Editing a user — details, activity, and IP restrictions

The Edit user action opens a panel with the account details.

Step by step

1. Go to Configuration → Team & Access → User Accounts.
2. Find the person using the search above the table or the All roles, All departments, and All statuses filters.
3. Open the three-dot menu in their row and choose Edit user. The Edit user panel slides out on the right.
4. Update the login details: Full name, Username, Email.
5. To give the user a new password, click Send new password and confirm in the dialog. There is no field for entering a password — Noxti sends a temporary password to the user’s email. This requires company administrator permissions, and the button is hidden if the account has no email address (Forgotten password and blocked access — what an administrator can and cannot do).
6. Set Roles, Departments, and Warehouses. The warehouse list narrows to the selected departments.
7. Use the Active switch to enable or disable the account.
8. To restrict sign-in, enter an address in IP restrictions, in the Enter an IP address (e.g. 192.168.1.1) field, then press Enter or click the plus button beside it. The address appears as a chip; click its X to remove it.
9. Click Update user.
10. If a window asks for a 2FA code, enter it. Confirmation remains valid for 15 minutes, so the system will not ask again for subsequent saves (2FA confirmation when changing permissions).

What you can change

You can change the full name, username, email, roles, departments, warehouses, and Active switch. You cannot set a password manually — you can only send a new temporary one with Send new password.

Four fields — username, email, Active, and IP restrictions — are treated as account takeover and follow the same rank rule as sending a new password: you cannot change them for someone above you (Forgotten password and blocked access — what an administrator can and cannot do). The restriction applies only when the value actually changes — opening the panel and saving without changing those fields is allowed.

What you cannot change here

The panel does not touch a user’s personal settings: theme, language, time zone, date format, photo, phone, or scanner and notification preferences. Each person sets those in their own account (My account — five tabs and what each contains). An administrator cannot set someone else’s theme or change their notification preferences.

You also cannot change someone else’s 2FA settings; see Forgotten password and blocked access — what an administrator can and cannot do.

IP restrictions

The allowed-address section accepts IPv4 and IPv6 addresses as chips. The rule is simple:

• empty list = sign-in from any address,
• non-empty list = sign-in only from the listed addresses.

Be careful with remote workers and dynamic IP connections. If the provider changes the address, the person is locked out and cannot unblock themselves.

Deactivating an account

The Active switch deactivates the account. A deactivated user is denied when trying to sign in, and the event is recorded in login history as a failed attempt with reason “account inactive”.

Deactivation has a side effect you should know about: it clears all of the person’s trusted 2FA devices. After the account is re-enabled, they must enter a code the first time they sign in from each device.

There is no separate “deactivate” action in the row menu — you must open the edit form.

Deactivation or deletion

• Deactivation — the account and history remain, but access is removed. Use it for leave, suspension, or an investigation.
• Deletion — removes the person from the company, but does not delete their account (Removing a user — remove them from the company, not their account).

When an employee leaves, a sensible order is to deactivate them first, then remove them from the company once you know they are not returning.