To avoid security issues around a login identifier that belongs to multiple companies, the following updates were implemented: 

• If an employee record is created and its email is later updated manually, an error message will display when the updated email address is already registered by an employee from another company. Users will then need to enter in a different email address.
• Email addresses that are included in an User Data Feed file but are already tied to an employee from another company will cause the file import to fail.
• Paradox Admins can add a user with the same login email to a new company, but any other user cannot.

Employee email address with access to 2+ accounts

Users with full access to Roles and Permissions and users with impersonating access may come across a security measure when updating the email address or phone number for any user with access to 2+ CEM accounts.

An example of a process that leads to this security measure is as follows:

• User A has a login email (created from the "job email" which is what's editable in the UI) of usera@gmail.com. This login email has access to 3 CEM accounts.
• User B has a login email of userb@gmail.com. This login email has access to 1 CEM account.
• User B attempts to update the email address usera@gmail.com of User A’s Employee record to be userb@gmail.com, but an error displays.

The security measure taken results in an Update User Details error displaying when User B attempts to save User A’s updated Employee Profile. Action will then need to be taken to allow the update to be made.

Process to update the email address

When an Employee Profile is updated for a user who has access to 2+ CEM accounts, the following will take place depending on how that Employee Profile is updated:

Option #1: Manually update from the CEM

1. When an email address is updated and the record is saved, an error will display and a verification code will be sent to the existing login. This can take place in one of two places:
   • Roles and Permissions
   • My Profile (for themselves or another user)
2. The user who’s email address was updated will then need to open the automated Olivia Alerts email sent to the existing login’s email address to view the verification code sent.
3. The user will then need to provide this information to the user updating their email address so that they can enter the verification code in the CEM and select the Yes, Make the Changes button to finalize the update.

Option #2: Update via Public API

The request will be rejected with an Unable to update user due to multi-account access error.

Option #3: Update via User Feeds (Data Feeds)

• If sync_user_email is enabled, the file will display an Unable to update user due to multi-account access error.
• If sync_user_email is not enabled, then the email will be updated on the user profile (UI only), but it will not be authorized until an admin manually goes in and edits the user profile.

Resolve locked out employee issues

If you have a user who is logged out of their active profile due to not having access to their existing login email, then contact your CS Representative or support team for assistance.