Principal users

Principal users at a glance

A principal user is an administration record for the identity, access choices, approval limits, authentication choice, and profile image used by a principal user in PAMS. The Principal users surface uses one screen for a new record and for an existing record.

Before you start

Prerequisites

• Know whether you are creating a principal-user record or changing an existing one.
• Have the identity information and access choices ready before you select a save action.
• You need edit access for Save and Save and Close to be available after you make a change.
• The record and its credential information must be loaded before their fields can appear.
• The form must pass its validation before it can save.

Unsaved changes affect the close action. When you have edit access and the current values differ from the saved values, leaving the page opens a confirmation choice instead of leaving immediately.

Note: Use the required markers beside the fields as your check before selecting a save action.

Find or open a principal user

Use a principal-user record to maintain one person's identity and access settings.

Steps

1. Open the security users area.

2. Choose the route that matches your task:

   If you need to…	Choose
   Start a new record	Select the option to create a new principal user.
   Change an existing record	Select the principal user in the users list.
   Change a profile image	Select the principal user in the users list.

3. Confirm that the page heading identifies the principal-user record before entering values.

Result: The principal-user screen is open at the new-record route or at the existing record you selected.

Understand the principal-user screen

The screen groups identity information, access choices, approval settings, two-factor authentication, and profile-image controls. The new-record screen shows Email, Title, the person's given name, Middle Name, Last Name, Display Name, and Mobile.

The following fields are required on the new-record screen:

These fields are also present but are not marked required on the new-record screen:

The access area contains the Allowed Branches and User Roles groups. Their checkbox entries come from the available branch and role data. The new-record screen showed five branch entries and nineteen role entries. Accessible account appears as a readout on this screen rather than as a visible selectable control.

The approval area contains three approval-limit groups. Each group has an Up to amount and an Unlimited choice. The groups cover sales, purchasing, and invoicing. The amount uses the format #,##0.00 and cannot be below 0.

The Mobile field accepts a maximum of 20 characters.

The authentication area offers Apply 2-factor Authentication With This User with the choices No and Yes. Profile-image actions include an upload action and Delete. The screen has no record list.

Maintain identity and access details

A principal-user record combines identity information with the branches, roles, approval limits, and authentication choice that apply to that person.

Prerequisites

• The principal-user screen is open.
• The identity information is ready.
• The branches and roles that apply to the record are known.

Steps

1. Enter the address in Email.
2. Enter the person's given name in First Name.

| If you need to… | Select |
|---|---|
| Leave two-factor authentication off | **No** |
| Apply two-factor authentication | **Yes** |

13. Choose an image in the image dialog. 14. Use the upload action in the image dialog. 15. Select Delete in the image menu to remove the current profile image.

Result: The identity, access, approval, authentication, and profile-image values are set on the screen and are ready for a save action.

Handle access and record variations

The controls available to you change with your edit access, whether the record is new or existing, and whether an approval area is unlimited.

The User Roles and Branches panels do not contain separate fields; use the inline checkbox groups in the user-information area. The username field and re-send activation-mail button are not part of this screen.

Save, leave, and handle problems

Saving commits the values after the form passes validation. Leaving with unsaved changes uses the page's confirmation choices.

Prerequisites

• The fields you want to keep are completed.
• You have edit access for the save actions.
• The validation group passes before saving.

Steps

1. Select Save in the header to save while staying on the screen.

2. Select Save and Close in the header to save and leave the screen.

3. Select the close control at the top-right of the screen when you want to leave without starting a save.

4. When the unsaved-change prompt opens, choose the action that matches your desired outcome:

   Desired outcome	Select
   Leave without keeping the changes	Don't Save
   Keep the changes and leave	Save
   Stay on the screen	Cancel

5. When validation stops the save, correct the field identified by the message.

6. Select the save action again.

The phrases Import instructions and file-size notices belong to import workflows in the shared popup. Subscription-upgrade content belongs to the subscription-upgrade workflow.

Result: The screen either remains open with the saved values, leaves after Save and Close, or presents the message that tells you which correction or confirmation is needed.

What comes next

After you finish the principal-user administration task, continue from the result that appears on screen. A successful new-user save can open the activation information; a leave action returns you to the surrounding security area.

Use these related pages for the next administration concern:

• Users for the user list and existing-record entry point.
• Roles for broader role administration.
• Teams for team administration.
• 2-factor Authentications for related authentication configuration.
• General error messages for common application message handling.

Result: You know which related administration page to open after the current principal-user screen.