Chapter 15 — Working across several companies

An HR consultant who runs payroll for three clients, a group finance director with a seat in every subsidiary, an employee who also teaches evenings at a sister school: one person, several employers. Operentra gives that person one account and a membership in each company, with a switcher to move between them. This chapter is the model behind that, the invitation that adds a company to an account, and the two rules that travel with each membership: its roles and its company's security policy.

What this chapter covers

• 15.1 One login, many companies
• 15.2 Invitations: accept, decline, what declining means for employees
• 15.3 The company switcher and per-company roles
• 15.4 Companies that require 2FA

The concept

Two things are easy to confuse: the person and their place in a company. The person has one email address they sign in with, one password, one second factor. Their place in each company is separate: the roles they hold there, the employee record that company keeps, the data that company may see. Mixing the two produces the classic failures: a consultant who needs five passwords, or worse, one company's administrator who can see another company's people because the same email was reused. Keeping them apart means a membership can be granted, changed or closed by its company without touching the person's account or their other memberships.

How Operentra handles it

• One account per email address, holding the password and the two-factor enrolment, and a membership per company holding that company's roles and its link to an employee record.
• Joining another company starts with that company's invitation (Chapter 14 for a user, Chapter 16 for an employee). Signed in, the person sees a banner with Accept and Decline; from the email link, an address that already has an account links by entering its existing password. Invitations are never limited by plan.
• Opening another company of your own with Create a workspace is limited by plan: an account that already runs a workspace needs one it runs on Enterprise, or on a custom plan with Multi-company (Chapter 4).
• Declining stamps the invitation as declined and never deletes anything: an employee keeps their employment record and simply has no portal access there, and the company sees Declined on the Users page and can invite again.
• The company switcher appears in the top bar once an account has two or more memberships, lists each company with the roles held there, and opens the chosen company in the admin side or the portal according to the roles held in that company.
• Sign-in opens the company used last, or the first available one; a company on its own domain admits only its own members at that address.
• Two-factor authentication belongs to the account. A company that requires it cannot be opened, at sign-in or through the switcher, until the account is enrolled; enrolling once satisfies every company.
• Who: anyone with an account. Administrators of a company control only their own company's memberships.

Walkthrough

Northwind's demo administrator account also belongs to Dunebridge Technologies, the UAE demo company, as Super Admin in both, so the switcher in the top bar lists two companies. Neither company requires two-factor authentication. The walkthrough follows that account, then an invitation from a third company.

15.1 One login, many companies

The account is the email address and password on the sign-in page, and everything under My Account (Chapter 6): the profile the person keeps for themselves, the password, the second factor, the sign-in email. Each company's view of the person lives in that company: their employee record, the roles on the Users page, the leave and payslips. Changing the password changes it everywhere; changing a role in Northwind changes nothing in Dunebridge.

A membership ends without ending the account. When an employee leaves one company, offboarding closes that membership after its grace period; the account stays, with its other memberships. Only when the last membership closes, and the address was the company's own mailbox, does the account go dormant, so that whoever inherits that mailbox cannot reach the old data. Create a workspace from the user menu (Chapter 4) adds a company to the same account as its Super Admin, with no second sign-up. An account's first workspace is always allowed; a second one it runs needs a workspace it already runs on Enterprise, or on a custom plan with Multi-company. Until then the page explains the rule instead of showing the form. The one exception is signing up again, with the same email and password, using an unused AppSumo code: the code pays for its workspace, so it opens whatever plan the account's other workspaces are on (Chapter 4). Memberships that come from invitations, and the switcher, work on every plan.

15.2 Invitations: accept, decline, what declining means for employees

A company invites someone by adding them as a user (Chapter 14) or as an employee with portal access (Chapter 16). If the invited address already has an Operentra account, two doors open.

Signed in, the person sees a banner in the workspace colour across the top of every page: "Ridgeway Partners has invited you to join their workspace.", the roles offered ("as HR Manager"), and Accept and Decline. The banner cannot be dismissed; it stays until the person answers or the seven-day invitation lapses. Accept joins the account to the company and opens it straight away. Only the address the invitation was sent to can accept it: the account's own sign-in email must match.

From the email, the invitation link opens a claim page. A new address sets a password there; an address that already has an account enters its existing password and clicks Link & sign in, which joins the company to that account.

Decline refuses the membership and keeps everything else. For a user invitation the company sees Declined and nothing of the person's is in its workspace. For an employee invitation the banner says it in advance, "Declines the login only — your employment record is not affected": the employee record, its payroll, leave and attendance carry on exactly as for an employee without portal access, and HR can resend the invitation later.

15.3 The company switcher and per-company roles

With two or more memberships, the company name in the top bar becomes a menu: Switch company, then Your companies, each with the roles held there ("Super Admin", "HR Manager · Accountant") or Member when it has none, and No access for a membership the company has deactivated or a company that is suspended. From seven companies up, a Find a company search heads the list. Choosing a company reloads the application inside it: an account that holds an administrative role there lands on the admin dashboard, one that is an employee only lands in the portal. Nothing carries over between the two except the account; each company's data, settings and caches are its own.

The next sign-in opens the company used last. A company that runs on its own domain (Chapter 13) signs in only its own members at that address. An administrator who signs in as someone else (Chapter 14) sees only that person's membership in the current company; the switcher is not offered during impersonation.

15.4 Companies that require 2FA

A company can require two-factor authentication for everyone (Chapter 12). Because the second factor belongs to the account, the rule is checked whenever the account enters that company. At sign-in, an account that is not enrolled is taken through enrolment before the company opens. Through the switcher, the switch is refused with "That workspace requires two-factor authentication. Enable it in Sign-in & Security first." and the person is taken to My Account's security tab, in the company they are still in. One enrolment there satisfies every company that requires it; the next switch goes straight through.

What happens next

• Users (Chapter 14) is where each company sees its memberships: Invited, Invite expired, Declined, the roles held, Resend.
• Offboarding (Chapter 82) closes one company's membership and leaves the account and its other memberships alone.

What the employee sees

The invitation banner or email, the claim page, and, once they belong to more than one company, the switcher. An employee who declined portal access still has their record, their pay and their leave; they just do not sign in to that company.

Common mistakes

1. Creating a second account with another email address to reach a second company. One account with two memberships is the design; two accounts mean two passwords and two second factors.
2. Accepting from the wrong account. The invitation belongs to the address it was sent to; signed in with another address, the banner never appears.
3. Reading Decline as a resignation. It refuses the login, not the job; payroll and leave carry on.
4. Expecting roles to follow the person. A Super Admin in one company is whatever the other company made them, often an employee.
5. Turning on the 2FA requirement before telling members. The next switch into the company sends them to enrol first.
6. Deleting a membership to fix a wrong role. Change the role on the Users page; the membership is the company's record of access.
7. Expecting a new company in the switcher before accepting. An invitation is not a membership until it is accepted or claimed.

Practice

Use your own trial workspace, not a customer's.

1. Open the user menu and choose Create a workspace (Chapter 4). On a trial the page explains that another workspace under your account needs Enterprise, or a custom plan with Multi-company; read it. The steps below reach a second company through an invitation instead, which no plan limits.
2. In a private window, sign up a second trial company with another email address of yours; it is that account's first workspace, so it is allowed.
3. In the second company, invite your first address as a user with the HR Manager role. Signed in with your first address, read the banner and decline; read the row on the second company's Users page and resend. Accept the resent invitation from the banner and read the switcher that appears in the top bar.
4. Switch to the second company and back; note which side each opens in.
5. In one company, switch on the two-factor requirement on System Settings (Chapter 12) and try to switch into it from an account that is not enrolled; read where you are taken. Switch the requirement off again.

Quiz

1. What belongs to the account, and what to each membership?

The account holds the sign-in email, password and second factor; each membership holds that company's roles and its link to an employee record.

2. What does declining an employee invitation change?

Only portal access to that company: the employee record, its pay, leave and attendance are unaffected, the Users page shows Declined, and HR can invite again.

3. Where does the switcher land you in another company?

In the admin side if you hold an administrative role there, in the portal if you are an employee only there.

4. A company requires 2FA and your account is not enrolled. What happens when you switch to it?

The switch is refused and you are taken to My Account's security tab to enrol; one enrolment satisfies every company.

5. When does the account itself go dormant?

When its last membership closes and the address was a company's own mailbox, so a later holder of that mailbox cannot reach old data.