Adding a New User

This guide explains how to add new users to both parent tenant instances and child customer instances in Synthreo’s Canopy portal.

User Management opens on the Users tab, which lists accounts across your organization with their Name, Email, Customer, Last Access, MFA Method, and Status. It also has an Accounts tab for application-level accounts. This guide focuses on the Users tab.

---

Adding a User (Parent Tenant)

Prerequisites

• Access to the Canopy portal with permission to manage users
• The user’s email address
• The user’s first and last name

Steps

1. Go to https://canopy.synthreo.ai
2. Select User Management in the left sidebar
3. Select the Add User button at the top right
4. In the Add new user dialog, enter:
   • Email
   • First Name
   • Last Name
   • Customer - shown when the account could belong to more than one customer, and required when you administer several
5. Set Product Access (see below)
6. Select Create

---

Product Access

The Product Access block holds one checkbox per application:

Checkbox	Behaviour
ThreoAI	Checked and disabled, labelled “ThreoAI (included for all users)“
Builder	Optional
Canopy	Optional
Pylon	Optional

Builder, Canopy, and Pylon are each region-gated. If the application is not available in that customer’s region the checkbox is disabled, and its tooltip reads “X is not available in this customer’s region.” While Canopy is still checking, the tooltip reads “Checking availability…”.

Note

New users are provisioned into ThreoAI with the Member role, not an administrator role. Roles are per-application, and the ones you can change afterwards on the user’s detail page are Builder, Canopy and Pylon. The automatic ThreoAI row carries no edit action, so there is no role field for it in Canopy; if a user genuinely needs elevated ThreoAI rights, raise it with Synthreo. See Managing Permissions and Roles & Permissions.

---

Adding a User to a Child Customer

Prerequisites

• Access to the Canopy portal with permission to manage customer tenants
• The user’s email address
• The user’s first and last name

Steps

1. In Canopy, select Customers in the left sidebar
2. Search for the tenant name of the child customer
3. Select the customer name to open the customer detail page
4. Go to the Users tab
5. Select Add User and enter:
   • Email
   • First Name
   • Last Name
6. Set Product Access
7. Select Create

Note

Opening Add User from inside a customer fixes that customer as the target, so no Customer field appears.

---

What Happens Next

• The new user receives a welcome email with setup instructions
• The setup link is valid for 7 days
• Until they finish setup their status reads Pending, and their detail page offers Resend Invitation
• After completing setup, the user can access their assigned applications

---

Bulk Import

To add many users at once, use Bulk Import from the User Management screen instead of creating each account by hand. The button sits beside Add User and opens a six-step wizard:

1. Select Customer - choose the customer the imported users will be created under.
2. Upload CSV - upload a CSV (5 MB maximum). Download Sample Template gives you a correctly shaped file to start from.
3. Preview Data - review the parsed rows before anything is created.
4. Configure Settings - set the batch size and the default product access, and optionally run validate-only, which checks the file without creating accounts.
5. Processing - Canopy creates the accounts in batches.
6. Results - see what succeeded and download an error report for any rows that failed.

The CSV

email, firstname, and lastname are required; a missing one is reported as Required column "email" not found before anything is parsed. first_name and last_name are accepted as aliases.

threo, builder, and tenant are optional columns that set product access per row, and a value in the row overrides the default you set in Configure Settings. true, yes, 1, and y all count as on. There is no Pylon column.

Rows are validated individually, so a bad address does not stop the run: it is listed in Results with its row number.

Caution

Two rows are refused on purpose and appear as errors rather than accounts:

• A row for your own address - “you cannot provision your own access.”
• A row granting more access than you hold yourself - “grants access beyond what you hold yourself.”

Each imported user is created through the same path as a single add, so each one receives a welcome email. Use bulk import when onboarding a whole team or migrating a customer’s users in one pass.

---

Resetting MFA for a User

If a user is locked out of their second factor (a lost device or a reset authenticator), reset their MFA from their detail page:

1. Select User Management in the left sidebar
2. Select the user’s row to open their detail page
3. In the Security card, under Two-Factor Authentication, select Reset MFA and confirm

Their current authenticator is removed and a setup email is sent so they can enroll a new one.

Note

If the row reads “No reset needed” instead of offering a button, that user has no second factor enrolled, so there is nothing to reset.

---

Resending a Welcome Email

For Parent Tenant Users

1. Go to https://canopy.synthreo.ai
2. Select User Management in the left sidebar
3. Locate the user and select their row to open the account detail page
4. In the Security card, under Invitation, select Resend Invitation

Note

If Invitation is not shown, the user has already finished account setup. The block appears only while their status is Pending.

---

For Child Customer Users

1. In Canopy, select Customers in the left sidebar
2. Search for the tenant name of the child customer
3. Select the customer name to open the customer detail page
4. Go to the Users tab
5. Select the user’s row to open their detail page, then select Resend Invitation

As with parent-tenant users, Resend Invitation appears only while the user has not finished account setup.

---

Troubleshooting

If the setup email is not received:

1. Check the Spam/Junk folder
2. Verify the email address entered is correct
3. Resend the welcome email using the steps above
4. If the issue persists, ask your administrator or MSP help desk. They escalate to Synthreo through the partner support channel.

Issue	Cause	Fix
Add User and Bulk Import are greyed out	The user roster has not loaded, or failed to load	Wait for the list, or retry the load; both buttons stay disabled until the roster is available
The buttons are missing entirely	You are on the Accounts tab	Switch to the Users tab; they are only offered there
A Product Access checkbox cannot be checked	That application is not available in the customer’s region	Hover the checkbox for the reason, or choose a customer in a region that has it
Duplicate email error on create	A user with that email already exists	Check User Management for an existing account with the same email
Welcome email not received	Email in spam, or address entered incorrectly	Check spam folder, verify the address, then resend
Setup link expired before user acted	The link is valid for 7 days only	Resend the welcome email to generate a fresh setup link

Best Practice

Set product access when you create the account rather than afterwards. A permission added later still requires the user to sign out and back in before the application appears.

---

FAQs

Can I add multiple users at the same time? Yes. Use Bulk Import from the User Management screen to create many accounts in one pass. See Bulk Import above. Each imported user receives a welcome email automatically.

What if the user’s name changes after the account is created? Open the user’s detail page and update First Name or Last Name in the Account Details card, then select Save Changes. The email address is changed separately, in the Security card, through a confirmation-link flow: it only takes effect after the user opens the link at the new address. See Managing Permissions.

Can a user belong to both a parent tenant and a child customer? A single sign-in identity can hold permissions in more than one customer, and their Profile lists every organization their account can act in. What cannot be split is the ThreoAI account: it belongs to exactly one customer. Adding an existing user to a second customer with no other application selected is refused, because it would need a second ThreoAI account.