Access
Manage users, roles, and granular permissions, with SSO, 2FA, and portal access — so everyone sees exactly what they should.
Updated February 23, 2026
Access controls who can do what across XO — users, roles, and fine-grained permissions, plus SSO and 2FA — the backbone of security and segregation of duties.
Users
- Go to XO Core → Access → Users → Invite.
- Enter the person’s email and assign a role and branch/scope.
- They accept the invite and set up 2FA.
Roles & permissions
- Open Access → Roles → New role.
- Grant permissions at the level you need — module, screen, field, or record.
- Use modes like create-only or read-only for tight control.
- Assign users to roles (or use permission groups).
📷 Screenshot: a role with module/field-level permissions toggled.
SSO & 2FA
- Enable SSO (SAML/OAuth/OpenID) for centralized login.
- Enforce two-factor authentication; integrate Nafath for KSA identity where relevant.
External access
Scope customer (portal) and supplier (vendor portal) access so external users see only their own data.
Best practices
- Build roles around job functions, not individuals.
- Apply least privilege; reserve admin to a few.
- Separate duties — e.g. whoever creates payments shouldn’t approve them.
Troubleshooting
- User can’t see a module. Check their role permissions and branch scope.
- SSO login fails. Verify the identity-provider config and that the user is provisioned.