Organizations and users
How TxNets, people and roles fit together in TxHub: owners, admins and members, joining with a work account, and service accounts.
Everyone who uses TxHub belongs to at least one TxNet, and has a role there. This page explains the roles, how people get into a TxNet, and how your organization’s single sign-on fits in. It is mostly for admins, but it is useful for anyone who wants to know what they can and cannot change.
How it fits together
| Thing | What it is |
|---|---|
| TxNet | A private network of devices. Each person and device belongs to a TxNet, and each TxNet has its own access policy, DNS and settings. |
| User | A person who signs in, with a password or with their work account over single sign-on (SSO). A user has a role in each TxNet they belong to. |
| Organization | Your company’s single sign-on setup: the Microsoft Entra ID directory you sign in with, the email domains that use it, and the rules for who may join. In the dashboard it is called an SSO integration. |
The organization controls how people sign in and whether they can join a TxNet on their own. It does not give anyone extra rights inside a TxNet. What you can do in a TxNet depends only on your role in that TxNet.
Roles in a TxNet
Every member of a TxNet has one of three roles:
| Role | What they can do |
|---|---|
| Member | Uses the network. Connects their own devices, sees their own machines under My machines, sees the network map, and manages their own two-factor authentication and enrollment keys in My settings. |
| Admin | Runs the network. Sees every machine, opens Users and Settings, approves routes and exit nodes, edits the access policy, DNS and applications. Can add members and manage members, including making a member an admin. |
| Owner | Everything an admin can do, and can also manage other admins and owners and make someone an owner. |
- An admin cannot change or remove another admin or an owner. Only an owner can.
- A TxNet always keeps at least one owner. You cannot remove the last owner or change their role. Make someone else an owner first.
- You cannot remove yourself from a TxNet.
The Users page
Admins and owners manage people under Users in the sidebar. Members do not see this page. The list shows each person’s role, status, last login, how many machines they have and whether two-factor authentication (MFA) is on.
Add a person
- Open Users and click Create User.
- Enter their Email address and a Password of at least 8 characters, and choose a Role.
- Click Create User and share the password with them in a safe way. They can change it after signing in.
If your company signs in with SSO, you usually don’t need this. People can join on their own instead, see Let people join with their work account.
Manage a person
Open the actions menu (…) on a row to:
- Change role: make them a member, admin or (owners only) owner.
- Require MFA or Reset MFA: see Sign-in and SSO.
- Set Password: give them a new password, for example if they forgot theirs.
- Configure machine limit: cap how many devices they can add. Leave it empty for unlimited, or set 0 to stop them adding devices. A person who reaches the limit sees “You have reached your machine limit” when they try to connect a new device.
- Remove user: take them out of the TxNet.
System accounts
A system account (also called a service account) is a user that can never sign in. It has no password and no SSO. Use it to own an unattended fleet, such as servers or kiosks, so that those devices don’t depend on a person’s account.
- In Users, click Create User.
- Turn on System user (no login) and enter an address such as
fleet@yourcompany.com. No password is needed. - In Settings → Enrollment keys, create an Organization-owned key and choose the system account as its Owner. See Enrollment keys.
System accounts show a no-login badge in the user list.
Let people join with their work account
When your organization uses single sign-on, people can join a TxNet the first time they sign in with their work account, without an admin creating them. This is called auto-join. It is set per email domain, such as yourcompany.com.
TxHub sets up the organization for you: it connects your Microsoft Entra ID directory, adds your email domains and names one or more Managers. Managers see SSO in the sidebar and look after auto-join and invites from there. Being a manager does not make you a TxNet admin.
Turn on auto-join
- Open SSO in the sidebar and choose your organization.
- Under Domains & auto-join, pick the Target TxNet for the domain. You must be an admin or owner of that TxNet.
- Choose a Join mode:
- Allow-list: only people you invite or approve can join.
- Open: anyone with a work account on the domain joins automatically.
- Switch the domain to Auto-join on.
Invite people
Under People, enter an email address and click Send invite. They get an email, and join the target TxNet the first time they sign in with their work account. You can only invite addresses on a domain that belongs to your organization. The list shows each person as Pending until they join, then Joined. On an Open domain the list is a record of who has joined, not a gate.
What auto-join does and doesn’t do
- People who join this way always get the Member role. Making someone an admin or owner is always a deliberate step on the Users page.
- Auto-join only adds people who are not in any TxNet yet. Someone who already belongs to a TxNet is left as they are.
- If an admin removes someone from a TxNet, auto-join will not quietly add them back.
- People on an SSO domain always sign in with SSO. Password sign-in is turned off for those addresses.
- Someone who signs in but is not allowed to join sees “No network access yet” and is asked to contact an administrator.
Good to know
- Members only ever see their own machines in the dashboard. To see which devices they can reach, they can run
txhub statuson their device. - Your role controls the dashboard. What devices can reach each other is controlled by the access policy.
- Roles take effect straight away. A person you demote or remove loses that access on their next request.
txhub status