Webvault Secure Access VPN - Inviting a User to Enroll their Device

This article explains how an authorised VPN manager can use the Webvault Secure Access portal to issue an invitation for a new or additional device, and manage outstanding device invitations.

Secure Access uses provides users with VPN access only to the networks and services approved for an organisation using a NetBird client on Windows, Linux, MacOS, iPhone or Android devices.

Before you begin

You will need:

• Access to the Secure Access Portal.
• VPN manager permissions for the relevant organisation.
• The user's correct name and email address.

Sign in at: Secure Access Portal

A device invitation normally remains valid for 72 hours and authorises the enrolment of one device.

The invitation is sent by Secure Access Portal from secureaccess@vmnetwork.com.au.

Invite a new VPN user

1. Sign in to the Secure Access Portal.
2. Open VPN users.
3. Select Invite VPN user.
4. Select the correct VPN organisation.
5. Enter the person's name and email address carefully.
6. Select Send device invitation.

The email address becomes the person's unique VPN identity within that organisation.

A manager-issued invitation pre-authorises one device. The user does not normally require a second manual device approval after completing enrolment.

Invite another device for an existing VPN user

If an existing VPN user needs Secure Access on another computer or mobile device:

1. Open VPN users.
2. Find the existing VPN user.
3. Open their VPN user record.
4. Select Invite another device.

The user's existing devices remain active.

Only one unused device invitation can be active for the same VPN user at a time.

Manage an outstanding invitation

Open the user's record under VPN users to review their current invitation and device enrolment state.

Resend an invitation

Select Resend invitation if the user did not receive the original email.

An invitation can be sent no more than three times.

Resending does not create another device invitation. It sends the existing invitation to the user's registered email address again.

Revoke an invitation

Select Revoke invitation if the invitation should no longer be usable.

Revocation immediately invalidates the unused invitation.

Use this if:

• The invitation was sent to the wrong person.
• The wrong email address was entered.
• The device should no longer be authorised.
• You believe the invitation link may have been disclosed.

Do not ask the user to send you their invitation link.

Expired, revoked or used invitations

An invitation cannot be reused after it has:

• Expired.
• Been revoked.
• Successfully been used to enrol a device.

Issue a new device invitation if another device needs to be enrolled.

What the VPN user receives

The user receives an email with the subject:

Your remote-access device invitation

The email identifies:

• The VPN manager or administrator who sent the invitation.
• Their organisation.
• The VPN organisation the user is being invited to join.

The user selects Register my device and is taken to the Secure Access Portal.

They will then identify their device and receive the appropriate enrolment process for Windows, Linux, macOS, iPhone or iPad.

Android guided enrolment is not currently enabled.

The user should complete the process using the separate knowledge base article:

Enrol your device in Secure Access

Invitation security

A Secure Access device invitation is a bearer credential for one device.

VPN managers should never ask users to forward or copy the complete invitation link into an email, support ticket or chat.

Secure Access will never require a user to send you their:

• Password.
• Authenticator or MFA code.
• Private key.
• Setup key.
• Enrolment code.
• WireGuard key.

If an invitation may have been exposed, revoke it and issue a new invitation.

Troubleshooting

The user did not receive the invitation

Confirm that the email address on the VPN user record is correct.

If it is correct, use Resend invitation.

The user should also check their junk or spam folder for an email from:

secureaccess@vmnetwork.com.au

The invitation has expired

A normal email device invitation remains valid for 72 hours.

If it has expired, issue a new device invitation.

The user says the invitation is invalid

Open the VPN user record and check its current state.

The invitation may have:

• Expired.
• Been revoked.
• Already been completed.
• Been superseded by another invitation.

Do not ask the user to send the old invitation URL to you.

The user needs another device

Do not alter or remove their existing device simply to enrol another one.

Open their VPN user record and select Invite another device.

The wrong person or email address was invited

Revoke the outstanding invitation immediately.

Create the correct VPN user or invitation using the intended email address.

The device was submitted with incorrect information

Review the submitted device and its enrolment state from the VPN user's record.

If enrolment cannot safely continue, revoke or replace the invitation as appropriate rather than instructing the user to use installation instructions intended for another operating system.