Partner Admins
An external organization can maintain its own users through a Partner Admin while your Site retains control over which files the Partner may access. This gives the Partner responsibility for its users and their recovery channels. Some user-management powers are included whenever you appoint a Partner Admin; optional settings add further capabilities.
Partner Scope
Site Administrators and Workspace Administrators choose who receives Partner Admin access within their scope. All Partner Users inherit the Partner's folder permissions and remain within its Root Folder. They cannot belong to Groups or hold Site Administrator or Workspace Administrator permissions.
A Partner Admin can change an individual user's File System Layout to show a subfolder or restore the full Partner Root view. That individual layout is under the Partner Admin's control; the Partner's Root Folder and permissions remain the limit the administrator cannot expand.
Partner Admin access does not itself grant folder administration, authority to change site-wide security policy, or permission to grant administrative access to other users. Choose the Partner's Root Folder and permissions for the external organization as a whole, rather than relying on an individual user's narrower layout to limit its administrator.
Unlike Group Admin capabilities, the optional Partner Admin Settings apply separately to each Partner.
Powers Included in Partner Admin Access
A Partner Admin can edit, enable, disable, and delete accounts within their Partner even when all optional Partner Admin Settings are disabled. Account editing includes email addresses, usernames, profile details, authentication methods, access expiration, and folder layout. Partner Admins can also resend welcome emails. Grant this access only to someone you trust to maintain the organization's accounts and decide whether existing users should retain access.
Partner Admins can manage Additional Email Recipients for their users. These recipients receive copies of eligible account and notification emails, so this authority can disclose information about the Partner's activity to additional people. Password recovery, welcome emails, email verification codes, and emails containing signed download links go only to the primary recipient. A Partner Admin cannot choose the internal Responsible Party assigned to a user or to the Partner.
Partner Admins can initiate, view, and cancel pending Connected Site requests. A Site Administrator at the invited Files.com site must approve a connection. Once approved, every Site Administrator on that Guest Site can access the Host Partner's folders. The Guest can use those folders with its own sharing, permissions, and workflows, including making content available to its users and external recipients. Review the invited organization as well as the individual accepting the invitation, because the Guest controls that use on its own site. The Host Partner's permissions still apply to every operation on the Host's files. Disconnecting an established connection requires a Site Administrator on either site.
Partner Admins can view relevant policies, including 2FA requirements and User Lifecycle Rules, so they can understand the conditions governing their users. They cannot edit those site policies or grant themselves broader Partner permissions.
Optional Partner Capabilities
| Partner Admin Setting | What you are delegating |
|---|---|
| Allow user creation | Adding new accounts with the Partner's existing folder access. The Partner Admin decides who else in the organization receives that access. |
| Allow credential changes | Setting passwords, resetting enrolled 2FA methods, and managing SSH keys for Partner Users. Trust the administrator to manage how those users authenticate, including credentials that can be used to sign in as them. |
| Allow bypassing 2FA | Overriding the site's 2FA requirement for individual Partner Users. This can let a user sign in without the second factor the site would otherwise require. |
| Allow providing GPG keys | Managing the Partner's GPG keys for encrypted file exchange. Folder Admins still configure folder encryption or decryption; the Partner Admin supplies and maintains the key material those workflows depend on. |
Keep the two 2FA-related settings distinct. Resetting enrolled methods changes which second factor a user can present; overriding the requirement changes whether the user must present one. Turning off all four optional settings does not remove the account-management powers included in Partner Admin access.
When delegating GPG key management, coordinate key replacement with the administrator responsible for the file-processing workflow. The selected public key determines who can decrypt encrypted output, while decryption depends on the matching private key. Changes to keys used by a workflow can affect both its recipients and its ability to process files. Follow the GPG Key Manager guidance when replacing or retiring keys.
Credential Control and Permission Changes
Every Partner Admin can edit their users' email addresses, including the address used for password recovery. Disabling direct credential changes does not remove that recovery-channel control. Password Recovery & Credential Changes explains the interaction with password recovery, second factors, and active sessions.
Removing Partner Admin access does not undo users, recovery addresses, credentials, additional email recipients, or Connected Site access already arranged. Administrative Permission Changes explains the review needed when that responsibility ends. Partner Users and Partner Admin Settings explain assignment and configuration.