Users, roles and two-factor sign-in

Everyone on your team signs in with their own account. A role decides what each person can see and do, location access decides which of your rooftops they work with, and two-factor sign-in keeps accounts safe even if a password leaks.

Invite a team member #

1. Open Settings › Users.
2. Under Invite a team member, enter the person's email and pick a role.
3. Select Send invitation.

(open full size)

1. Email. Where the invitation goes.
2. Role. What they can do once they join. Salesperson is preselected.
3. Send invitation. Emails a link that works once and expires after 72 hours.
4. Locations. "All" or "Limited" (see location access).
5. MFA. Whether the person has turned on two-factor sign-in.

Unanswered invitations appear under Pending invitations, where you can Revoke them. To resend, revoke the old one and invite again.

What the invited person does #

1. Opens the link in the invitation email.
2. If they are new to MotoDealerHQ, they choose their name and a password of at least 12 characters. If they already have an account, they sign in first, then open the link again.
3. The invitation only works for the email it was sent to.
4. If their role requires two-factor sign-in, they set it up at their first sign-in.

Change someone's role, access or locations #

1. On Settings › Users, select Edit next to the person.
2. Change what you need and select Save.

(open full size)

1. Role. Takes effect on their next click; they don't need to sign out.
2. Access. Active, or Suspended to block sign-in to this dealership without deleting anything.
3. Job title. Shown under their name in the Users list.
4. Locations. Access to all locations, or only the ones you tick.

Location access #

When Access to all locations is unticked, the person only sees the inventory, leads and appointments of the locations you tick. Use this for staff who work at one rooftop of a group. See Locations for setting up rooftops.

Remove someone #

Select Remove next to the person and confirm. Their account is taken off this dealership; it isn't deleted, so they keep access to any other dealership they belong to. If the person has CRM history (leads, tasks or appointments), MotoDealerHQ suspends them instead so the history stays intact. Reassign their leads first if you want to remove them fully.

Rules that keep accounts safe #

• You can only give someone a role whose permissions you already have yourself.
• Only an owner can make someone an owner, or change an owner.
• Nobody can change their own role, suspend their own access or remove themselves.
• The dealership must always keep at least one active owner.
• Someone limited to some locations can only manage staff limited to those same locations, and can't grant "all locations".
• Inviting counts toward your plan's Staff accounts limit, including pending invitations.

Roles #

Open Settings › Roles to see every role, how many permissions it has and how many people hold it.

(open full size)

1. New custom role. Build your own role from the permission list.
2. Type. System roles come with every dealership and can't be edited. Custom roles are yours.
3. Members. How many people hold the role.

The standard roles #

Select View on a system role to see its exact permissions.

Create a custom role #

1. On Settings › Roles, select New custom role.
2. Enter a Name and a short Description.
3. Tick the permissions the role needs. They are grouped by area (Core, Inventory, CRM, Service and so on), and each shows its key, for example leads.view_own.
4. Select Save role, then assign it on Settings › Users.

To delete a custom role, open it and select Delete role. You can only delete a role that no one holds and no pending invitation uses.

Two-factor sign-in #

Two-factor sign-in (also called MFA) asks for a 6-digit code from an authenticator app after your password.

Who must use it #

• Owners always must.
• By default, General Managers must too.
• Owners and General Managers can require it for more roles: open Settings › Settings & domains, tick roles under Security, and select Save settings.
• MotoDealerHQ can also require it for every dealership user.

Anyone else can turn it on voluntarily from My account. We recommend it for everyone.

Turn it on #

1. Open My account from your profile menu and select Enable two-factor. If your role requires it, the console takes you there at sign-in.
2. Open an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.
3. Scan the QR code. If you can't, select Copy key and add the account by hand (time-based, 6 digits, 30 seconds).
4. Enter the current 6-digit code and select Enable two-factor.
5. Save the 8 recovery codes somewhere safe, such as your password manager. They are shown only once. Select I have saved them — continue.

Signing in #

1. Enter your email and password as usual.
2. Enter the 6-digit code from your app, or one of your recovery codes.
3. On a computer or phone only you use, you can tick Remember this device for 30 days. You still need your password; only the code is skipped. Changing your password ends all remembered devices.

Lost your phone? #

1. Sign in with one of your recovery codes instead of a code. Each recovery code works once.
2. To move to a new phone, go to dealer.motodealerhq.com/mfa/setup while signed in, scan the new QR code and enter a code from the new phone. This replaces the old authenticator and gives you a fresh set of recovery codes.
3. If you only need new recovery codes, open My account and select Generate new recovery codes. The old codes stop working.

To stop skipping the code on remembered devices, select Forget remembered devices on My account. See also Two-factor sign-in and sessions.

Permissions #

Limitations #