Set up your organisation

Everything you set up for the whole organisation is in one place, the administration: your colleagues' accounts and what they may do, the groups and team shares they work in, your name and colours, the sign-in rules and the activity log.

Open the administration

Click Admin at the bottom of the left bar. The administration opens on Users; the column next to it lists every section, grouped by subject.

Add a user

1. In Users, click Add a user.

2. Fill in the New user window. The Username is what the person signs in with: lowercase letters, digits and . _ - + @ only, with no space. It cannot be changed later. Choose a first Password and a Role (see below).

   

3. Click Create. The account appears in the list. PAFworks sends no invitation: give the person their username and password yourself. They can change the password on the Security page of their account.

If your organisation signs in through its own identity provider, accounts can also be created at the first sign-in: see Sign in with your identity provider.

Choose the role and the storage quota

Click the pencil (Edit user) at the end of a row. Besides the name and the e-mail address, the window holds the role, the storage quota, a New password field for someone who forgot theirs, the Active account box, and Reset for a person who lost the phone of their two-factor authentication.

Storage quota (GB) sets the space the person is given; 0 means unlimited. The list shows what each account uses against it: their own files, with their previous versions and what is in their trash, and their mail with its attachments; files in team shares count against nobody. Only the files are held to the quota: once they reach it, new uploads are refused, but mail keeps arriving.

Storage used, at the top, is everything the organisation stores: the accounts' files, the team shares, the mail with its attachments. Storage usage on the right splits it, largest first: each account with its files and its mail, then the team shares, the shared mailboxes and the rest.

Pause, delete or restore an account

Next to the pencil, two buttons act on the whole account:

• Pause (Pause account): after a confirmation, the person can no longer sign in anywhere — web, sync clients, mail apps, AI apps — and their share links, workspaces and booking pages stop answering. Nothing is deleted: Resume account brings everything back.
• Delete (Delete user): the account is disabled right away, and deleted for good with its files and mail 30 days later.

Until then, a deleted account stays in the list with the date it goes for good. Click Restore user on its row to give it back as it was, active or paused, with everything it held.

Groups

A group gathers accounts so that you can give access to all of them in one move. Click Groups in the administration.

• New group asks for a Name and an optional Description.
• Select a group to see its members. Pick an account under Add a user and click Add; Remove takes someone out.
• Edit renames the group. Delete removes it, and with it the access to the folders it was granted.

Groups are used when you give access to a team share (next section). People can also pick a group when they start a group discussion or invite people to a date poll.

Team shares

A team share is a folder that belongs to the team, not to one person: all its members find the same files in it, each according to their rights. Only administrators create them.

1. Create the share

   In Files, click the + next to Team share in the left column. Give the share a Name.

2. Add people and groups

   In Members, type part of a name: people and groups are found in the same search. Pick each one in the list.

   

3. Set their rights, then create

   Everyone you add starts with Write; change it to Read or Admin where needed. You are listed first, as Admin. Click Create: the share appears under Team share in the Files of every member.

   

A group stays linked: whoever joins the group later gets the share too, and whoever leaves it loses it. Someone who has a right of their own and another through a group gets the higher of the two.

Manage every team share

In the administration, Shared folders lists every team share of the organisation, including those you are not a member of. Click Manage to rename a share, add or remove people (Add a user…) and groups (Add a group…), and change their rights. You can also create a share here, then add its members.

Delete and restore a team share

Click Delete on its row and confirm. The share disappears right away for all its members, then is deleted for good with everything filed in it 30 days later. Until then it stays in the list, where Restore brings it back as it was, members and groups included.

A share's own administrators can delete it from its gear in Files too; restoring it is always done here.

Shared calendars and address books

Calendars and contacts does for calendars and address books what Shared folders does for files. It lists every shared calendar and every shared address book of the organisation, whoever owns it. The task lists of Tasks are calendars too, so they are here as well.

• Type a name and click Create to make a new one; you are its owner.
• Manage changes its Name and Colour, and its members: pick someone under Add a user… with Read only or Read & Write.
• Delete takes it away at once from everyone, its owner included, with its events and tasks or its contacts. Restore brings it back during the next 30 days.

Your brand: name, logo and colours

In the administration, click Theme. The preview at the top changes as you type.

Click Save: the page reloads in your colours. Restore the default theme goes back to the PAFworks name, logo and colours.

• In the application, for everyone in your organisation: the logo and the navigation colour in the left bar, the main colour on buttons, links and selections.

  

• On the sign-in page and the pages of public links: the logo and the name head the page.

  

• On the client pages, where the guests of your workspaces ask for their code and open their files.

  

• In e-mails: notifications and invitations carry the name, and their links take the main colour.

Sign-in security

In the administration, click Security. The Sign-in policy panel holds two rules; click Save after changing them.

• Require two-factor authentication: everyone signing in to the web interface must set up an authenticator app before they can reach anything else, people already signed in included. They see a Set up two-step verification page: they scan a QR code with an app such as Aegis, FreeOTP or Google Authenticator, type the 6-digit code, and keep the recovery codes shown. Accounts that already have an app are unaffected.
• Lock out repeated failures (ticked by default): wrong passwords and app passwords are counted, and sign-ins are refused for a while once an account or an address has had too many. By default: 5 failures per account, 20 per address, remembered for 900 seconds (15 minutes). Advanced options changes these figures.

Sync clients, mail apps and AI apps sign in with app passwords, which each person creates in their preferences: they keep working when you require two-factor authentication. Follow the instance drops your values and goes back to the defaults of your PAFworks.

Sign in with your identity provider

If your organisation already has an OpenID Connect identity provider — Keycloak, Authentik or another — people can sign in to PAFworks through it, with no second password.

1. In the administration, click SSO configuration, then New provider.

2. At your provider, register PAFworks as an OpenID Connect client with the Redirect URI and the Post-logout redirect URI shown at the top of the page. Then fill in the form: a Provider ID (letters, digits, hyphens and underscores: it is part of the redirect URI), the Name shown on the sign-in button, the Server URL of the provider, and the Client ID and Secret key it gave you.

   

3. Tick Leave two-factor authentication to the provider only if your provider already enforces it: people signing in through it are then not asked for a code by PAFworks. Click Create.

The sign-in page now shows a Sign in with Acme SSO button (see the picture in Your brand), and usernames and passwords keep working alongside. PAFworks recognises an existing account by the e-mail address the provider has verified, or by the username; someone the provider knows who has no account yet normally gets one at their first sign-in.

• Once a provider exists, a Sign-in page panel offers Hide password sign-in: the sign-in page then only shows the providers' buttons, and sends people straight to the provider when there is only one. The password form stays one address away, given in the panel: https://cloud.example.com/login/?show-password-login.
• Disable this provider, in its form, takes its button off the sign-in page and keeps its settings. Delete removes it: people who only ever signed in through it will need a password.
• An account created through the provider has no password of its own: its owner creates app passwords for their devices in their preferences.

PAFworks as the identity provider of your other applications

The other way round: your wiki, dashboard or ticket tracker can sign people in with their PAFworks account.

1. In Security, under Identity provider, tick Enabled and click Save. Give the application the addresses listed below the box, starting with the Discovery document.

2. Under Connected applications, type the application's name, choose Server-side application or Browser or mobile application, type its redirect address (one per line, matched exactly) and click Register.

3. Copy the client identifier and the secret into the application. The secret is shown only once; Renew the secret makes a new one, and Remove disconnects the application.

   

The first time someone signs in to the application, PAFworks asks them to Allow it. They can withdraw it later in their preferences, under Devices and sync › Applications you signed in to.

The activity log

Open https://cloud.example.com/activity/. Everyone sees their own activity there; as an administrator, click All to see the whole organisation's.

• All actions narrows the list to one kind: files added, edited, opened or downloaded, deletions, moves, renames, folders created, shares and their visits, versions restored, sign-ins.
• Filter by user takes a username. Load more goes further back.
• The Activity section of a file's details panel, in Files, shows the same history for that file alone.

Good to know

• One delay for everything you delete here: accounts, team shares, shared calendars and address books are kept for 30 days, then deleted for good in the night after the date shown. They can be restored until then.
• A deleted account keeps its username and e-mail address until it is deleted for good: they cannot be given to a new account meanwhile. The same goes for the name of a deleted team share.
• When an account goes for good, what it had put in team shares stays in them.
• A shared calendar or address book belongs to its owner: if the owner's account is deleted, it goes with it, whoever its members are. The administration warns you when the owner's account is disabled.
• Pausing an account or giving it the User (no download) role switches its share links off without deleting them: they work again once you resume the account or change the role back.
• Two-factor authentication applies to the web interface; devices and apps use app passwords, which each person can revoke on their own.
• Signing in to another application through PAFworks gives it the person's identity — name, e-mail address, and their groups if it asks — never their files or mail.
• The activity log keeps one year of history.