Guest users have limited access to Amplify: they can submit initiatives through the Initiative Submissions form, and nothing else. They're created through your organization's identity provider, when they sign in with single sign-on, and they don't use one of your Amplify licenses. This article covers what guest users can do, creating them, changing a user between guest and standard, and removing their access.

This article needs administrator access, and single sign-on to be set up for your organization — see Authentication. Guest users also need Initiative Submissions to be set up — see Configuring Initiative Submissions.

What guest users can do

A guest user can:

• Submit initiatives — the Initiative Submissions form is their home page, and opens when they sign in. See Initiative Submissions.
• Edit their account — on Edit your Amplify Account, a guest user can change their avatar, and their language where your organization uses more than one. Their name and email address come from your identity provider, and can't be changed in Amplify. Guest users don't have a password or two-factor authentication to manage, since they sign in with single sign-on.
• Sign out.

Everything else in Amplify is closed to guest users:

• Any other page they open takes them back to the form.
• They can't be chosen as the owner of an item, mentioned, or added from the lists of users elsewhere in Amplify.
• They can't be given admin access, admin roles, custom field values, or a resource type.
• They can't join the Amplify mailing list.

Where Initiative Submissions is turned off, a guest user who signs in is signed straight out again, with a message that submissions are closed, and to contact the person who invited them.

User types

Each user is either a Guest or a Standard user. Your identity provider sets their type with the amplifyUserType attribute it sends when they sign in with single sign-on:

• Guest — the user is a guest user.
• Standard — the user is a standard user.
• Not sent, or anything else — a new user is a standard user, unless guest users are created automatically — see Creating guest users automatically. An existing user's type doesn't change.

A user's type can only be changed through your identity provider, not in Amplify.

Creating guest users

Guest users are created the first time they sign in with single sign-on, in one of two ways.

From your identity provider

Your identity provider marks each guest user. To create guest users this way, Create user if the user does not exist needs to be turned on for your identity provider, under Administration > Authentication.

To create a guest user:

1. In your identity provider, give the person access to Amplify.
2. Set their amplifyUserType to Guest.
3. Ask them to sign in to Amplify with single sign-on. They're created as a guest user, and the Initiative Submissions form opens.

Creating guest users automatically

Instead, anyone your identity provider lets into Amplify can become a guest user simply by opening the Initiative Submissions link — without being marked in your identity provider, and without opening the rest of Amplify to new users. To turn this on, check Auto-create guest users via the Initiative Submission URL for your identity provider, under Administration > Authentication.

A person is created as a guest user this way when:

• they start from the Initiative Submissions link, and sign in with single sign-on in a browser — not the mobile app;
• they don't already have an active Amplify account with the same email address;
• your identity provider sends their email address and name, and doesn't send an amplifyUserType; and
• Create user if the user does not exist is turned off. Where it's on, new users are created as usual instead, by their amplifyUserType.

Signing in any other way doesn't create a guest user, and someone who already has an account isn't changed into a guest user.

Users created through single sign-on always sign in with it, rather than with a password.

Finding guest users

Guest users are hidden from the list under Administration > Manage Users by default. To see them, change the filter on the User Type column. See Managing Users.

Changing a user's type

To change a user between guest and standard, set their amplifyUserType in your identity provider to Standard or Guest. The change is made the next time they sign in with single sign-on. Removing the attribute, or leaving it blank, doesn't change an existing user's type.

When a standard user becomes a guest user, everything they own is reassigned to your organization's fallback owner, such as Amplify Owner. Their admin roles and administrator access, access to Ask Amplify and the API, and permission to create programs are removed, and they're disconnected from the mobile app. None of this is given back if they become a standard user again — reassign their items, and give them access again, under Administration > Manage Users.

Removing a guest user's access

• To stop a guest user signing in — lock them under Administration > Manage Users. A locked user can't sign in, whatever your identity provider allows.
• To remove a guest user — remove their access to Amplify in your identity provider, then delete them under Administration > Manage Users.

For managing users, see Managing Users. For setting up the form guest users submit through, see Configuring Initiative Submissions.