Settings & security

Workspace settings, custom fields, roles and members, two-step sign-in and the audit log.

Checked against the app on Wednesday, November 4, 2026

For HR and administrators

1. What Settings is for and who can use it

Settings is where the workspace Owner and Admins set Moazaf up for the whole company: the workspace profile, who can sign in and what they may do, extra fields on profiles, document rules, request types, notifications and the audit log. Your own password and two-step sign-in are not here: they are on Account & security, in the menu under your name.

Settings

The menu on the left is grouped. You only see the pages your role allows, so an HR Manager sees a shorter menu than the Owner.

Settings opened on Workspace profile. The menu on the left lists the pages in groups: General, Access, Organisation, Documents, Fleet & assets, Requests & leave and Compliance.

General
Pages
Workspace, Plan & billing, API & webhooks, AI
More help
Workspace is below. Plan & billing has its own guide, Plans & billing.
Access
Pages
Governance, Members, Roles & permissions, Service providers
More help
Members and roles are below in this guide.
Organisation
Pages
Departments, Cost centres & projects, Offices & sites, Custom fields
More help
Custom fields are below. Offices are in the Attendance guide.
Documents
Pages
Document types, Mandatory documents, Reminders
More help
See the Documents guide.
Fleet & assets
Pages
Resource types
More help
See the Fleet and Assets guides.
Requests & leave
Pages
Onboarding checklists, Request types & approvals, Leave, Letter templates, Service desk, Notification channels
More help
Each has its own guide.
Compliance
Pages
Audit log, Data export
More help
The audit log is below in this guide.

Group	Pages	More help
General	Workspace, Plan & billing, API & webhooks, AI	Workspace is below. Plan & billing has its own guide, Plans & billing.
Access	Governance, Members, Roles & permissions, Service providers	Members and roles are below in this guide.
Organisation	Departments, Cost centres & projects, Offices & sites, Custom fields	Custom fields are below. Offices are in the Attendance guide.
Documents	Document types, Mandatory documents, Reminders	See the Documents guide.
Fleet & assets	Resource types	See the Fleet and Assets guides.
Requests & leave	Onboarding checklists, Request types & approvals, Leave, Letter templates, Service desk, Notification channels	Each has its own guide.
Compliance	Audit log, Data export	The audit log is below in this guide.

Owner: can change every page. Only the Owner can change Governance. By default only the Owner can also export the whole workspace and change the plan; the Owner can give those two permissions to a custom role.
Admin: can change almost everything except payroll, billing changes, Governance and the whole-workspace export.
HR Manager: can manage Departments, Cost centres & projects, Custom fields, the document pages (Document types, Mandatory documents, Reminders), Leave and Onboarding checklists. They can see Offices & sites but not change them.
Payroll Admin, PRO, Fleet Manager and Auditor: can open some settings to read them. When you can only read a page, it says You can view these settings but not change them.

For HR and administrators

2. Workspace profile and company logo

Settings › Workspace

Change the Company or group name, Country, Time zone, Default language, Industry or Number of employees.
Tick Watermark document downloads if you want PDFs and PNG or JPEG scans stamped with the workspace, the person viewing them and the time whenever they are opened or downloaded. Files opened through a share link are stamped with the link's name instead of a person. Other file types, and files Moazaf can't read (for example password-protected PDFs), are sent unchanged.
Click Save changes. You see Workspace updated.
Under Company logo, upload your logo (PNG, JPG or WebP, up to 1 MB). It is printed on payslips, final settlement statements and letters.

The Workspace address (the part of the link after /w/) is fixed when the workspace is created and can't be changed.

The time zone matters: attendance days, reminder dates, the From and To dates in the audit log and the time on each audit log line follow it. For the UAE keep Asia/Dubai.

For HR and administrators

3. Custom fields: extra details on profiles

Custom fields add the details your team tracks that Moazaf does not have by default, such as uniform size, badge number or locker number. You can add them to employees, companies and documents. They appear on the forms and profiles under Additional fields.

Settings › Custom fields

Choose the tab: Employees, Companies or Documents.
Click Add field.
Type the Label (English) and the Label (Arabic).
Choose the Type: Text, Number, Date, List, Yes / no or File.
For a List, type the choices under Options, one per line.
Tick Required if the field must always be filled in, then click Save.

The Add custom field window with the English and Arabic labels, the type set to List and four sizes typed as options.

Key is the short name the API uses for the field. Leave it empty and Moazaf makes one from the English label. It can't be changed later.
Order sets where the field shows among the other custom fields.
Untick Active to hide a field from forms without losing what was entered.
Deleting a field removes it from every profile. Values already entered are kept but hidden.

The Owner, Admins and HR Managers can manage custom fields.

For HR and administrators

4. Roles and permissions

Every member has one role. The role decides which pages they see and what they can do there. Moazaf comes with ten built-in roles that suit most UAE companies:

Owner
What it can do
Everything, including billing, payroll and closing the workspace.
Admin
What it can do
Everything except payroll (off by default) and billing changes.
HR Manager
What it can do
People, documents, leave and attendance. Sees costs, but not payroll or expense claims.
Payroll Admin
What it can do
Payroll, WPS, end of service and expense claims. Sees people and documents, with salaries and bank details.
Finance
What it can do
Costs and budgets, files and approves expense claims, sees payroll.
PRO / Documents Officer
What it can do
Documents and renewals, with government and document fees only.
Fleet Manager
What it can do
Vehicles, assets and handovers, with vehicle costs only.
Line Manager
What it can do
Sees their own team and approves the team's requests and leave.
Employee
What it can do
Self-service: their own profile, documents, requests and payslips.
Auditor
What it can do
Read-only access to everything except payroll and billing, including the audit log.

Role	What it can do
Owner	Everything, including billing, payroll and closing the workspace.
Admin	Everything except payroll (off by default) and billing changes.
HR Manager	People, documents, leave and attendance. Sees costs, but not payroll or expense claims.
Payroll Admin	Payroll, WPS, end of service and expense claims. Sees people and documents, with salaries and bank details.
Finance	Costs and budgets, files and approves expense claims, sees payroll.
PRO / Documents Officer	Documents and renewals, with government and document fees only.
Fleet Manager	Vehicles, assets and handovers, with vehicle costs only.
Line Manager	Sees their own team and approves the team's requests and leave.
Employee	Self-service: their own profile, documents, requests and payslips.
Auditor	Read-only access to everything except payroll and billing, including the audit log.

Settings › Roles & permissions

Roles & permissions lists the custom role Site Supervisor first, then each built-in role with its description and the number of members who have it. Every role except Owner has a Clone button.

Make your own role. Built-in roles stay as they are for everyone except the Owner. To make a role that fits your company, copy one that is close:

Click Clone next to the role that is closest to what you need.
Give the new role a name in English and Arabic, then click Clone.
On the role page, set each permission. Most can be No access or All records; some can also be Team (the member's own team) or Self (only their own records).
Permissions marked Sensitive show passport and Emirates ID numbers, salaries or bank details. Give them only to people who need them.
Click Save changes.

A custom role, Site Supervisor, cloned from Line Manager: its name fields, the Payroll access choice and the list of permissions.

Payroll access sets all payroll permissions at once: None, View (payroll for all records, with salaries and bank details) or Full (also prepare, manage and approve payroll).
The Owner can also change the built-in roles (except Owner itself). Others see Built-in roles are read-only. Clone this role to customise it.
You can only give a role the permissions you have yourself. For example, an Admin can't make a role that runs payroll.
A custom role can be deleted only when no member or pending invitation uses it. Move those people to another role, or revoke the invitation, first.
The Owner and Admins can make and change roles. So can anyone whose custom role has been given permission to manage roles.

For HR and administrators

5. Members: invite people and manage their access

Members are the people who can sign in to the workspace: your HR, payroll and admin team, and employees who use self-service. Being on People does not give someone a login; inviting them does.

Settings › Members › Invite member

Click Invite member.
Type their Email address and choose the Role.
Choose the Email language for the invitation.
If they should only see part of the workspace, use Access scope to limit them to some Companies, Departments or Record categories. Leave it empty for full access within the role.
Click Send invitation.

The Invite a member window with an email address, the role HR Manager, the email language and the access scope choices.

They get an email with a link. The link works for 7 days. They create a Moazaf account (or sign in, if they have one) and click Accept invitation.

The Members list with the owner, and below it Pending invitations with the invited HR Manager, who invited them and when the invitation expires.

Under Pending invitations, use the ⋯ menu to Resend the email, Copy link to send it another way, or Revoke it.
On a member's row, the ⋯ menu has Edit (change role or access), Suspend (they can't open the workspace until you Reactivate them) and Remove (they lose access at once; their past activity stays in the audit log).
2FA on next to a name means that person uses two-step sign-in. Last active shows when they last used the workspace.
If your plan has a user limit, the page shows how many users you have and the limit. Some plans have no limit.

You can't change your own role or remove yourself. Only an Owner can make someone Owner or change another Owner, and a workspace always keeps at least one active Owner.

To give many employees self-service logins at once, use Invite to app on the People list instead (see the People guide).

6. Two-step sign-in: authenticator app, backup codes and passkeys

Two-step sign-in (2FA) means a stolen password is not enough to get into your account: you also need your phone. We recommend it for Owners, Admins and anyone who works with payroll or bank details. Each person turns it on for their own login, and it then applies to every workspace they belong to.

Your name (top corner) › Account & security

Install an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator.
On Account & security, under Two-factor authentication (2FA), click Enable 2FA.
Type your password and click Continue.
Scan the QR code with the authenticator app. If you can't scan it, type the key shown under the code into the app.
Save the 10 Backup codes somewhere safe (Copy codes copies them). Each code works once, if you lose your phone.
Type the 6-digit code from the app into Authentication code and click Verify and enable. You see Two-factor authentication is on.

The two-factor card during set-up: the QR code, the key to type by hand, the box for the 6-digit code and the list of backup codes.

Account & security with two-factor authentication shown as Enabled, and the Passkeys card below it.

If the card says Two-factor sign-in is turned off for Moazaf right now. You can still set it up; it will be used when it's turned on., your set-up is saved. Moazaf starts asking for the code once two-step sign-in is switched on for everyone.

Signing in after that. After your email and password, Moazaf asks for the 6-digit code from the app. Tick Trust this device for 30 days on your own computer so it asks less often. No phone? Click Use a backup code instead and type one of your backup codes.

The sign-in screen asking for the 6-digit authentication code, with the Trust this device for 30 days box highlighted.

Passkeys. A passkey lets you sign in with your face, fingerprint or device PIN instead of a password, and it also counts as two-step sign-in. Under Passkeys, click Add passkey, give it a name such as Work laptop, then follow your device. Next time, click Sign in with passkey on the sign-in page.

A passkey can only be added within 10 minutes of signing in. If you see a message about it, sign out and in again.
The Moazaf mobile app can't use passkeys yet. If you use the app, set up an authenticator app too.
Disable 2FA (with your password) turns off the authenticator app only. Your account stays protected while it has the authenticator app or at least one passkey, so it is fully off only when both are gone.

For HR and administrators

7. Who must use two-step sign-in, and staying signed in

Two-step sign-in is switched on or off for all of Moazaf by the Moazaf team. There is no setting in your workspace to force it on your members. When it is switched on:

Anyone who has set it up is asked for their code at sign-in.
If the Moazaf team has also switched the reminder on (for all of Moazaf or for your workspace), Owners, Admins, Payroll Admins, Finance, and anyone whose role can manage members, roles, settings, billing, the API or payroll, see a reminder at the top of the screen until they set it up: We recommend turning on two-factor authentication to protect payroll, bank details, users and billing. They can click Set up or Hide for now. It never blocks their work.
People from service provider firms (for example a PRO agency working in your workspace) must use two-step sign-in, unless the Moazaf team has turned that rule off. It is on by default.

If you want the reminder switched on or off for your whole workspace, email support@moazaf.com from the Owner's address. To check who already uses it, look for 2FA on on Settings › Members.

Staying signed in. Moazaf keeps you signed in on a device for up to 30 days. To end your other sessions (for example on a shared or lost computer), open Account & security and click Sign out of other devices under Password. Changing your password with Change password also signs out every other device.

When you suspend or remove a member, they lose access to the workspace at once, even if they are still signed in.

For HR and administrators

8. The audit log: who changed what, and when

The audit log keeps a record of every change to business records: companies, people, documents, members, roles, settings and more. Each line shows when it happened, who did it, what they did and on which record. Nobody can edit or delete these lines.

Settings › Audit log

Search by action, record or person, or narrow the list with Record type, From and To.
Choose Service provider activity under Activity to see only what outside service providers did.
Click the arrow at the end of a line to see the Details: each changed Field with its value Before and After.

The Audit log list with one change opened, showing the fields that changed with their old and new values.

The Owner, Admins and Auditors can open the audit log. Sign-ins are not listed here.

9. Common questions

I lost my phone and can't sign in.
Answer
On the code screen click Use a backup code instead and type one of your backup codes. Then, on Account & security, click Disable 2FA and Enable 2FA again to link your new phone and get new codes. If you have no backup codes left, email support@moazaf.com: after checking it is you, they can reset your two-step sign-in.
Someone left the company. What should I do?
Answer
On Settings › Members, open the ⋯ menu on their row and choose Remove (or Suspend if they may come back). They lose access at once. Their past changes stay in the audit log.
Can an HR Manager see salaries?
Answer
Not with the built-in HR Manager role. Salaries and bank details are for the Owner, Admin and Payroll Admin. If your HR Manager needs them, the Owner or an Admin can clone the role and give it both See salaries and See bank details (IBAN). Salaries then show on the employee's Payroll tab.
Why can't I see some pages in Settings?
Answer
The menu only shows what your role allows. Ask your workspace Owner or an Admin to change your role.
Can I limit a member to one company?
Answer
Yes. On Members, open Edit on their row and choose the company under Access scope › Companies. They then see only that company's records. Owners always have full access.
An invitation expired or got lost.
Answer
If it was lost, find it under Pending invitations and click Resend, or Copy link and send it yourself. An expired invitation leaves that list and can't be resent: click Invite member and send a new one. Invitations work for 7 days.
Is my two-step sign-in the same in every workspace?
Answer
Yes. It belongs to your login, not to a workspace, so it protects every workspace you are a member of.

Question	Answer
I lost my phone and can't sign in.	On the code screen click Use a backup code instead and type one of your backup codes. Then, on Account & security, click Disable 2FA and Enable 2FA again to link your new phone and get new codes. If you have no backup codes left, email support@moazaf.com: after checking it is you, they can reset your two-step sign-in.
Someone left the company. What should I do?	On Settings › Members, open the ⋯ menu on their row and choose Remove (or Suspend if they may come back). They lose access at once. Their past changes stay in the audit log.
Can an HR Manager see salaries?	Not with the built-in HR Manager role. Salaries and bank details are for the Owner, Admin and Payroll Admin. If your HR Manager needs them, the Owner or an Admin can clone the role and give it both See salaries and See bank details (IBAN). Salaries then show on the employee's Payroll tab.
Why can't I see some pages in Settings?	The menu only shows what your role allows. Ask your workspace Owner or an Admin to change your role.
Can I limit a member to one company?	Yes. On Members, open Edit on their row and choose the company under Access scope › Companies. They then see only that company's records. Owners always have full access.
An invitation expired or got lost.	If it was lost, find it under Pending invitations and click Resend, or Copy link and send it yourself. An expired invitation leaves that list and can't be resent: click Invite member and send a new one. Invitations work for 7 days.
Is my two-step sign-in the same in every workspace?	Yes. It belongs to your login, not to a workspace, so it protects every workspace you are a member of.

Still need help?

Email our support team. Tell us your company name and what you were trying to do.

support@moazaf.com