Members and roles

Access in Fresco BI has three layers. An organization role says what a person can do in the whole organization. A workspace role says what they can do in one workspace. A share gives access to one item. This page covers the first two. For shares, see Share a report.

Organization roles

Every organization has exactly one Owner.

Can do	Owner	Admin	Member
Use the workspaces they belong to	Yes	Yes	Yes
Admin of every workspace	Yes	Yes	No
Create and delete workspaces	Yes	Yes	No
Invite, suspend and remove Members	Yes	Yes	No
Invite, suspend and remove Admins	Yes	No	No
Change a role between Admin and Member	Yes	No	No
Gateways, Trash, Activity log, sign-in rules	Yes	Yes	No
Transfer ownership, delete the organization	Yes	No	No

A Member has only the rights given by their workspace roles and shares.

Note

On the Free and Pro plans, the people you add are always Members and can only view reports. Only Enterprise organizations have more than one person who builds content. See Plans and limits.

Workspace roles

Can do	Admin	Editor	Viewer
Open the workspace and view its reports	Yes	Yes	Yes
Create Data Tables, data models and reports	Yes	Yes	No
Share items	Yes	Yes	No
Use data sources in Data Tables, test them	Yes	Yes	No
Create, edit and delete data sources	Yes	No	No
Open the workspace Trash	Yes	Yes	No
Rename the workspace, manage its members	Yes	No	No
Create embed keys	Yes	No	No

A workspace always keeps at least one Admin. Organization Owners and Admins are Admin of every workspace, even if they are not in its member list.

Before you start

• To invite people, you need the Owner or Admin role in the organization.
• To add people to a workspace, you need the Admin role in that workspace.
• The Free plan has no other members. To invite people, upgrade to Pro first.

Invite people to the organization

1. On the Home page, click Invite members.
2. Click Invite member.
3. Enter the person’s Email.
4. Pick a Role. An Admin can only invite Members.
5. Click Create invite.

Fresco BI does not send an e-mail. Tell the person yourself to sign in to Fresco BI with that address. They join the organization when they sign in with a verified e-mail.

Caution

An invite expires after 7 days. Open invites count toward the member limit of your plan.

You can also open Organization settings and click Members. This is the way to reach the members page in a Pro My org. See Organizations and workspaces.

Pending invites

The Pending invites list shows each invite with its Status: Awaiting acceptance or Joined. An expired invite shows Expired.

• To cancel an invite, click Revoke.
• To send an invite again, invite the same e-mail again. If an open invite already exists, revoke it first.

You can create up to 50 invites per hour.

Add people to a workspace

The person must already be a member of the organization.

1. Open the workspace.
2. In the sidebar, under Workspace, click Members.
3. In Add to workspace, pick a person in Search organization members, or a group in Search groups.
4. Pick a role: Admin, Editor or Viewer.

Each change saves at once. To change a role, pick a new one in the list. To take someone out, click Remove.

On Free and Pro, people you add to a workspace are always Viewer.

User groups

A user group is a named set of organization members. One group works in many workspaces and in row-level security roles, so you give access once instead of person by person.

1. Open the workspace.
2. In the sidebar, under Workspace, click User groups.
3. The list shows Group name, Members and Role in this workspace. Search groups with Search groups.

Only organization Owners and Admins create, rename and delete groups (New group). Deleting a group moves it to the Trash; you can restore it. Its role in every workspace, its row-level security roles and its data model permissions stop at once, and its members are kept.

Pick a Role in this workspace for a group (Admin, Editor or Viewer), or leave it empty. Click a group to open its page. It has four tabs:

Tab	What it does
Permissions	Report view permission: a tree of the reports of the workspace and their pages. Tick a report to give every page, pages added later included, or tick single pages.
Assignments	The members of the group. Add member with Search organization members, and Remove.
Data table permission	Read only. Access to Data Tables follows the workspace role: you do not give it to a group. Row-level security lives on the data model, and direct access to a Data Table would go around it.
Data model permission	Give a group Read (view the reports built on the data model, with row-level security) or Build (create new reports from it). The effective permission is the higher of the workspace role and this grant. It counts only while the group has a role in the workspace.

On Free and Pro, the people you add can only view reports, so Build cannot be given.

Permission for single report pages

By default a Viewer sees every page of a report they may open. Once you give any group a page of a report in the Permissions tab, the report is limited by page:

• A Viewer, and a person who has the report shared with Read, sees only the pages given to the groups they belong to. A report with no page for them does not exist for them: it is not listed and does not open.
• Editors and Admins of the workspace, organization Owners and Admins, and people with Build on the report always see every page.
• A page added to a limited report later stays hidden from a group that has a page list until you tick it. A group with the whole report ticked sees the new page.
• The limit applies in the viewer, in the data behind each visual, in export and PDF, in drill-through and in shares. It does not apply to an embed, which shows the whole report as published, nor to an Application, which has its own audience.
• Page permission hides pages. It is not a rule on data: use row-level security for that.

Use View as to check what a person sees.

Change an organization role

Only the Owner changes roles.

1. On the Home page, click Invite members.
2. On the person’s row, open the menu.
3. Click Change to Admin or Change to Member.

Transfer ownership

1. On the new owner’s row, open the menu.
2. Click Transfer ownership and confirm.

You become an Admin. Only the new owner can transfer it back. The new owner must have a verified e-mail. The Owner cannot leave or change their own role before transferring ownership.

Suspend a member

A suspended member stays in the organization but cannot use it.

1. Open Organization settings and click Members.
2. On the person’s row, click ….
3. Click Suspend.

To give access back, click Lift suspension.

Reset two-step verification removes a member’s second step, for example when they lost their phone. Fresco BI asks you to sign in again first.

Remove a member

1. On the Home page, click Invite members.
2. On the person’s row, open the menu.
3. Click Remove from organization and confirm.

The person loses access at once. Their roles, groups and shares are kept for 30 days, so you can bring them back. After 30 days they are deleted for good. The reports and Data Tables they made stay in their shared workspaces.

In a company organization the person also has a private My workspace. The dialog shows what it holds (for example “2 reports, 3 data tables”) and asks Move content to…. Pick a shared workspace in Workspace to receive the content to move everything there. Or pick Don’t move: send to Trash: the whole My workspace goes to the Trash with the person, and comes back if you restore them. You cannot read the content of their My workspace.

To leave an organization yourself, click Leave organization on your own row.

Restore a removed member

1. Under Removed members, find the person.
2. Click Restore.

They get back their roles, groups and shares. Restore is refused when the organization has no free seat.

Export the member list

1. Open Organization settings and click Members.
2. Click Export CSV.

The file holds up to 50,000 rows. Each admin can export 5 times per hour. Every export is written to the Activity log.

Questions

The person never got an invite e-mail. Fresco BI sends none. Send them the sign-in link yourself.

Can an Admin remove another Admin? No. Only the Owner can.

What happens to content when I remove someone? Their reports and Data Tables in shared workspaces stay. Their private My workspace is moved to a shared workspace of your choice, or goes to the Trash.