Invite a client and manage portal access
Invite a contact to the portal, understand what the activation link does, and use invited, active and suspended states to control access without losing history.
Portal access belongs to a contact. You invite the contact, they activate the invitation themselves, and from then on they sign in with their own credentials. These actions need the portal-manage permission.
Invite a contact
From CRM → Client portal, choose Invite contact.
- Search contacts — type at least two characters and pick the person. If they are not in the CRM yet, add the contact first.
- Email — prefilled from the contact record. This is the address the invitation goes to and the address they will sign in with, so change it here if their login address differs from the one on file.
- Send invitation.
They receive an activation link, not a password. Nothing internal is exposed by the invitation.
If the contact already has portal access, the dialog says so: "This contact already has portal access. Remove them first to re-invite."
What happens on their side
Opening the activation link, the client:
- Sees who invited them and which email the invitation was sent to.
- Signs in or creates an account — with the invited address. If they are signed in under a different address, the page tells them there is a mismatch rather than activating the wrong account.
- Agrees to the Terms of Service and acknowledges the Privacy Notice.
- Chooses Activate portal access and lands on their portal dashboard.
Three things can go wrong, and each says so plainly:
- Link expired — ask the sender for a new invitation. Use Resend invitation on your side.
- Already activated — they should sign in at the portal login page instead.
- No longer valid — the invitation was removed. Invite again.
The three access states
| State | What it means | What you can do |
|---|---|---|
| Invited | The invitation was sent; they have not activated yet. | Copy invite link to send it another way, or Resend invitation by email. |
| Active | They have activated and can sign in. | Send form request, Suspend access, or Remove from portal. |
| Suspended | Access is revoked, history kept. | Reactivate at any time. |
The Portal users list shows each person's status, the email they sign in with, when they were invited or added, and when they last signed in. The footer counts active, invited and suspended users.
Copy invite link works only while an invitation token exists. If it says no token is available, use Resend invitation first, then copy.
Suspend or remove
- Suspend revokes access immediately and keeps their submission history. Use it for staff turnover at a customer, a paused engagement, or a security concern you are still investigating. Reactivating restores access.
- Remove permanently revokes portal access and cannot be undone.
Prefer suspend. If the same person comes back, you keep everything they ever submitted — and a suspended user can be reactivated in one click.
When a client cannot sign in
The portal login page names the cause:
- "You do not have access to this client portal" — no portal user record. Invite them.
- "Your portal account has been suspended" — reactivate, if that is intended.
- "Your account has not been activated yet" — they never completed the activation link. Resend it.
Clients reset their own password from the Forgot password link on the portal sign-in page; you never handle their password.