User Management & Roles

Add, remove, and manage the people in your Nira organization, and understand exactly what each role can and can't do.

Written By Nira.app

Last updated 15 days ago

Prerequisites

  • Professional or Enterprise plan. User accounts and role-based access controls are not available on Individual or legacy plans.

  • Admin access. Only Administrators can add users, change roles, or deactivate accounts.

  • Familiarity with how you share assets today. If you only use public or password-protected links, see Share Options Overview first — you may not need user accounts at all.

Why Use User Accounts?

You can share assets with a simple URL or a password, and for many teams that's enough. User accounts add a more secure, revocable layer: you grant or remove access per person, keep an audit trail of who did what, and unlock collaboration features like markups and commenting. If you need to cut off access the moment someone leaves a project, user accounts are how you do it.

The Four Roles

Nira has four roles (also called privileges or user types). Assign the least-privileged role that still lets someone do their job.

Capability

Admin

Team Member

Contributor

External Guest

View all org assets

✅

✅

❌ (only assets shared with them)

❌ (only assets shared with them)

Edit assets

✅ (all)

✅ (all)

✅ (only assets they created or were granted)

✅ (only where granted)

Upload / create new assets

✅

✅

✅

❌

Delete assets

✅ (all)

✅ (all)

Own uploads

❌

Add / deactivate users

✅

❌

❌

❌

Manage billing & subscription

✅

❌

❌

❌

Access expiration date can be set

—

—

✅

✅

Admin — Complete control over the organization. Creates, views, edits, shares, and deletes all assets; manages users; manages subscription and payment. Assign sparingly.

Team Member — Same asset powers as an Admin (create, view, edit, share, delete all assets) but cannot manage other users or billing. This is the right role for trusted internal staff.

Contributor — Can upload new assets and automatically gets edit access to anything they create. They cannot see your organization's other assets unless an Admin or Team Member grants access per asset. Good for internal staff who should only touch their own projects.

External Guest — Can only access assets explicitly shared with them, at the View or Edit level you choose per asset. Cannot create assets. This is the role for clients and outside reviewers.

💡 Tip: For Contributors and External Guests, you can set an expiration date on their View or Edit access to a specific asset — useful for time-boxed client engagements.

Adding a User

  1. Log in as an Admin.

  2. Open the Admin panel (hamburger menu, top left → Users).

  3. Click + Add.

  4. Enter the person's email address — this is their unique identifier in Nira. A person can only have one account per email.

  5. Assign a role (see the table above).

  6. Save. The user receives an invitation to set up access.

ℹ️ Note: Email is the account identifier across every login method (magic link, password, SSO). If you invite someone, use the exact email they'll log in with — especially important for SSO, where the email must match their identity-provider account.

Granting Contributors and Guests Access to Specific Assets

Contributors and External Guests start with no access to your other assets. To grant it:

  1. Open the asset.

  2. Go to the Share… options → Users tab.

  3. Add the Contributor or Guest and choose View or Edit.

  4. (Optional) Set an access expiration date.

Repeat per asset. Access granted here can be revoked at any time by an Admin or Team Member.

Removing Access: Deactivate, Don't Delete

You cannot delete a user in Nira. You deactivate them. This is intentional — deleting a user would break chain of custody and collaboration history (who uploaded what, who commented, who measured).

To deactivate:

  1. Open the Admin panel → Users.

  2. Click Edit next to the user's name.

  3. Set the account to Deactivated.

A deactivated user immediately loses all access to your organization's private assets. Anything they uploaded — plus their comments and markups — remains in place; they simply can no longer reach it.

Connecting to SSO

If your organization uses an Enterprise plan with SSO, you can let users authenticate through your corporate identity provider (Okta, Azure AD, Google Workspace, or SAML) instead of managing separate Nira passwords. Note that Nira does not support automatic provisioning (SCIM) — you still invite each user manually, using the same email they use in your identity provider. See SSO & Login Troubleshooting for setup.

Troubleshooting

Problem: A new user I added can't see any assets.

Cause: They're a Contributor or External Guest, who see nothing until access is granted per asset.

Fix: Open each asset → Share… → Users and add them with View or Edit. Or, if they should see everything, change their role to Team Member.

Problem: I want a user to see only the callouts they created, not everyone else's.

Cause: This isn't supported. Callouts (and callout Type tags) are organization-wide. Every user with access to an asset sees all callouts on it.

Fix: There's no per-user callout visibility control. If client separation matters, keep each client's work in separate assets and grant access accordingly. See Callouts for naming-convention guidance.

Problem: I need to remove someone immediately — but there's no Delete button.

Cause: By design; users can't be deleted.

Fix: Deactivate the account (Admin panel → Users → Edit → Deactivate). This revokes access instantly while preserving history.

Problem: A Team Member can't access billing or add users.

Cause: Those actions are Admin-only.

Fix: Either perform the action as an Admin, or promote the person to Admin (do this deliberately — Admins can change billing and manage all users).

Problem: I invited a user but they're stuck in a login loop.

Cause: Usually a mismatch between how the account was created and how they're logging in (magic link vs. password vs. SSO).

Fix: See SSO & Login Troubleshooting, which walks through each loop scenario.

Technical Notes

  • Roles are org-wide, access is per-asset for Contributors and Guests. There's no concept of a "project" grouping beyond per-asset sharing.

  • No SCIM / auto-provisioning. Users must be invited manually, even with SSO.

  • Callouts and callout tags are org-wide — there is no per-user annotation visibility.

  • Deactivation is reversible; deletion doesn't exist. Reactivating a user restores their prior access history.

  • User accounts require Professional or Enterprise. Individual and legacy Core/Business plans don't include the role system.

  • One account per email address. The same email can't hold two Nira accounts.

Related Articles