See who reaches what in the Access tab

Your own access and why, the organization's overview with View as, requests, ways in from outside and tokens - all in one tab.

In short

The Access tab answers one question: who can open what, and why. Every member sees their own access and the requests that wait for them. People who may read the whole picture also see every member's reach, View as, ways in from outside and tokens. It shows only what you are allowed to see.

Before you start

• Who: every member sees "My access" and their own requests. "Overview" and "Outside access" need "See who reaches what"; "Roles" needs "See roles"; "Tokens" needs "Manage access tokens and service accounts"; "Security log" needs "Read the audit and security logs".
• Plan: Organizations is part of every plan, Free included. Your plan sets how many members and teams an organization may hold (Plan & usage shows them).
• First: make the organization your workspace.

Steps

1. Open the organization and choose "Access".
2. In "My access", read your role, your teams and "What you can open, and why", module by module.
3. Use "Find a thing you can open" to search by name, and "Ask for more" on a thing to ask for a higher level.

1. Open "Overview" (it needs See who reaches what).
2. Type in "Who or what do you want to check?" to find a person, a team, a role, a guest, a service account - or a thing.
3. Narrow by "Team" and "Role", or by "Can manage", "Lowered by role", "Not seen 30 days", "Paused" or "Dangerous permissions".
4. Press a person to see what they reach and why, or "View as" to see the page they would see, read-only.

Result: each thing carries its reason as a short chain, for example "Role: Member - Team: Payments - Shared by name at Edit = Edit".

1. Open "Security log" (it needs Read the audit and security logs). Under "Log", sign-ins and failed ones, two-step sign-in, passkeys, password resets, single sign-on, domains, access rules and tokens are listed, newest first.
2. Narrow it with "Event" and "Days", or press a person's name on a row to see only their events.
3. Press "Download CSV" to take the list out with the same filters. It is part of a plan with the audit export.

My access

• "Lowered by role" means a share gives you more than your role allows; the share is kept and counts the day your role allows it.
• "Who to ask" for anything else names the organization's administrators.
• "Looked at by" lists anyone who looked at your access with View as, and when.
• Your personal tokens and calendar feeds belong to you, not the organization. Only you see them.
• Your requests that wait list what you asked for - a thing, a place in a team, a module or a permission - with "Take back".

The overview

The summary counts people and people who can open anything with Manage all. It counts things nobody manages and people not seen for a while who still reach things. It also counts ways in from outside that never expire, requests that wait, paused members and stopped work. The lines under "Needs a look" open the list behind them. Members, Outside (guests) and Machines (service accounts) are listed apart. "Export CSV" downloads the overview with your filters; the export is recorded in Activity.

Pick a thing in the search to open "Who reaches it". It shows the shares as themselves (a team or a role with its size), and everyone who can open it, with level and reason. "Change who it is shared with" opens the thing's own Share dialog.

View as a member

Every look is recorded Each View as is one line in Activity, and the person sees on their own My access that you looked, and when. Look only when you need to.

• A paused member reaches nothing while paused; the page says until when.
• A member who has not set up two-step sign-in, where the organization requires it, reaches nothing until they do.
• A guest reaches only the boards they were let onto.
• A service account reaches only what is shared with it by name, Edit at most.

Nobody manages, stopped work and single points

A team's lead or deputy sees the stopped work of their own branch on the team's My branch page.

Requests

• Requests for access to a thing you manage: "Share" at a level, or "Decline". If you only read who reaches what, you see the request but its managers answer it.
• Asked of you as an administrator: someone asks to turn a module back on, or for a permission. "Turn it on", "Open roles", or "Dismiss".
• Requests to join a team you answer for: "Add" or "Decline".

The same requests reach your inbox. A request that no longer holds - its asker left, or got access another way - disappears by itself.

Outside access and tokens

"Outside access" lists every way into the organization from outside. These are guests on boards, links to cards and release records, public forms, mock servers, webhook inboxes and published pages, tokens and join links. Each row says what it is, what it is on, who made it, when it ends and when it was last used. It is marked when it never expires, can change things or was not used in a while.

• "Revoke" stops a way in at once. "Revoke all" does the same for every row shown and says what became of each.
• "Set an end date" brings the end of a join link, a token or a webhook inbox forward. An end can only come sooner.
• "Ask its managers to revoke" puts one item in the inbox of whoever may end it, when you may not.
• "Tokens", for people who manage access tokens and service accounts, lists service accounts, their tokens and members' personal tokens that work here, with revoke. See /help/settings/access-tokens.

Good to know

• Things that are not open to you are not listed or counted anywhere in the Access tab.
• In a small organization - fewer than ten members, no role of its own, no token and no request yet - the tab is one page. Each view gets a tab of its own once it is used, or when the organization grows past ten members.
• While the organization is frozen nothing can be ended, and while it is not active no way in answers anyone outside.
• In the Security log, the same event of one person or network close together shows once, with how many times and when it first happened. A failed or refused one is marked "Refused".
• "How we stand", beside "Log" in the Security log, shows Security at a glance, the security questionnaire answered live and how long the audit log stays online (see /help/organizations/security-and-data-report).

If something goes wrong

• "Overview" is missing: you lack See who reaches what. Your own access is under "My access".
• A thing you expected is not listed: it is not open to you, so it is not counted either.
• "Revoke" is not offered on a row: you may not end that way in. Use "Ask its managers to revoke".
• "Security log" is missing: you lack Read the audit and security logs.

Related

• /help/organizations/sharing
• /help/organizations/roles-and-permissions
• /help/organizations/activity-log