User Invitations & the Account Lifecycle: From Invite to Deactivation
User invitations work through expiring secure links: an administrator invites by email, the invitee activates with a password and mandatory 2FA, and the invitation link dies after seven days if unused.
The invitation step is small but security-bearing: an invitation that never expires is a permanent door, and a self-service signup is an open one. This page covers the lifecycle mechanics. Siblings: user management, roles, security.
Why invitation links expire
A seven-day expiry converts the invitation from a standing credential into a timed one. An invitation email sitting in someone's inbox — forwarded, forgotten, or compromised — can't be used three months later to create an account inside your approval system. If the window passes, the administrator re-invites: a fresh link, a fresh timer, and the stale one is dead.
The activation sequence
- Invite — an administrator enters the email and role; the invitation email goes out
- Activate — the invitee follows the link and sets their own password (administrators never see or set it)
- Secure — 2FA setup completes before the account is usable: mandatory from the first login
- Work — the user appears in the directory under their role and department, ready for workflow assignment
Deactivation and re-invitation
Deactivation ends access instantly — sessions terminated, not just future logins blocked — while the user's audit history remains attributed to them permanently: the user management guide covers why that pairing matters. A deactivated user who returns to the company gets re-invited fresh: new activation, new credentials, and their historical trail intact and waiting.
Frequently Asked Questions
How long should user invitations be valid?
Seven days is the standard window — long enough for a busy hire to get to it, short enough that a forgotten or compromised invitation email isn't a standing credential.
Can users sign themselves up?
No — administrator invitation only. Self-service signup on an approval platform means anyone can create an account and appear in the directory; entry is a controlled act.
What happens when a deactivated user returns?
Re-invitation: fresh activation and credentials, with the old audit history preserved and still attributed to them.
Approvdit's invitations expire after 7 days, activation requires password plus 2FA setup, and deactivation terminates sessions instantly while history lives forever. Book a live demo.