Members

Route: /member · Menu: Management › Members · Page permission: member:R

A member is a managed person. Members do not sign in to the Console; they use the Agent on their desktop or the Agentless Portal in a browser. Console administrators are a different thing entirely — see 08 · Administrators & Roles.

What you can do here

• As an administrator, I want to see every member account, so that I can manage them.
• As an administrator, I want to create an account for a new colleague, so that they can reach the systems they need.
• As an administrator, I want to act on an account’s state — deactivate, reactivate, unlock, reset MFA, delete — so that I can keep accounts safe.
• As an administrator, I want to edit who a member is and what they may reach, so that access follows their job.
• As an administrator, I want to manage the devices registered to a member, so that a lost laptop cannot keep connecting.
• As a security officer, I want every new member to be forced into MFA by default, so that an exemption is always a deliberate act.

1. The member list

1.1 Columns

MFA Required vs MFA Enabled. Required is policy — what you decided. Enabled is fact — what the member actually did. A member with Required ON and Enabled OFF will be forced to enroll at their next sign-in.

1.2 Member statuses

1.3 Searching and filtering

Open the filter panel from the toolbar.

Rules that apply throughout:

• Different filters combine with AND; multiple values inside one filter combine with OR.
• Applying a filter resets you to page 1.
• Conditions are written into the URL, so a filtered view can be bookmarked or shared.
• Searching is debounced (1 s) so typing does not hammer the server.

1.4 Sorting

Click a sortable column header to cycle ascending → descending → default. The default is updated time, newest first. Sortable fields: name, email, status, MFA required, MFA enabled, agentless seat, created time, updated time.

1.5 Paging

Page sizes 10 / 25 / 50 / 100. Next to the selector a summary reads 共 {total} 筆; when a member quota is in force it also shows / 上限 {limit}.

1.6 Row interaction shortcuts

• Double-click a row → open its detail page.
• Single-click a row body → toggles selection, but only after you have already ticked at least one checkbox. Before that, clicking a row body does nothing, so you cannot select rows by accident.
• Clicking a button or a checkbox inside a row triggers only that control.

1.7 Saving a default filter

In the filter panel, Save as default stores the conditions currently shown in the panel (including ones you have not submitted yet) on this machine, synced across tabs. Next time you open the list with no filter parameters in the URL, that default is applied automatically and the panel opens. A URL that already carries filters always wins. Clear default removes it; you can also clear it from Preferences.

2. Row actions and when they are available

Editing is not a row action. A member’s fields are edited inline on the detail page, which requires member:U — see §8.

A button you have no permission for is not shown. A button whose status precondition is unmet is likewise not shown for that row.

The label Unactivate is what the interface says for “put this inactive account back into service”. It is the counterpart of Deactivate, not another way of saying it.

2.1 Deleting a member that is still in use

If the backend refuses the delete because the member still has linked resources, a force delete confirmation appears. Confirming re-issues the delete with force=true, removing the linked resources along with the account.

Members are the only resource with a force-delete recovery path. Applications, organizations, roles and Console users do not have one — if their delete fails, that is final until you clear the dependency yourself.

3. Creating a member

Route: /member/create · Permission: member:C

A two-step wizard, then a result page.

3.1 Step 1 — Basic information

Why MFA Required defaults to ON. Removing a second factor is a security decision and must be somebody’s deliberate act. Forgetting to switch it on must never silently produce an exempt account. Every creation path — this wizard, copy, the topology chart’s quick-create, and CSV import — starts from ON. To create an exempt account you must switch it off, or explicitly write a falsy value in the import file’s MFA Required column.

3.2 Step 2 — Password mode

3.3 The activation mail

• Valid for one hour.
• Resending invalidates the previous mail’s token. Only the newest link works.

3.4 Failure to create

The account name is checked for duplication both as you type and again on submit. Other failures show on the result step with the reason; the wizard stays open so you can correct and retry.

4. Copying a member

Entries: list row action → /member/create/:id (returns to the list) · detail toolbar → /member/:id/create (returns to that member) Permission: member:C

Copying opens the ordinary create wizard with the source member’s values already filled in.

If the seeded name or address is already taken, Merak appends a number — Copy, Copy1, Copy2, … — probing up to 20 times. Beyond that it fills in the last candidate and lets the field’s own duplicate check flag it.

Why the suffix is - Copy and not (Copy). The display name is written through to the underlying identity system, whose person-name validation rejects parentheses outright. A parenthesised seed value could never be submitted at all.

Missing a cross-feature read permission does not break the copy — the related items are simply not seeded, rather than sending a request that would be refused.

5. Member detail and account actions

Route: /member/:id · Permission: member:R

The detail page shows the full record plus cards for the member’s devices, organizations, applications and — when the feature is on — agentless applications.

5.1 Toolbar actions

The toolbar carries the same actions as the list row, plus Flow Chart.

There is no “reset password” action for members. To get a member back onto a fresh password, use Send Email while the account is pending, which re-issues the set-password mail. A member who is already active resets their own password through the sign-in page’s Forgot password flow.

5.2 Cards on the detail page

If you lose a cross-feature permission, the whole card disappears — Merak does not show an empty card you could mistake for “this member has none”.

6. Agentless seats and bindings

Flag-gated. If your deployment has agentless off, none of this appears.

Agentless access has two independent layers, and both must be in place before a member can open anything in a browser.

6.1 Granting a seat (tier 1)

1. Open the member’s detail page and enter edit mode.
2. Switch Agentless Seat on and save.

The seat is written separately from the rest of the form, because it moves a tenant-level billing count.

When the switch is disabled:

Seat availability is pre-checked in the browser, but the backend is the final word — someone else may take the last seat between your check and your save. Granting and releasing seats each raise their own audit events.

6.2 Binding applications (tier 2)

Open the Agentless applications card and pick from the list.

• Only applications the member can already reach and that have agentless switched on themselves are selectable.
• If the member has no seat, the panel says so and the unticked rows are disabled — you are stopped before you can build a selection the backend would refuse.
• Only directly assigned applications can be bound; there is no equivalent binding for organization-inherited access.

A binding is real access control, not a UI flag: an unbound member cannot reach the application even with a valid session, and removing a binding disconnects them immediately.

7. Devices

Devices are registered by the Agent when a member enrolls a machine. You can rename, deactivate and delete them, but you cannot create one from the Console.

7.1 Device fields

7.2 Device statuses

7.3 Rules and limits

• A member may register at most 5 devices.
• A new device starts as Pending and becomes Normal once verified.
• Deactivating a device invalidates its tokens immediately.
• Only an Inactive device can be deleted. Deactivate first.
• Deleting a device removes its sign-in records.

7.4 Device permissions

8. Editing a member

Route: the detail page, edit mode · Permission: member:U

8.1 Quick-select: copying someone else’s application set

Picking applications one by one for every new joiner is slow. In edit mode the application picker offers three search modes above the search box:

When you choose Member or Organization, a second control decides what applying means:

Three things make this safe to use:

1. Applications already inherited from an organization are excluded in both directions. Adding them would create a redundant direct grant that survives the member leaving the organization (a silent permission leftover); removing them would revoke a direct grant hidden under a row that stays ticked regardless — you would not see it happen.
2. A confirmation dialog lists exactly what will be added or removed, by name and count, before anything changes. If the source changes nothing, you get a message instead of an empty dialog.
3. Applying is not saving. The dialog only changes local ticks; the actual grant still needs the picker’s Confirm and then the form’s save. You can preview freely.

A Clear all button at the bottom of edit mode empties every togglable tick in one action, through the same confirmation dialog. Organization-inherited items are unaffected.

The mirror image of this exists on the application side — pick members by copying another application’s or an organization’s member set. See 03 · Applications §7.1.

9. Bulk work

Members support the full batch toolkit: Export, multi-select batch actions (deactivate / activate / unlock / delete) and CSV import in both create and modify modes.

Two member-specific notes:

• Resend activation mail and Reset MFA exist as single-row actions only. The first has an obvious per-person side effect that should not be fired en masse; the second depends on each row’s own MFA-enabled state.
• Member batch delete does offer a force-delete recovery path, unlike other resources.

Full instructions: 09 · Bulk Operations.

10. Permission summary

Every state-changing action on a member maps to the single key member:U. There are no finer-grained keys such as members.unlock — the whole permission catalogue is <resource>:C/R/U/D and nothing else.

Next

• Group members so access can be granted collectively: 04 · Organizations
• Publish something for them to reach: 03 · Applications