Administration: organisation, people and access

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Find the people and access screens, and check who can do whatThis lesson is for administrators. You will find the screens that hold your organisation's people and structure, learn what each tab of Access control is for, and answer a common question from managers and auditors: who is able to do a particular thing on a particular company, and which role gives them that right.6 min
2. 2Add a legal entityThis lesson is for organisation administrators. You will register a new legal company in the group and learn what every field of the form is for: its identity, legal structure and jurisdiction, its trade licence and tax registrations, its revenue bracket, its tax set-up and its headcount.9 min
3. 3Finish the set-up and edit the entity's profileThis lesson is for organisation administrators. You will finish the set-up of the company added in the last lesson, then open Entity settings to edit its profile: the emirate used on tax returns, the headcount, and the contact details printed on invoices. You will also see where the same profile appears in Organisation settings and which fields are locked.8 min
4. 4Build the organisation structure with unit types and unitsThis lesson is for access administrators. You will describe how your group is organised by naming the levels of the structure, called unit types, and by adding a region and a store under head office. Roles can then be given for a region or a store instead of for the whole organisation. You will also edit a unit and filter the list.8 min
5. 5Place entities in the units of the structureThis lesson is for access administrators. You will move two legal entities from Head office into the UAE Operations region, so that a role given on that region covers both companies. You will also see why a unit that holds entities cannot be deleted.5 min
6. 6Set up departments inside an entityThis lesson is for access administrators. You will create a department inside one legal entity, give it a head and the modules it handles, rename it, and then see how it appears as a unit in the organisation structure. You will also see why a department cannot hold roles that manage access.7 min
7. 7Read the Team list and invite peopleThis lesson is for access administrators. You will read the Team list, which shows everyone in the organisation with the roles they really hold, and invite two new people: one with no role yet, and one with a first role that is limited to a single company and to read-only. You will also remove a person who was invited by mistake.8 min
8. 8Read the built-in roles and create a custom roleThis lesson is for access administrators. You will read what a built-in role allows, including the Organisation administrator role and Full access, then create a custom role that lets someone see the access set-up and read the audit log without changing anything. You will also copy a template, edit the copy and archive it.9 min
9. 9Grant roles for an entity, a unit, a department or the whole organisationThis lesson is for access administrators. A role says what a person may do; the scope says where. You will grant four roles, each with a different scope: one legal entity, an organisation unit with the units beneath it, a department, and the whole organisation. Then you will read the result for one person and for everyone.9 min
10. 10Request a privileged role that needs a second administratorThis lesson is for access administrators. Some roles are privileged, because they let their holder manage access or the organisation itself. You will read the approval policy that covers such roles, then grant the Org unit administrator role to a regional manager and see that it waits for a second administrator instead of taking effect at once.6 min
11. 11Approve a colleague's request for a privileged roleThis lesson is for the second administrator. A colleague has asked for a privileged role to be given to a regional manager. You will find the request in your Approvals inbox, read what is being asked, approve it with a comment, and confirm that the role is now held.5 min
12. 12Give read-only and time-limited access, then change and revoke itThis lesson is for access administrators. You will give a colleague a role that is read-only and ends by itself on a set date, see what emergency access is, extend the end date by editing the grant, and then revoke the grant and find it again among the expired and revoked ones.8 min
13. 13Give a role to a team with a groupThis lesson is for access administrators. When several people need the same access, a group saves work: you grant the role once to the group, and everyone in it holds the role. You will create a group, choose its members, grant it a role on one entity and see how the role appears for a member.6 min
14. 14Arrange cover for an absence with a delegationThis lesson is for access administrators. A delegation lets a named deputy act on a colleague's behalf for a set period, without giving the deputy a new role. You will set up cover for a compliance officer who is going on leave, limited to one permission on one company, and find it in the list of everyone's delegations.6 min
15. 15See how the organisation always keeps one full-access administratorThis lesson is for access administrators. An organisation must always keep at least one active administrator with Full access over the whole organisation and no end date, otherwise nobody could grant a role again. You will see the system refuse two changes that would break this rule, and you will put everything back as it was.6 min
16. 16See who has access to an entity, and who can read the audit logThis lesson is for administrators and for anyone who answers an auditor's questions. You will open the Team tab of an entity, which lists everyone who can reach that company and how each role reaches it. Then you will check which people hold the permission to read the audit log, and find the access changes from this course in the audit log itself.8 min
17. 17Start an access review and decide the grantsThis lesson is for access administrators and reviewers. An access review is a regular check in which a reviewer confirms or removes every role grant in one part of the organisation. You will start a review of the UAE Operations region, keep the grants that are still needed, revoke one that is not, and close the review so that it stands as a record.9 min
18. 18Review the whole organisation, and see why you cannot decide your own accessThis lesson is for access administrators and reviewers. A review of the whole organisation includes the administrators' own roles. You will start one, keep the other grants, and see that the grants about your own access carry the badge Needs another reviewer: you cannot keep or revoke them, and the review cannot be closed until a second person decides them.6 min
19. 19Decide a colleague's own access and close the reviewThis lesson is for the second reviewer. A colleague has run an access review and could not decide the grants about her own access. You will find the review from the left menu, decide those grants, close the review and open the closed record with every decision in it.5 min
20. 20How this connects: follow one grant through the productThis lesson is for administrators. It ties the course together by following a single grant. You will give one person one role on one entity, and then find that grant everywhere it shows up: in the Team list, on the entity's Team tab, in the answer to Who can, and in the audit log. The next lesson signs in as that person to see what changed for her.7 min
21. 21How this connects: what the person sees after the grantThis lesson is for administrators and for anyone who has just been given a role. You will sign in as the person from the previous lesson and see exactly what one grant changed: a second company in her list, a Tax section in the left menu for that company only, working buttons inside Tax, and the role on her profile. You will also see what she still cannot open.6 min

How this connects to the rest of ComplianceOS

• Every module

  Roles decide which modules a person sees in the left menu and what they can do in each. The scope of a grant, an entity, a unit, a department or the whole organisation, limits where. Shown live in the closing lessons.

• Entities

  A new legal entity appears in the Entities list, in the organisation structure under Head office, and in the Where list of every grant. Its Team tab lists everyone whose roles reach it and how.

• Approvals

  Granting a privileged role waits for a second administrator in the same Approvals inbox as other requests, under the approval policy saved for access changes.

• Departments

  A department created in an entity's settings is a unit in the organisation structure under its entity's unit. People join it by holding a role on it, and that role applies to the department's whole entity.

• Audit log

  Every grant, change, revocation, delegation and review decision is recorded in the audit log with the actor and the time. Reading the audit log is a permission of its own.

• Access reviews

  Every active grant becomes an item in the next access review that covers it. Closed reviews are kept as the record an auditor asks for.