Manage your profile
This page shows your user information and (if your user role has the relevant permissions)
your company details and your subscription. You can change your own information and
company details, and buy a subscription.
You can also watch the tutorial
You can change your personal profile and preferences:
- Name - change your name. Please note that you can't change your own email
address, as this can only be done in Manage - Users.
- Mobile phone - your mobile phone number, including your country code. Phone
numbers must be between 9 and 16 digits. This is also used for system notifications by SMS.
- Dates, numbers, and periods - select how you want dates, numbers, and
periods to be visually displayed in reports and models (watch the tutorial video).
- Theme - select between the standard color scheme, the light color scheme,
or the masked theme. The masked theme will mask (hide) all amounts in reports, models,
charts, and data sets. This special theme is suitable for demonstration and training
sessions, so you can show the application without displaying any amounts.
- Email me on imports - select if you want to be emailed when selected
data sets have newly imported data within the past 24 hours.
- Show tips - select if you want to see tooltips, hints, suggestions, or the
guided tour whilst you navigate through XLReporting. Tooltips are small ⓘ icons that
show extra information when you hover over them.
If your user role has Edit tenant permission, you can also change the company
details of your tenant:
- Company name and address - enter or edit your company address details.
- Currency - set the default currency. You can deviate from this in reports.
- Your logo - enter the URL to an image file. This image will be displayed as
the logo. You can copy the address of a web-based image file by right-clicking on the
relevant webpage in your web browser and selecting "Copy image address".
- Color - you can assign a default color for the page header. Optionally, you
can define a different color for each group of items. This makes user navigation more
- Security options - select optional security options for your tenant. Please
read the next paragraph for detailed explanations.
- Global settings - define optional global settings that you can lookup in
any import, report, or model using the SETTING() function.
- Script - create a script to define custom functions which you can use in
any expression across all your objects. This option is for advanced use, and only visible if
your user role has Edit script permission. Read more
If your user role has Edit tenant permission, you can also change the security
options for your account:
- Enforce MFA login - Multi-Factor-Authentication (MFA) creates an extra
level of security when logging into XLReporting. In addition to email and password, users
will be prompted to enter a code that is displayed on their mobile device. They can use any
(OTP-based) mobile app such as Google Authenticator, Microsoft Authenticator, Twilio Authy,
LastPass etc. By default, each user can decide whether or not to activate MFA. If you
enable this setting, all users will be forced to activate MFA.
- Enforce same domain - when enabled, this will require the email address
of new users to be in the same domain(s) that are already currently in use. For example, if
your current users have "@mycompany.nl" and "@mycompany.com" email addresses, all new users
have to be in either of those 2 domains. Whenever you want to add a domain, you can
temporarily disable this setting, create a new user with the new domain, and then
enable this setting again.
- Enforce Single Sign-On - in addition to logging in with username and
password, users can also login via an external Single Sign-On system (see
Single Sign-On). Both routes can co-exist. If you want single
sign-on to be the only permitted route, then you can enable this option.
Features such as password resets will no longer be
- Disable external dashboards - by default, dashboards can be published to
external people who are not registered users within XLReporting (read more). If you don't want your users to be able to
do this, you can disable that feature here for your entire tenant.
- Disable scripts - by default, scripts can be created when defining
objects. Scripts are small pieces of program code that can perform automated and repetitive
tasks, but they carry a limited risk. If you don't want your users to be able to do this,
you can disable that feature here for your entire account.
You can also watch the tutorial
Global settings enable you to define settings, either just by name or as a
"name=value". You can lookup these settings with the SETTING() function in your imports,
reports, and models. This function returns true or false if the given setting exists in the
tenant, or its value if you used "name=value". See the SETTING
function for more details.
Please note that global settings are case-sensitive. It is best to avoid using spaces.
This section is only visible if your user role has Edit settings
permission, and deals with your contractual agreement with us and your right to use our
- Your current subscription - this shows your current subscription plan and
how much data you are currently using. We apply a "Fair Use" policy, but if you are
structurally exceeding your subscription storage, you need to upgrade your subscription
plan. Please contact us for any questions you may have.
- Accept our Service Agreement - we kindly ask you to read our Service
Agreement, and tick this box to indicate that you accept it. The agreement outlines
important things about our obligations as Provider, your rights as Customer, and the
measures we take to protect your data.
Please note that you must accept the
agreement before you can fully use your subscription.
here to read the agreement in full.
- Close your account - we surely hope you'll never need this option, but if
you must, then here it is. Your account will be closed immediately, and your data will be
automatically deleted after 5 days. If you regret your decision, please contact
us within 5 days.
- Your subscription - click on any of the product boxes to upgrade (or
downgrade) your subscription plan. You'll be taken through a payment process with our
partner Stripe Inc to process your payment. You can opt for monthly or annual subscriptions.
Single Sign-On (SSO)
XLReporting has its own user management based on username and password, with optional "Multi
Factor Authentication" (MFA).
We also support "Single Sign-On" (SSO) which delegates
the user authentication and login to an external identity provider that supports the OpenID
Connect protocol. This gives you a single and unified management of all your users. You can
connect with the following providers:
- Auth0 - a flexible solution
for authentication and authorization of users.
- Okta - a secure identity cloud that links
all your apps, logins and devices into unified user management.
- WorkOS - a single integration that
enables your application to support SSO for the most popular identity providers.
AD - an enterprise identity
service provides single sign-on, multifactor authentication, and conditional access.
- SecureLogin - a single sign-on
solution for accounting firms and their clients.
- Any OpenID Connect provider - XLReporting
uses the leading oAuth2 OpenID protocol, which is used by most identity providers.
Please contact us for details on SSO configuration, as we will need to coordinate this with your
own IT team.
You can use the Save and Actions buttons in
the right-top of the screen:
These buttons enable you to do the following:
- Save - save your changes (or Ctrl+S)
- Actions - open a dropdown menu with further options:
- Change my password - passwords must be at least 8 characters using lowercase,
uppercase, and numbers. Passwords automatically expire after 180 days.
- Change my MFA login - when activated, this creates an extra level of security when
logging into XLReporting. In addition to email and password, you will be prompted to
enter a code that is displayed on your mobile device. You can use (OTP-based) mobile
app such as Google Authenticator, Microsoft Authenticator, Twilio Authy, LastPass
etc. If you have problems logging in with Multi-Factor-Authentication (MFA), or if
have lost your MFA device, you can contact us. We can reset
your MFA only after approval from your company's administrator.
- Change my API access - when activated, you can retrieve data from (and import data
into) data sets through the XLReporting API. For example, you can send data directly
from another system or database into XLReporting without having to go through the
web pages. Or you can retrieve data from XLReporting directly into another system.
You need to provide an API token with all requests. API tokens are valid for 360
days, and you can revoke or renew them at any point in time.
- Transfer objects - this option is only visible if your user role has Transfer
objects permission, and enables you to export the configuration of your
objects to a file, for (re)import at any later point in time, or import into another
- Refresh sandbox - this option is only visible if your user role has Define
account permission AND you are logged into a Sandbox
tenant (which is a separate copy of your live tenant). This option enables
you to refresh all configuration and data in your sandbox tenant based on your live
- Manage my clients - this option is only visible if you are a XLReporting partner
and your user role has Manage clients permission. It enables you to
view your client tenants, and to manage (review, create and update) your defined
objects, user roles, and users into your clients. See Manage
clients for more detail.
- Review my tenant - this option is only visible if your user role has Define
account permission, and shows your tenant configuration and recent
- Review my activity - this option shows your own recent activity.
- Switch tenant - this option is only visible if you have access to more than one
tenant, and it enables you to switch between those tenants without having to login
- All above actions and settings in your profile are specific for each tenant that you
have access to, with exception of your password and MFA login. These apply to you across
all tenants that you can access.
- Passwords are set to automatically expire after 180 days. You can renew your password
anytime you wish.
You can activate Multi-Factor-Authentication (MFA) and a API access token using the
- We do not provide fallback codes for MFA. If you have problems logging in with
Multi-Factor-Authentication (MFA), or if you have lost your MFA device, you can contact us. We can reset your MFA only after
approval from your company's administrator.
- Be careful and cautious when you enable API access. Only enable this when you are
actually using API calls and always use the "principle of least privilege".
- API tokens have a validity of 360 days, or until such time that you revoke or renew them
or the API permissions of your user account are revoked.
- If you use automated connections using an API token, make sure that the emails are
being read because you will be notified timely when a token is due to expire.