People and roles
Inviting your team into an estate, and what each of them can change once they are in.
An estate is the account that owns your agents, targets and alerts. A person can belong to several, with a different role in each: an owner of your company's estate and a viewer of a customer's, say. The role always belongs to the person in that estate, never to the person.
The four roles
Each role can do everything the one before it can, and more.
| Viewer | Member | Admin | Owner | |
|---|---|---|---|---|
| See the overview, targets, graphs, alerts, the fleet and credential names | ✓ | ✓ | ✓ | ✓ |
| Add, change and delete targets, target groups, checks and alert rules | ✓ | ✓ | ✓ | |
Add checks that run commands you supply (script, agent_exec) |
✓ | ✓ | ||
| Declare, change and delete credentials | ✓ | ✓ | ||
| Approve, suspend, rename and delete agents; create and revoke enrolment keys | ✓ | ✓ | ||
| See who is in the estate; invite people, change their roles, remove them | ✓ | ✓ | ||
| Make someone an owner; change or remove an owner | ✓ |
Command-running checks need admin rather than member because they run arbitrary commands on your machines. Anyone who can add or edit one can run whatever they like wherever that agent reaches.
Inviting someone
You need to be an admin or an owner. Open Members in the top bar, enter their email address, choose a role and press Send invitation.
They get an email with a link, valid for 7 days. It works the same whether or not they already use MetricHarbor:
- New to MetricHarbor: the link asks for their name and a password, then signs them straight in to your estate. It does not create an estate of their own, which is what ordinary sign-up does.
- Already has an account: the link asks them to sign in, then offers Join. Your estate is added to their account alongside the ones they already have. The name in the top bar links to Account, where they switch between estates.
They appear under Members once they have accepted. Until then they are listed under Invited.
Send again gives them a fresh link and stops the old one working. Withdraw cancels the invitation.
Changing a role, or removing someone
On Members, pick a new role on their row and press Save, or press Remove.
Both take effect on that person's next request, without waiting for them to sign out. Someone removed while they have a page open gets an error on the next thing they click. They keep their account and any other estates they belong to.
Three rules apply. The page only offers what they allow:
- Nobody grants a role above their own. An admin can invite admins, members and viewers, but not owners.
- Nobody changes someone who outranks them. An admin cannot demote or remove an owner.
- An estate always keeps an owner. The last owner cannot be demoted or removed. To hand the estate over, make the new person an owner first, then step down.
You cannot remove yourself from Members.
When it does not work
The email never arrived. Check their spam folder first. Right after you send an invitation, the Members page shows the link itself, once. Copy it and send it to them some other way. If you have already left that page, press Send again for a new link. The link is never shown again, because MetricHarbor keeps only a fingerprint of it.
"This invitation is invalid or has expired." The link is more than 7 days old, has already been used, was withdrawn, or was replaced by a newer one. Press Send again.
"This invitation was sent to … and you are signed in as …" Only the account the invitation was addressed to can accept it. That stops a forwarded link handing the role to whoever is signed in on that browser. Press Not you? Sign out, which comes back to the invitation, and sign in with the right account. If they use a different address, invite that one instead.
"You already have a MetricHarbor account." The address already has an account, so the link wants a sign-in rather than a new password. Sign in, and the invitation offers Join. If the password is forgotten, use Forgotten your password? on the sign-in page.
"… is already in this estate." They are a member already. To give them a different role, change it on their row instead.
"Too many invitations sent from this estate." An estate can send 30 invitations an hour. Wait, then carry on.
There is no Members link. You are a member or a viewer. Ask an owner or an admin of the estate.