> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/admin/organisation/inviting-auditors.md).
# Inviting co-auditors
Inviting fellow auditors via Options → Organisation → Users.
To invite fellow auditors, you need to navigate to Options within Engyon. Within the options, there is an Organisation screen. For this, you need the Admin role at the audit firm. The invitation does not yet grant access to an audit.
See [Organisation](/engyon/en/admin/organisation.md) for the screen and [Roles and permissions](/engyon/en/reference/settings/roles-and-permissions.md) for what each role is allowed to do.
## Manual invitation
1. Go to Options in the bottom left and open Organisation.
2. Open the Users tab.
3. Click on the icon plus (:plus:) Auditor in the top right.
4. Fill in the **email address** of the person you are inviting.
5. Choose the role at the audit firm. What each role is allowed to do is stated in [Roles and permissions](/engyon/en/reference/settings/roles-and-permissions.md).
6. Click on Create.
The invitee will receive an email to create a profile.
{% hint style="info" %}
After the invitation, the user does not yet have access to audits. Assign them afterwards in the audit under Settings → auditor team.
{% endhint %}
You invite a **client user** on the client organisation (Users tab, Client button), not here. See [Setting up client access](/engyon/en/how-to-guides/sources/set-up-client-access.md).
### How long is the invitation valid?
An invitation is valid for **7 days**. With SSO, we do not check if the invitation is still valid. This is because in that case, we do not share a link that could fall into the wrong hands (an invitation that expires makes that chance slightly smaller).
## In the Users table
On the same table, in the last column:
| Action | Icon | When |
| ------ | ------------------------------------------------------------------------------ | ---------------------------------------------------------- |
| Edit | icon pencil (:pen:) | Role of an active user, or an outstanding invitation |
| Renew | icon renew (:sync-alt:, tooltip `Renew invitation`) | The invitation has the tag expired (7 days) |
| Delete | icon bin (:trash:) | Confirmation: *Are you sure you want to delete this user?* |
If users are managed via SCIM, these icons are disabled: roles come from the identity provider.
The bin icon (:trash:) on an active user leaves that user in place, but they can no longer log in. The roles at the audit firm and on the audits are removed. The audit trail in existing audits remains.
If you only remove someone from an audit, with the bin icon (:trash:) next to the name under Settings → auditor team or client team, only that role is removed. The user can still log in. The audit trail in that audit remains.
## Automatic creation (SCIM)
In addition to manually inviting users in Engyon, it is also possible to create users automatically. For this, Engyon offers a SCIM 2.0 integration. This integration can be configured in the left column of the Organisation screen. If the organisation has *single sign-on* configured, the heading Provisioning is shown in the left column.
1. Click next to Provisioning on the icon plus (:plus:). This opens a screen where a name can be given to the integration. This name is purely for identification purposes.
2. Give the integration a **name** and save.
3. Once the integration is created, the details needed to set up the SCIM integration at the identity provider are shown. This concerns the **base URL** and the **bearer token**. Save the token in a safe place, as it cannot be shown again later (a new token can be created though).
It is only possible to give users access to Engyon with a specific role within the audit firm. Therefore, users cannot receive a role at a client organisation or on an audit via SCIM.
After creation, you can choose pause, Generate token, or Delete via the icon ellipsis (:ellipsis-vertical:).
{% file src="/files/iBgqQBlRGjEGHuV6nEeQ" %}
Technical documentation of the SCIM integration.
{% endfile %}
### Recovery codes at the first login
When you log in for the first time, you use the authenticator app. When you log in with this, you arrive at a page with recovery codes. Keep them: they are intended if someone loses the authenticator app. In that case, a recovery code can be used to get back into the application and subsequently reset the MFA. See [Resetting a user and recovering the MFA](/engyon/en/frequently-asked-questions/setup/resetting-a-user-and-restoring-mfa.md).
If logging in with SSO, no authenticator app is required.