Maintain team roles and remove access

Company membership, role permissions, and account ownership are different controls. Start with the correct company and review the person’s actual job before changing access.

Where to go: Settings → Team & Access. Use Team for company members, External Accountants for outside accountants, and Roles for role definitions.

Review and change a member’s role

1. Open Team, locate the person, and confirm their identity and membership status.
2. Inspect the Role badge for its access summary.
3. If you have permission, use the menu beside the role to choose the intended predefined or custom role. Review the scope before selecting it; a role change can immediately affect access.
4. Confirm the saved role in the table and have the member check the relevant page after refreshing their session.

The current user’s own role and the owner row are protected from ordinary role editing. Do not use Transfer Ownership as a workaround; that changes who owns the company and requires a separate deliberate handover.

Build or review a custom role

In Roles, open the role editor or start a new role. Give it a clear name and review its page/action permission tree. Select only the access needed for that job, then save and assign it to the intended member.

Pay attention to shared-permission hints. Some actions share a permission: unchecking one entry may hide that button while another selected entry still grants the underlying action. Review all related entries when withdrawing access. A hidden menu entry by itself is not proof that a person has lost the permission.

Before assigning a role widely, have an authorized test member verify both a task they should perform and a task they should not. Do not give broad administrator access simply to make a missing button appear.

Choose the correct membership action

Situation	Team action	Check afterward
A pending invitation was sent to the correct person but not received	Resend invitation, after checking the address and delivery status.	Delivery and invitation validity. A resend does not mean the person has joined.
A pending invitation is no longer appropriate	Revoke invitation.	The invitation is no longer active.
An active member needs a temporary access stop	Disable.	The membership shows disabled.
A disabled member should return	Enable, after reviewing their role.	The membership is active with the intended permissions.
A member has left the company	Remove, after reading the confirmation.	The membership is removed; review any other company access separately.

Available actions depend on status, your permissions, and owner/self protections. Read the confirmation before applying a lifecycle action. Removing membership is not a way to erase the person’s historical accounting activity.

External accountants

Use the External Accountants table for their invitations and access. Its actions include Suspend access, Edit permissions, and Remove external accountant, depending on status and permissions. Review the accountant’s granted scope and pending invitations separately from employee roles.

Verify and troubleshoot

Review the role/status shown after the change and relevant Audit Log activity. A missing action may be caused by permissions, the member’s state, company context, or a plan limit. Check missing actions before changing unrelated settings. Never share the owner’s sign-in as a substitute for an individual invitation.