From f966c4815d5ead1f4d904b9c1f7078226159e78a Mon Sep 17 00:00:00 2001 From: Bruno Mercier Costa <94469565+emrcbrn@users.noreply.github.com> Date: Fri, 16 Oct 2026 12:02:17 +0200 Subject: [PATCH] docs: cover users waiting on their own approval after a second sign-in method (#1045) * docs: cover users waiting on their own approval after a second sign-in method A user who created the account with Google or Microsoft and later signs in with email and password gets a second NetBird user with the same email, since users are identified by their IdP user ID. Domain matching adds it to their own account, where user approval holds it, so the Waiting for Approval screen names their own address. Adds a section to the account access page with the cause, the fix (sign in with the original method, reject the extra user), the no-approval and public-domain variants, and links it from the intro, the What to do steps and the troubleshooting hub. * docs: delete, not reject, the extra user when approval is off Without user approval the second sign-in joins straight away, so it is not pending and Reject does not apply. Point to Delete in the user's actions menu under Team -> Users instead. --- .../help/troubleshooting-account-access.mdx | 24 +++++++++++++++++-- src/pages/help/troubleshooting.mdx | 1 + 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/src/pages/help/troubleshooting-account-access.mdx b/src/pages/help/troubleshooting-account-access.mdx index 8b42a0d1..6da05b1c 100644 --- a/src/pages/help/troubleshooting-account-access.mdx +++ b/src/pages/help/troubleshooting-account-access.mdx @@ -1,6 +1,6 @@ import {Note} from "@/components/mdx"; -export const description = "Why NetBird shows you a Waiting for Approval screen, adds you to an account you don't recognize, or gives a teammate an account of their own, and how to resolve it safely." +export const description = "Why NetBird shows you a Waiting for Approval screen, adds you to an account you don't recognize, asks you to approve yourself, or gives a teammate an account of their own, and how to resolve it safely." # Pending approval and account invitations @@ -8,6 +8,8 @@ Signed in to NetBird and landed on a **Waiting for Approval** screen, or in a Ne The opposite also happens: a teammate signs in and gets a new, empty account of their own instead of joining yours. See [A teammate got their own account](#a-teammate-got-their-own-account). +If the screen asks you to wait for approval from your own email address, see [The screen names your own address](#the-screen-names-your-own-address). + ## What the Waiting for Approval screen tells you After you sign in, the dashboard shows three steps: **Account Created**, **Waiting for Approval**, and **Join Account**. Your user exists, but the account requires new users to be approved before they can use it, so you are held at the second step until someone approves you. @@ -31,7 +33,7 @@ NetBird can add people to an account without a manual, one-by-one invite: ## What to do -1. **Check the domain on the screen.** It is normally your organization's email domain. Confirm with your IT or security team that they run NetBird and expect you on it. +1. **Check the domain on the screen.** It is normally your organization's email domain. Confirm with your IT or security team that they run NetBird and expect you on it. If the address looks like your own, see [The screen names your own address](#the-screen-names-your-own-address) instead. 2. **Ask the owner or an admin to approve you.** The screen names the account [Owner](/manage/team/user-roles#owner), of which there is exactly one per account, but any admin can approve you as well. They do it from the dashboard's user list. See [Approve or reject user](/manage/team/approve-users#approve-or-reject-user). 3. **Click Refresh once you are approved.** The screen moves you into the account. If it still shows Waiting for Approval, your browser may be holding on to a cached session: open the dashboard in a private browser window and sign in again. 4. **If something looks off,** for example the domain is not your organization's, you don't recognize the account, or no one internally owns it, do not ask anyone to approve you. Click **Log Out**, treat it as suspicious, and verify internally first. @@ -40,6 +42,24 @@ NetBird can add people to an account without a manual, one-by-one invite: On self-hosted NetBird, the Waiting for Approval screen needs dashboard v2.93.0 or later, and the owner's address on it needs management v0.80.0 or later. Older dashboards show a **User Approval Pending** error page with only a **Sign Out** button instead: the steps above still apply, but after you are approved, sign out and sign in again. +## The screen names your own address + +You signed in as `lisa.wong@example.com`, and the Waiting for Approval screen says you are waiting on `li****g@example.com`. The Owner you are waiting on is you. + +On NetBird Cloud, this happens when you created the account with one sign-in method, for example **Google** or **Microsoft**, and later signed in with a different one, for example an email address and password. NetBird tells users apart by how they sign in, not by their email address, so the second sign-in created a second user with the same email. Its domain, `example.com`, already belongs to the account you own, so [domain matching](#why-this-happens) added that second user to your account, where it waits for approval from the Owner: you, under your original sign-in method. + +The two users are not linked, and approving the second one does not merge them. It only gives you a second user in your account with the User role, not Owner. To get back in as Owner: + +1. **Click Log Out.** +2. **Sign in with the method you used to create the account.** If you don't remember which one, try each option on the sign-in page with the same email address. The right one opens your account as its Owner, with your peers and settings. +3. **Reject the extra user.** In **Team → Users**, the second user shows your email address and is waiting for approval. Click **Reject** to remove it. See [Approve or reject user](/manage/team/approve-users#approve-or-reject-user). + +From then on, sign in with your original method only. If you use the other method again, NetBird creates the second user again and you are back on this screen. + +If your account does not [require user approval](/manage/team/approve-users#require-user-approval), you don't see this screen. The second sign-in joins your account straight away with the User role, so you are in your own account but can't manage it. Log out and sign in with your original method as in steps 1 and 2. The extra user is not pending, so you can't reject it: in **Team → Users**, open the actions menu on its row and click **Delete** instead. + +If you signed up with a public email address, such as a Gmail account, domain matching never applies. The second sign-in lands in a new, empty account of its own instead. Sign out and sign in with your original method to get back to your account. If you don't need the empty account, sign in to it once more and [delete it](/manage/settings/delete-account). + ## A teammate got their own account A teammate signs in to NetBird Cloud and lands in a new, empty account, with none of your peers, users, or policies. NetBird did not match their email domain to your account, so it created a separate one for them. One of these is usually the reason: diff --git a/src/pages/help/troubleshooting.mdx b/src/pages/help/troubleshooting.mdx index cc6ca28e..1181e95b 100644 --- a/src/pages/help/troubleshooting.mdx +++ b/src/pages/help/troubleshooting.mdx @@ -98,6 +98,7 @@ The problems support sees most often. "Approvals, landing in the right account, session expiry, SSO and provisioning, MSP tenants, and NetBird Cloud plans.", chips: [ { label: "Pending approval", href: "/help/troubleshooting-account-access" }, + { label: "Waiting on your own approval", href: "/help/troubleshooting-account-access#the-screen-names-your-own-address" }, { label: "Teammate got their own account", href: "/help/troubleshooting-account-access#a-teammate-got-their-own-account" }, { label: "Can't invite or sync a user", href: "/help/troubleshooting-user-in-another-account" }, { label: "Sign-in domains", href: "/manage/team/sign-in-domains" },