Use this checklist when onboarding a tenant or running a quarterly access review. It complements role design covered in Roles, permissions, and RBAC.
Please note:
- Work top to bottom — module and role hygiene delivers the largest risk reduction for the least effort.
- Offboard users the same day employment ends: deactivate login, remove roles, and reassign owned records — follow Add users and invite teammates and Manage members for invite hygiene.
- Encourage every user to enable Account security, 2FA, and passkeys and review Linked accounts for OAuth sign-in.
Checklist
| Item | Action | Owner |
|---|---|---|
| Module sprawl | Disable unused modules | Workspace admin |
| Admin count | Limit full admin roles | Security lead |
| Role review | Remove ex-employees, stale invites | HR + admin |
| Least privilege | Replace generic roles with job-based ones | Admin |
| Portal access | Audit customer and salesmen portal users | Admin |
| Field sensitivity | Restrict HR and finance custom fields | HR / finance |
| Workflow actors | Confirm approval roles still valid — see Workflow approvals | Process owner |
| Integration keys | Rotate API tokens on schedule | Engineering |
Work top to bottom — module and role hygiene delivers the largest risk reduction for the least effort.
Onboarding sequence
- Enable only modules required for go-live — see Configure your workspace and Enable and manage modules
- Create roles before inviting users (avoid everyone-is-admin) — use Roles in Settings
- Invite members with the smallest viable role
- Document who owns role changes and offboarding
- Schedule first review 30 days after launch
Security posture overview
flowchart TB Modules[Enabled modules] --> Surface[Attack and error surface] Roles[Roles and permissions] --> Access[User access] Access --> Data[Sensitive records] Modules --> Nav[Feature visibility] Roles --> Workflows[Workflow and portal actors] Workflows --> Data Review[Quarterly checklist] --> Modules Review --> Roles Review --> Workflows
Offboard users the same day employment ends: deactivate login, remove roles, and reassign owned records.