Impersonating Logins

What impersonation is

Impersonation lets you temporarily sign in as another login in your organisation, so you see the dashboard or app exactly as they do: the same menus, records, fields and permissions. It is the quickest way to answer questions like "why can't Sam see this event?" or to check that a new role is set up correctly before handing it to someone.

While you are impersonating, everything you do is carried out with their access, until you choose Stop Impersonating.

How to impersonate someone

1. Open the login (persona) you want to check, from Access Control → Users or anywhere the login appears.
2. Open the actions menu and choose Impersonate <name>.
3. The dashboard reloads as that login. When you are finished, open your account menu and choose Stop Impersonating to return to your own session.

You can't start a second impersonation while you are already impersonating someone. Stop the current one first.

Who can impersonate

To impersonate a login, all of the following must be true:

• You have the persona.impersonate permission. In the role editor this appears under Impersonation → Impersonate logins. Administrators have it automatically.
• You can edit that login. Being able to view a login is not enough. Your role needs edit access to logins (persona.editany, or persona.editown for logins you own) in a scope that contains the login.
• You are an administrator if they are. Only administrators can impersonate an administrator login.

Safeguards

Impersonation is designed so that it can never give you more access than you already have:

• No stepping up. Someone who isn't an administrator can never impersonate an administrator, so a role that can manage some logins can't be used to take over an administrator's session.
• Edit, not view. If you could only view someone's login, you can't impersonate it. Impersonating effectively lets you act as that person, so it requires the same access as changing their login.
• Applications are administrator-only. Impersonating a login inside an application adds that application's permissions on top of the login's own, so only administrators can do it.
• Your organisation only. You can only impersonate logins in the organisation you are currently signed in to.

If impersonation is refused, the dashboard shows the reason, for example "You can only impersonate logins you are able to edit".

Setting it up for your team

Administrators can always impersonate. To let other staff do it, for example a support lead who helps people with their access:

1. Go to Access Control → Roles and open (or create) the role for those staff.
2. Under Impersonation, tick Impersonate logins.
3. Make sure the same role can edit logins in the scopes where they should be able to impersonate.
4. Grant the role through an access pass in those scopes. See Roles and Permissions for how roles, scopes and access passes combine.

Grant this permission sparingly. Anyone who holds it can act as any non-administrator login they can edit, including seeing that person's private records.

FAQs