Team Management: Invitations, Roles, and Permissions

Effective team collaboration requires proper access control and clear role definitions. TenancyDesk's enterprise RBAC (Role-Based Access Control) system ensures team members have exactly the access they need — no more, no less.

Understanding TenancyDesk's RBAC Architecture

TenancyDesk uses a two-level access control system:

Company Isolation (Multi-Tenancy)

Every user belongs to one company (your agency). This ensures:

• Complete data isolation: Agency A cannot see Agency B's data
• Automatic filtering: All API calls filter by company_id
• Audit compliance: Each action logged per company

Example: An agency with 25 agents has deals, contacts, and documents completely invisible to any other agency on TenancyDesk (multi-tenant isolation by company).

Role-Based Permissions

Within your company, users have one of 5 roles that determine their access level.

Important: Which roles are available depends on your subscription plan:

• Solo plan (149 AED/month): Admin only
• Starter plan (299 AED/month): All 5 roles (up to 5 users)
• Pro plan (599 AED/month): All 5 roles (up to 20 users)
• Enterprise plan (999+ AED/month): All 5 roles + custom roles (unlimited users)

---

The Five Team Roles

1. Admin (Company Owner / IT Manager)

Full system access — the highest permission level within your company.

Permissions:

• Access ALL deals (view, edit, delete)
• Manage ALL team members (invite, remove, change roles)
• Configure company settings (branding, RERA ORN, defaults)
• Manage billing and subscriptions
• Access ALL reports (company-wide, financial, compliance)
• Configure integrations (WhatsApp, API keys, webhooks)
• Export company data (full data exports, audit logs)
• Enable/enforce security policies (2FA requirement)

Typical holders: Agency owners, IT administrators, operations directors

Recommended limit: 1-3 Admins per company (for security)

---

2. Manager (Company-Wide Operations Lead)

Full company operational access without administrative controls.

Permissions:

• Access ALL deals in company (view, edit)
• View all team performance reports and statistics
• Assign/reassign tasks to any team member
• Approve deal stages (if approval workflow enabled)
• Access all contacts and properties
• View compliance dashboard and risk scores
• Cannot manage team members (invite/remove)
• Cannot access billing or subscriptions
• Cannot change company settings
• Cannot configure integrations

Typical holders: Operations director, company-wide operations lead

Best practice: Use for company-wide oversight, not individual team management (use Team Lead for that).

Available on: Starter, Pro, Enterprise (NOT Solo)

---

3. Team Lead (Team Manager / Supervisor)

Hierarchical team oversight — manages agents and property administrators in their team.

Permissions:

• View own team's deals (edit assigned)
• Assign deals to own team members
• View team performance reports (own team only)
• Complete own tasks
• Access contacts and properties related to team deals
• Cannot manage other teams
• Cannot invite/remove users
• Cannot access company-wide reports or billing
• Cannot see other teams' deals

Typical holders: Team supervisors managing 3-8 agents, shift leads

Best practice: Use Team Lead role for middle management between Manager and Agent.

Available on: Starter, Pro, and Enterprise plans

---

4. Agent (Sales Agent / Broker)

Individual sales focus — create and manage own deals.

Permissions:

• Create new deals
• Manage OWN deals only (deals they created or are assigned to)
• View basic contact information
• Upload documents to own deals
• Complete own tasks
• Track own commissions
• Cannot see other agents' deals
• Cannot access any reports
• Cannot see company-wide statistics
• Cannot modify company settings
• Cannot invite team members

Typical holders: Sales agents, leasing consultants, property brokers

Security benefit: If an agent leaves the company, they've only ever accessed their own deals — minimal data exposure risk.

Available on: Starter, Pro, Enterprise (NOT Solo)

---

5. Property Administrator (Office Administrator)

Operational support role — full company read access for Ejari prep, payment reconciliation, and document management.

Permissions:

• View all company deals, payments, tasks, and compliance
• Edit deals assigned to them (full edit access)
• Upload, verify, and organize documents
• Prepare Ejari / Tawtheeq registration
• View all payment schedules and track collections
• Browse all company properties and contacts
• Cannot create new deals or modify deal terms
• Cannot create or edit properties
• Cannot delete contacts
• Cannot view reports or analytics
• Cannot manage team or settings (except own profile)

Typical holders: Office administrators, Ejari/Tawtheeq specialists, document processors, payment reconciliation staff

Use case: Property Administrators see all company deals for document collection, Ejari preparation, and payment tracking while agents focus on client relationships.

Available on: Starter, Pro, Enterprise (NOT Solo)

---

Permission Matrix

*Team Lead can assign/reassign within their team

---

Inviting Team Members

Step-by-Step Invitation Process

Settings → Team → Invite Member

1. Enter email address: Must be unique (not already registered)
2. Select role: Choose from available roles (based on your plan):
   • Solo plan: Cannot invite (admin-only)
   • Starter/Pro/Enterprise: All 5 roles (Admin, Manager, Team Lead, Agent, Property Administrator)
3. Add personal message (optional): "Welcome to the team!"
4. Click Send Invitation

What the invitee receives:

• Email with secure invitation link
• Your company name and logo
• Role they're being invited as
• Link expires in 7 days

Invitation states:

• Pending: Invited but not yet accepted
• Accepted: User created account, now active
• Expired: 7 days passed without acceptance
• Revoked: Admin cancelled before acceptance

Resending or Revoking Invitations

To resend: Settings → Team → Pending Invitations → Click "Resend"

To revoke: Settings → Team → Pending Invitations → Click "Revoke"

---

Managing Existing Team Members

Changing a User's Role

Settings → Team → Click user → Edit Role

Important considerations:

• Role changes take effect immediately
• User sees different navigation/features on next page load
• Audit log records: who changed, from what role, to what role

Common role change scenarios:

• Junior agent promoted to team lead: Agent → Manager
• Admin going on leave: Temporarily assign another Admin
• Contractor finishing project: Manager → Property Administrator (reduced access)

Deactivating vs. Deleting Users

Deactivation (Recommended):

• User cannot log in
• All their deals remain accessible
• Historical activity preserved
• Can be reactivated later
• Use when: Employee leaves, temporary suspension

Deletion (Permanent):

• User account removed
• Deals reassigned to selected user
• Activity history anonymized
• Cannot be undone
• Use when: Test accounts, GDPR erasure request

To deactivate: Settings → Team → User → Toggle "Active" off

To delete: Settings → Team → User → "Delete User" → Confirm

---

Activity Monitoring

User Activity Log

View per-user activity: Settings → Team → User → "Activity"

Logged actions:

• Login times and IP addresses
• Deals created, edited, deleted
• Documents uploaded
• Tasks completed
• Settings changed

Retention: 30 days (Solo), 90 days (Starter), 180 days (Pro), 365 days (Enterprise)

Team Performance Dashboard

Reports → Team Performance

Metrics tracked:

• Deals created per user (this month)
• Average deal completion time
• Document upload rate
• Task completion rate
• Login frequency

Use cases:

• Identify top performers for bonuses
• Spot agents needing additional training
• Track onboarding progress for new hires

---

Best Practices for Team Management

Recommendations from 500+ UAE real estate agencies:

1. Principle of Least Privilege

• Start with the lowest possible role
• Upgrade only when necessary
• Review permissions every 3 months

2. Separation of Duties

• Don't grant same person "create deal" and "financial approval" roles
• Use separate Property Administrator for administrative document uploads
• Keep API access for Admins only

3. Regular Access Reviews

• Review team member list monthly
• Remove or deactivate inactive accounts (>30 days without login)
• Audit permission changes quarterly

4. Security

• Make 2FA mandatory for Admin and Manager roles
• Use strong passwords (12+ characters, special symbols)
• Monitor login logs for unusual activity
• Deactivate inactive accounts immediately when employee leaves

5. Training and Documentation

• Provide role-based training for all new members
• Keep role responsibility docs updated
• Create SOPs (Standard Operating Procedures) for each role
• Use TenancyDesk training videos

6. Audit Trail

• Enable audit logging for all changes
• Review audit logs weekly for sensitive changes
• Export audit logs for compliance reviews

---

Common Questions

Q: Can I have multiple Admins? A: Yes. We recommend 2-3 for redundancy. If one Admin is unavailable, others can manage the team.

Q: What happens to a user's deals when they're deleted? A: You'll be prompted to reassign their deals to another active user. Deals are never lost.

Q: Can I temporarily promote someone to Admin? A: Yes. Change their role to Admin, then change back when no longer needed. All changes are audit-logged.

Q: How do I see what permissions a role has? A: This article! Or Settings → Team → "Role Permissions" (shows permission matrix).

Q: Can I create custom roles? A: Custom roles are available on Enterprise plan. Contact support to configure.

---

Enterprise Features

Available on Enterprise plan:

• Custom roles: Define granular permissions beyond the 5 standard roles
• Multi-branch isolation: Agents only see deals in their branch
• SSO integration: Login via company's identity provider (Okta, Azure AD)
• API access and webhooks: Programmatic integration with external systems
• Bulk operations: Import/export large datasets
• Advanced audit: Extended retention (365 days), detailed export

Contact sales: enterprise@tenancydesk.com

---

Master team management, and your agency will scale securely without access control chaos.