# Certificates and Staff

## What is it for?

The **Staff and certificate status** card lists the staff on this device one by one and shows each person's setup status. You close a departing employee's access here with the **Revoke** button.

## When do you use it?

- When an employee leaves or loses their phone.
- When you want to see who has run the setup and who has not.
- To keep track of certificates that are about to expire (a look once a month is enough).

## Before you start

- If the list is empty it says "No staff records on this device. Nobody can run the setup until staff are added." Add staff first: [Useroam Connector](/books/staff-wi-fi-administration/page/useroam-connector) for Active Directory, otherwise [New User](/books/guests/page/new-user) (type **Staff WiFi (certificate)**). ![Empty staff list warning](https://help.useroam.com/uploads/images/gallery/2026-09/pw-bos-en.png)

## Step by step: closing an employee's access

1. Open **Staff WiFi** in the left menu and scroll to the **Staff and certificate status** card at the bottom. The number next to the title is the total number of staff on the device. ![Staff and certificate status list, Status column badges](https://help.useroam.com/uploads/images/gallery/2026-09/pw-liste-en.png)
2. To find the employee, type part of the name in the **Staff name** box at the top right and press **Search**. ![Staff name search box and result](https://help.useroam.com/uploads/images/gallery/2026-09/pw-ara-en.png)
3. Press **Revoke** at the end of the row. The browser asks "Revoke this certificate? The device will not be able to connect again and the staff member must run the setup once more."; press **OK** (or **Cancel** to go back). ![Revoke button](https://help.useroam.com/uploads/images/gallery/2026-09/pw-iptal-en.png)
4. A green **Certificate revoked.** message appears at the top and the row shows the **Revoked** badge. ![Certificate revoked message](https://help.useroam.com/uploads/images/gallery/2026-09/pw-iptal-ok-en.png)
5. If the employee has left for good, close their account too: delete or disable it in [Local Users](/books/guests/page/local-users). If you use Active Directory, disable the account in the directory. ![Local Users list and row buttons](https://help.useroam.com/uploads/images/gallery/2026-09/mz-lu-liste-en.png)

## Status badges

<table id="bkmrk-badgewhat-it-meanswh"><thead><tr><th>Badge</th><th>What it means</th><th>What to do</th></tr></thead><tbody><tr><td>**Set up** (green)</td><td>Has a valid certificate; the device can join the network.</td><td>Nothing.</td></tr><tr><td>**Not set up yet** (grey)</td><td>Has a staff record but has not run the setup.</td><td>Send the setup link.</td></tr><tr><td>**Not permitted** (white)</td><td>The local user was created as **Hotspot user**. This person **cannot** get a certificate even with the link.</td><td>If they need one, create them with the type **Staff WiFi (certificate)**.</td></tr><tr><td>**Expires soon (26 days)** (yellow)</td><td>Less than 60 days left; the brackets show the days remaining.</td><td>Ask the employee to run the setup again. The new certificate replaces the old one.</td></tr><tr><td>**Expired** (red)</td><td>The certificate is no longer valid; the device cannot join.</td><td>Ask the employee to run the setup again.</td></tr><tr><td>**Revoked** (black)</td><td>The certificate has been revoked.</td><td>If the employee comes back, they run the setup again.</td></tr></tbody></table>

Certificates are valid for **825 days** and **do not renew themselves**. Staff who set up in the same period expire on the same days; do not wait when you see yellow badges.

## Every field and button on the screen

<table id="bkmrk-field-%2F-buttonwhat-i"><thead><tr><th>Field / Button</th><th>What it does</th></tr></thead><tbody><tr><td>**Staff name** box and **Search**</td><td>Searches usernames. With no result it says "No staff member matches your search." ![No staff member matches your search](https://help.useroam.com/uploads/images/gallery/2026-09/pw-bulunamadi-en.png)

</td></tr><tr><td>**Staff member**</td><td>Company username. A short name (`ahmet`) and a full name (`ahmet@firma.local`) count as the same person.</td></tr><tr><td>**Status**</td><td>One of the badges above. If the person has several certificates, the newest one decides.</td></tr><tr><td>**Issued**</td><td>When the newest certificate was issued. A dash if there is none.</td></tr><tr><td>**Action** / **Revoke**</td><td>Shown for valid or expired certificates; not shown for revoked ones.</td></tr><tr><td>"Showing %d of %d staff. Use the search box."</td><td>The list shows at most 100 people at a time. Example: "Showing 100 of 240 staff." Use the search box for the person you need.</td></tr><tr><td>Note at the bottom of the card</td><td>"Revocation takes effect at the next network authentication of the device. A device that is already connected may stay connected until its session ends."</td></tr></tbody></table>

## Certificates with no matching staff record

Below the list you may see a folding section called **Certificates with no matching staff record (1)**. When opened it shows the note "These were issued before the staff list check was added. Revoke them if they are not in use." and a table with **User** (with the start of the serial number below), **Issued**, **Status** (**Valid** or **Revoked**) and **Action**.

![Certificates with no matching staff record](https://help.useroam.com/uploads/images/gallery/2026-09/pw-oksuz-en.png)

The owners of these certificates are not in the staff list. **Revoke them if they are not in use:** a valid certificate with no known owner is a device that can join the network but cannot be tracked in the list.

## Frequently asked questions

**I revoked it but the employee is still connected.**  
Revocation takes effect at the device's next network authentication. A device connected right now can stay connected until its session ends. If you must cut it off immediately, drop the device on the firewall side as well.

**The same person set up with both a short name and a full name.**  
Revoke closes **all** valid certificates of that person on this device together.

**Does revoking delete the staff record?**  
No. The person stays in the list with the **Revoked** badge. To delete the record, use [Local Users](/books/guests/page/local-users).

**Should I revoke the old certificate of an employee who changed phone?**  
No need. When the new setup is done, the same person's older certificates are revoked automatically.

## Related pages

- [Inviting Staff](/books/staff-wi-fi-administration/page/inviting-staff)
- [Guests &gt; Local Users](/books/guests/page/local-users)
- [Analytics and Reports &gt; 5651 Logs](/books/analytics-and-reports/page/5651-logs)
Badge	What it means	What to do
Set up (green)	Has a valid certificate; the device can join the network.	Nothing.
Not set up yet (grey)	Has a staff record but has not run the setup.	Send the setup link.
Not permitted (white)	The local user was created as Hotspot user. This person cannot get a certificate even with the link.	If they need one, create them with the type Staff WiFi (certificate).
Expires soon (26 days) (yellow)	Less than 60 days left; the brackets show the days remaining.	Ask the employee to run the setup again. The new certificate replaces the old one.
Expired (red)	The certificate is no longer valid; the device cannot join.	Ask the employee to run the setup again.
Revoked (black)	The certificate has been revoked.	If the employee comes back, they run the setup again.
Field / Button	What it does
Staff name box and Search	Searches usernames. With no result it says "No staff member matches your search." ![No staff member matches your search](https://help.useroam.com/uploads/images/gallery/2026-09/pw-bulunamadi-en.png)
Staff member	Company username. A short name (`ahmet`) and a full name (`ahmet@firma.local`) count as the same person.
Status	One of the badges above. If the person has several certificates, the newest one decides.
Issued	When the newest certificate was issued. A dash if there is none.
Action / Revoke	Shown for valid or expired certificates; not shown for revoked ones.
"Showing %d of %d staff. Use the search box."	The list shows at most 100 people at a time. Example: "Showing 100 of 240 staff." Use the search box for the person you need.
Note at the bottom of the card	"Revocation takes effect at the next network authentication of the device. A device that is already connected may stay connected until its session ends."