How do I manage multi-tenant access?
Required Feature Flags
The following feature flags and permissions are required to use this feature:
Feature Flag | Description |
Move Users | Lets you move or copy a user between contracts in your organisation without contacting support. |
Required Permissions:
Manage Users (
admin.org.users.manage) — to add, edit, and remove users in your contract
In evaluagent, a user account is global. The same person can have access to more than one contract (also called a tenant) in your organisation, with different roles and team assignments in each.
This guide explains how to give an existing user access to another contract you administer, and what stays shared versus per-contract.
What's Shared vs Per-Contract
Attribute | Scope |
Username | Shared across all contracts |
Email address | Shared across all contracts |
Password | Shared — one password works everywhere |
Authentication method (SSO/password) | Shared — applies to every contract |
Name and profile photo | Shared |
Roles | Per-contract |
Team assignment | Per-contract |
Reporting access | Per-contract |
Telephony / 3rd party system username | Per-contract |
Language preference | Per-contract |
A user picks which contract to enter when they log in. They can switch between contracts without logging out.
Step 1: Check if the User Already Exists
Before adding someone new, search your user list. If you try to create a new user and see _"The username has already been taken"_ or _"The email has already been taken"_, the account already exists somewhere in evaluagent — your job is to link it, not create a duplicate.
Step 2: Add the User to Another Contract
If the Move Users feature is enabled on your contract:
Go to User Management > Add & Edit Users in the contract you're currently logged into.
Find the user in the list.
Click the Actions menu at the end of their row.
Click Add to contract.
In the pop-up, pick the destination contract.
Choose whether to keep the user in the current contract or remove them. By default they keep access to both.
Click Save.
The user's roles are copied to the destination contract where matching roles exist. Their telephony settings (switch ID) come across too.
If the Move Users feature isn't enabled, contact evaluagent support with:
The user's email or username
Your contract name (the one to add them to)
The roles they should have
Their team (if they're an agent)
Step 3: Set Up Their Access in the New Contract
Once the user appears in the new contract, edit them like any other user to:
Assign the right roles
Pick the correct team (for agents)
Set hierarchy reporting access (for non-agents)
Configure telephony and other per-contract settings
Authentication Across Contracts
A user has one authentication method, and it applies everywhere. If they're assigned to SSO, they use SSO for every contract. If they use a password, they use the same password for every contract.
This means:
A user can't have SSO for one contract and a password for another.
A user can't use one SSO provider for one contract and a different SSO provider for another.
If you need to change a user's authentication and they have multi-contract access, coordinate with the other admins first — the change affects all contracts they're in.
Removing a User from a Contract
Click the Actions menu on the user's row and select Remove from contract. This only works if they still have access to at least one contract afterwards.
If the person is no longer with your business, deactivate them instead — that way reports keep working but they can't log in.
Sandbox Contracts
A sandbox (demo) contract counts as a separate tenant. To grant a user sandbox access, use Add to Sandbox from the Actions menu. They'll get administrator and system access roles in the sandbox automatically. Sandbox contracts have some restrictions — bulk upload and direct user creation are disabled, for example.
Troubleshooting
"The username/email has already been taken" — the user already exists in another contract. Use Add to contract, or contact support to link them.
User can't log in after being added — make sure they have roles assigned in the new contract, and that they're picking the right contract at login.
SSO redirects to the wrong identity provider — the user is assigned to a different SSO provider in another contract. Authentication is global, so contact support.
User unexpectedly deactivated everywhere — another contract probably deprovisioned them via SCIM. Contact support to reactivate, then reassign roles and teams.