Who should be able to see payroll? Who can send invoices? A short guide to roles, invitations and sign-in rules in the admin console.
The admin console is where you decide who can do what across every app. It is worth fifteen careful minutes at the start.
Start from roles, not people
Create a few roles that match how your team works: owner, finance, sales, viewer. Give each only the permissions it needs. It is much easier to add a permission later than to explain why someone saw something they should not have.
Invite by email
Invite colleagues with the role they should have. They get a link, choose a password and land in the apps you switched on for them.
Turn on a second factor
You can require two-step sign-in for everyone. Do it for owners and finance first if you want to move gently, then extend it.
Limit sign-in to your own domain
If everyone has a company email address, restrict sign-ups to that domain so strangers cannot join your organisation.
Review the audit log
The audit log records who changed what. Skim it once a month; the habit alone discourages mistakes.
