Manage users, roles, permissions, and teams
Manage user accounts
View, edit, activate, and deactivate user accounts.
The user profile lists the assets they are responsible for (where they are set as an assignee, alone or alongside others). Each entry links straight to the asset, giving you a quick accountability view of who owns what.
When you manage many users, use the rows-per-page selector at the bottom of the table (10, 20, 50 or 100) to show more at once. Select users with the checkboxes to act on several at once: change their role, or activate/deactivate them in one step. To protect your account, you can't change your own account in bulk, and the system always keeps at least one administrator.
Use the Columns button above the users list to choose which columns appear — Role, Status, Contact, Last Login, Created, Employee ID, and Shift. Your choice is saved to your account and follows you across devices. By default the table shows Employee ID and Shift and hides the creation date; turn any column back on whenever you need it. The Shift column is available on the Business plan and above (where work shifts are configured), and Employee ID on every plan.
Need to record Unit, Section, Division, or any other organizational detail on a person? On the Business plan you can define your own user fields in Company Settings → Custom Fields (choose the User entity). They then appear on every user profile for you to fill in — your structure, your labels, no two companies forced into the same org chart.
Need to give someone access right away without waiting for an invitation email? Choose the No email needed tab under Organization → Users → Invite User. You set an initial password and provide either an email or a username. The person can sign in immediately — with their email if you entered one, or with username@your-company-slug plus the password you set (they are asked to change it on first sign-in). Unlike passive members, direct-created users are full login accounts: a user created this way with a username has access even though no email is shown on their row.
Each user can carry an optional Employee ID — your internal HR or payroll number. It appears on the user's profile and is searchable from the Organization → Users list, so you can find someone by their company ID, not just their name or email.
Filter the users list to a single team, or group it by team or by role to see your organization's structure at a glance. When grouping by team, the header shows the team's place in the hierarchy (parent > team). Turn on the optional Team column from the Columns button to see each member's teams inline.
Beside the Employee ID, each person can carry a Job title — what they actually do: driver, caretaker, supervisor, educator. It is free text, so it fits your own vocabulary, and it is NOT a FreeMaint role: it grants no permission and changes nothing about what the person can see or do. Set it from Organization → Users on the profile, or straight from the New driver dialog in Fleet. It then appears on the driver list, on the OSHA 300 injury log, next to qualifications and on the team org chart.
On the Organization → Users list, the "No login" badge marks a person who has neither an email nor a username — a passive / workshop member who cannot sign in. A user created from the No email needed tab who has a username (but no email) can log in, so they are not shown with this badge. If you expected someone to have access but they show "No login", open their profile and add an email, or recreate them from the No email needed tab and give them a username plus a password.
Add team members who do not have a work email — workshop crews, paper-based workflow, drivers without a system login. Choose the Workshop Member tab under Organization → Users → Invite User to create them from name and role only. You can still assign work orders, log their time, attach a driver profile, and later edit their role, permissions, or phone from Organization → Users without being asked for an email. To give them login access later, just type their email on the edit page and save.
On the Organization → Users list, open a user's row menu (the three-dot icon) to manage their password. "Reset Password" emails them a secure link to choose a new one. "Set Password" lets you type a new temporary password yourself and hand it over directly — the user is asked to change it on first sign-in, and this is the only option for passive or username-only users who have no email. Both require the user-management permission, and you can do the same from a user's profile page.
Each user profile shows a performance card with work orders assigned and completed, completion rate, and assigned/completed tasks for the period you choose (this month, quarter, or year).
Deactivate departed members instead of deleting to preserve work history.
Send invitations
New users join through email invitations with pre-assigned roles.
Every invitation and every direct account can carry an optional « Access until » date: the last day the person can sign in, in your company's time zone. At the end of that day the account is deactivated automatically and signed out everywhere; admins who can edit users are reminded 7 days before. You can set, move or remove the date later from the person's profile (never on your own account). Reactivating an account whose date has passed removes the date. Useful for contractors, temporary staff and service partners.
All three ways of adding someone above accept an optional vendor: the email invitation, the workshop member (no email, no login) and the direct account with a username. Pick one and the account belongs to that vendor from the moment it exists. It then only ever sees the work orders assigned to it, and never a cost, an asset value or a purchase price — whatever roles it is given later. These accounts are kept out of Organization > Users by default; switch on "Show vendor accounts" to list them, or open the vendor's own page. You can change or remove the affiliation later from the person's profile. The user import has the same column, "External Vendor (Name)": type the vendor's name and the imported accounts are bound to it. A name that matches nothing fails that row rather than creating an unbound account, and the export writes the column back so an export-edit-reimport round trip keeps the link.
If the email you invite already has a FreeMaint account in another workspace, that's not an error. When they open the invitation they'll be asked to confirm switching into your workspace. If they are the only member of their current workspace (often a leftover trial), it is closed and they join yours; if that workspace has other members or a paid plan, they'll be guided to leave it first or contact support. An account created with Google, Microsoft or Apple has no password yet: the invitation page offers to email them a link to set one (“Email me a link to set my password”), after which they open the invitation again to confirm the switch.
If the email doesn't arrive, ask the person to check their spam folder, or open Organization > Invitations and click “Copy invitation link” to share it directly.
If you already have a list of people in a spreadsheet, import them all at once instead of inviting them one by one. Rows that include an email address are sent an invitation to set their own password and appear under Organization > Invitations. Rows with a username instead of an email become login-capable accounts right away — the generated password is shown once after the import so you can hand it out. Rows left with neither become passive members (no login) — useful for workshop crews you only assign work to.
An invitation code (shared by link, QR or message) can also be typed by hand: on the sign-in or sign-up page, click « Have an invitation code? », enter it and click « Join ». The next page shows the workspace and the role before anything is created — this is the way in for a colleague who would otherwise sign up and land in an empty workspace of their own.
On the invitation page, the person can click “Continue with Google” or “Continue with Apple” instead of creating a password. They choose the account of the invited address and join your workspace directly, with the role you picked; from then on they sign in with that account. If they sign in with Google from the sign-in page instead of opening the invitation, FreeMaint sees the invitation waiting for their address and offers to join your workspace — it never creates a separate one.
Invitations are tracked in Organization > Invitations.
If their existing account signs in with Google or Apple, they can move it without a password: on the invitation page, they click “Continue with Google” (or “Continue with Apple”), then confirm the switch.
Admin and Manager roles cannot be imported — invite those people individually so they verify their email. Import always creates new people; it never overwrites existing accounts.
Invite a listed service partner from Company Settings > My partners, end its access when the work is done, and rate it: the rating is public and verified.
A partner who sets FreeMaint up, imports your data or trains your team usually works inside your workspace. Invite them from Company Settings > My partners: they get their own account with the ready-made “Service partner” role, you end the access when the job is done, and you can rate them. Every plan includes unlimited users, so this account costs you nothing.
In Company Settings > My partners, click “End access” on the partner's row: their account is deactivated right away (or the pending invitation is cancelled), and what they did keeps their name. “See activity” opens the audit log (Business plan) filtered on the partner.
Only the administrators of your company can invite a partner, and the partner must be listed in the FreeMaint directory.
Once your partner has signed in to your workspace, click “Rate” on their row and choose from 1 to 5 stars. You can change your rating at any time: the latest one counts.
To call on the same partner again, click “Restore access” on their row: the button shows once the access has ended, as long as their account still exists in your workspace. Their account is reactivated: same address, same password, and their history and your rating stay. You can set a new “Access until” date, and they receive an e-mail. If their account no longer exists, invite them again.
The partner joins with the “Service partner” role. If your company does not have it yet, FreeMaint creates it from its template when you send the first invitation; you can review it in Organization > Roles.
The role starts from the administrator's permissions and sees all your company's data. The partner can configure your CMMS (workflows, custom fields, numbering, forms, modules, regional settings) and work on assets, locations, parts, preventive maintenance, procedures, imports, work orders and reports. Left out, in particular:
Still looking for a partner? See “Ask a service partner for help”.
Warning:
A FreeMaint account belongs to a single workspace. An address that already has a FreeMaint workspace is refused, so that your partner never loses their own workspace: ask them for another address for yours.
Core roles and role templates explained
Six core roles come with every workspace — Admin, Manager, Supervisor, Technician, Requester and Viewer. The specialized roles are templates: pick one under “Start from a template” when you create a role. You can also build custom roles.
Match roles to job functions.
Create your own roles
Build roles with any combination of permissions — start blank, or pick a ready-made role under “Start from a template”.
Each role can choose which destination the fourth slot of the mobile bottom bar holds: Schedule, Assets, Parts, Reports, Team or Profile. Leave it on Automatic and the app decides — Schedule for roles that carry out or plan work, the profile for everyone else. An option is greyed out when the role lacks the permission that screen needs. Takes effect the next time the user signs in.
To start from an existing role, click the “Duplicate role” icon on its row in Organization > Roles. The copy opens with the same permissions, data visibility and mobile tab, named “<role> (copy)”: rename it, untick what this role should not have, then save. Every role can be duplicated, Admin included.
Hundreds of granular permissions
Each permission is written domain:action — for example work_orders:create or assets:view_value.
An amount appears only for a role holding the permissions below, on every screen at once: dashboard, analytics, reports and their scheduled e-mails. Otherwise it reads “—” or “Amounts hidden”; counts, hours and quantities stay visible.
User permissions = Role permissions + Additional individual permissions.
Important:
Cost, price and value permissions are restricted by default: among the six core roles, Admin and Manager hold them, and Supervisor sees work order costs and part prices. Check a role's permissions before you give it to someone.
“Advanced Dashboard” no longer shows any amount on its own: it decides whether a manager sees every person's row in team performance. To let a role see maintenance costs, tick both “View costs in analytics and dashboards” and “View costs Work Orders”.
Limit users to specific locations
Department-based access restricts what technicians, requesters and operators can see in FreeMaint to the locations they are assigned to. Useful for multi-site or multi-department organizations where each shop floor team should only see its own work. You can restrict access for individual users or for an entire team at once.
Only roles with "Limit to assigned locations" ticked are restricted: by default Technician and Requester (and the Operator template). Admin and Manager are not, so they keep full visibility regardless of assignments. Tick or untick the setting on a role in Organization > Roles to change who is restricted.
You can keep the existing "Assigned only" toggle on at the same time. When both are on, a user sees the union: assets/orders inside their department and assets directly assigned to them anywhere.
Projects follow the same rule. A user limited to their assigned locations sees the projects located in one of their locations, the projects that cover an asset they can see, and the projects they lead, created, belong to or own a phase of. A project with neither a location nor an asset is visible only to its participants. Team scope or “Only assigned” on their own never hide projects.
A member's accessible locations are the combination of their personal assignments and the locations of every team they belong to or lead. The person set as “Manager / department head” of a location counts as assigned to it.
If a role's Data visibility is set to Team scope, the locations granted to that user's teams already widen what they see — the assets, work orders, requests and preventive maintenance in those locations and their sub-locations — even when Department-based access is off. You do not have to link each record to the team one by one. The toggle above is what additionally restricts roles that see all company data.
Empty result on a page? If a user has the toggle on but no location assigned, they will see a yellow banner asking them to contact their administrator.
Create and manage teams
Teams group users. Reference: TEAM-1, etc.
A team can sit under a parent team: set “Parent team (org-chart)” when you create or edit it, and Organization > Org Chart shows the result. With Team scope data visibility, the leader of a team also sees the work orders, assets, requests, preventive plans and inspections of every team under it, at any depth, and can assign work in them. A plain member of the parent team does not. To give a department head the work of all the crews under them, make them the leader of the parent team: there is no need to add them to every sub-team.
In Organization > Teams, click a team, then "Live team map" — or choose "Live team map" in the ⋮ menu of the team's row. The map shows the clocked-in members of the team — the people who belong to it or lead it — at their last known position. Live updates are a Business feature; on other plans the map refreshes every 30 seconds. Positions are only shared while someone is clocked in.
In the team form, "Locations this team can access" grants the team one or more locations. Members whose role uses Team scope data visibility then see the assets, work orders, requests and preventive maintenance in those locations, in addition to the records assigned to the team itself. Sub-locations are included automatically, so granting a building covers each of its floors.
A user whose role uses Team scope but who belongs to no team is not restricted at all — they keep seeing every record their permissions allow. Their detail page flags this so you can add them to a team. The role editor flags it as well, the moment you pick Team scope on a role that would restrict no one.
Organization > Org Chart shows how your teams are nested. Anyone allowed to edit teams can drag the teams into place, and the arrangement is shared: everyone in the company sees the same chart. "Reset layout" puts it back to the automatic arrangement for everyone. Other users see the chart read-only.
Each team page shows a performance card with work orders assigned and completed, completion rate, and assigned/completed tasks for the chosen period, so you can compare output across teams.
Organize by function (Electrical Team) or area (Building A Team).
Assign work to teams
Any team member can pick up team-assigned work. When a work order is assigned to the team, all members (the leader included) are notified; status updates go to the assignee and creator to avoid notification overload.
Balance workload across members.
Track employees' certificates, licenses and expiry dates
Record each employee's certificates, authorizations, attestations and licenses with their validity dates, and get alerted before they expire — so your team always stays compliant.
Admins and managers manage and view the whole register. Any employee can always see their own qualifications on their profile. Adding or editing qualifications requires the Starter plan or above.
A daily check notifies admins and managers 30, 15 and 7 days before a qualification expires. You can turn the alert channels (in-app, push, email) on or off in Notification settings.
From the Qualifications register, each row can be edited or deleted directly — the pencil and bin icons appear for anyone allowed to manage qualifications. When an employee is deleted, their records leave the register but are NOT destroyed: certification evidence often has to be kept after someone leaves. Pick "Former employees" in the status filter to bring those records back when an auditor asks for them.
In the Qualifications register, switch to “Matrix” to see one row per person and one column per competence of your catalog. Each cell shows whether the competence is valid, expiring soon or expired — a dash simply means nothing is on record. The bottom row counts, for each competence, how many people are in date, expiring or expired. Filter by team or search for a person, and click a row to open that person’s profile. Only qualifications linked to a catalog competence appear in the matrix; “Register” lists all of them.
Set the reminder window to match your renewal lead time so you never scramble at the last minute.
Record who is away and see your team's availability
Record a team member's leave or time off as a range of whole days, so managers and supervisors know who is away and can plan the work around it.
When an absence is declared, the person's team leaders — up through the parent teams — receive a notification, along with the roles chosen in Company Settings › Notifications › Advanced notification configuration, under “People & teams”, each only for the people they can see. The channels (in-app, push, email) are set there too. The note is never sent. Only people who can open the Absences page are notified, and an absence that is already over is recorded without a notification.
Seeing absences is included in every plan. Declaring, editing and deleting absences requires the Business plan.
FreeMaint never asks why someone is away and stores no reason or type of leave — no sick leave or other health information. Keep the note factual and free of personal details. The note is shown only to the person concerned and to those who manage absences.
Declare planned leave as soon as you know it: upcoming absences already show in the planner and in the assignee picker.
The Absences page lists the absences of the people your data visibility covers — everyone, your teams, or only yourself, depending on your role. Switch between Away today, Upcoming and Past, and filter by team or person.
With “Declare own absences”, a person records their own leave. With “Manage everyone's absences”, a manager or supervisor declares, edits or deletes the absences of the people they can see. Two absences of the same person cannot overlap.
A private activity card for everyone, optional record-quality views for managers and collective team goals — who sees what, and what to check first.
FreeMaint recognizes good work without turning it into a league table. Each person sees their own activity. If an administrator chooses, managers can also see record quality per person and set collective goals for their teams. Nothing here ranks people against each other.
People with the teams:update permission set a monthly goal for a team on its page; administrators set company-wide goals in Company Settings › System. Three metrics are available: preventive maintenance on time, record quality and work orders completed. Progress is calculated live from the team's work orders and appears on the dashboard and in the mobile app — never broken down by person.
Anyone who completes work orders sees their own figures for the last 7, 30 or 90 days, compared with the period before: work orders completed, share completed on time, record quality and hours logged. Nobody else sees this card. A rate with nothing to measure shows a dash, never 0 %.
With team views on, people who hold the advanced dashboard permission (dashboard:advanced) see a Record quality column in Analytics › Team, and a record-quality line on user and team pages. The column is never used to sort or rank the table.
If your plan drops below Business, existing goals stay visible and can be deleted; adding or editing a goal needs Business again.
Warning:
Inform your teams before turning on team views and goals. In France, the works council (CSE) must be consulted first (Labor Code L2312-38); in Germany, the works council (Betriebsrat) must agree (§87 BetrVG); in Italy, article 4 of the Workers' Statute applies. Do not use these figures on their own to decide pay, promotion or sanctions.
Customize your experience
Each user can customize language, theme, and notifications.
Change your language from the avatar menu: Settings › Appearance › Language. In the mobile app: Me › Settings › Preferences › Language.
FreeMaint CMMS
© 2026 FreeMaint. All rights reserved.