Sub-users
Give other people their own login to your account in TMA Cloud.
Give other people their own login to your account in TMA Cloud.
What a Sub-user Is
A sub-user is an extra login that belongs to your account. Sub-users share your files, folders and storage quota, but sign in with their own email and password.
Use sub-users instead of handing your password to a colleague. Because each person signs in separately, the audit log records who performed each action, and you can grant each person only the permissions they need.
- Any regular account can create sub-users
- A sub-user cannot create sub-users of its own
- Sub-users are not administrators, even when created by the admin account
Creating a Sub-user
- Go to Settings → Sub-users
- Click Add sub-user
- Fill in the details:
- Name - Required. Shown in the audit log next to their actions
- Email - Their login email. Must not already be in use anywhere on the instance
- Password - At least 8 characters
- Tick the permissions they should have (see below)
- Click Create sub-user
New sub-users start with all permissions ticked. Untick the ones you do not want to grant before creating.
Permissions
Each sub-user has its own set of permissions. Anything left unticked is denied.
| Permission | Allows |
|---|---|
| Download | Download files and folders, and open them in the viewer |
| Upload & create | Upload files, create folders, and copy existing items |
| Modify | Rename, move, star, and edit document contents |
| Share | Create and revoke share links, and copy existing links |
| Move to trash | Send files and folders to the trash |
| Restore from trash | Put items in the trash back where they were |
| Delete permanently | Delete items in the trash for good, and empty the trash |
Restoring and deleting permanently are separate, so a sub-user can recover mistakes without being able to destroy anything. Sub-users who had Manage trash before the split have both.
Browsing is always allowed. Every sub-user can open folders, search, and see file details, even with nothing ticked.
Opening a file (the image viewer, OnlyOffice, or a desktop app through the desktop app) needs Download, because each of these reads the file's contents. Without it, double-clicking a file shows "You don't have permission to open files".
Two shortcuts are available above the list: Allow all ticks every permission, Clear all unticks them.
Changing Permissions Later
- Go to Settings → Sub-users
- Click the permission summary in the sub-user's row to open its checklist
- Tick or untick permissions
- Click Save permissions
Changes take effect on the sub-user's next request. They do not need to log in again.
What Sub-users See
Actions a sub-user does not have permission for are hidden from the interface. A sub-user without Upload & create has no Upload button, no drop zone, and no New folder option; one without Move to trash has no Delete entry in the context menu.
If a request is made anyway, the server rejects it with 403 and a message naming the missing permission.
Removing a Sub-user
- Go to Settings → Sub-users
- Click the trash icon in the sub-user's row
- Click Yes, remove
Removing a sub-user deletes only the login. Files stay in your account, because they were always stored under your account rather than the sub-user's. The sub-user's active sessions are ended immediately.
Storage
Sub-users share your storage quota. Anything they upload counts against your limit, and a sub-user's own storage limit setting is never used.
Audit Log
Each entry records both the person who acted and the account it happened under. See Audit Logs for how to query it.
Related Topics
- Authorization - Accounts, sub-users, and permissions
- Users API - Sub-user endpoints
- Audit Logs - Reading the audit trail
Last updated on