Manage UniFi Access users and schedules

Goal and requirements

Give one employee access to one entrance during their authorised hours, then demonstrate denial outside that policy. This tutorial assumes the Access console, hubs, readers, locks and exit arrangements are already installed and commissioned. It covers software administration without changing physical wiring, emergency behaviour or lock hardware.

Use an administrator account, a compatible NFC credential and a designated test person. Confirm that the existing doors work normally. Keep an authorised person available at the site during the test and retain the established entry and exit methods. The example uses a standalone site without UniFi Fabric people management; centrally managed Fabric sites require their corresponding user-management workflow. [1]

Define the intended permission

Our fictional employee, Alex Chen, needs the Staff Entrance from 07:30 to 18:00, Monday to Friday. Alex does not need the stockroom or access on weekends. Use your own authorised person and doors, and check the site's timezone before entering schedules.

Access permission and an automatic door-unlock schedule have different effects. A user access schedule controls when a credential may be accepted. A door-unlock schedule can leave a door open to people without individual authentication. This exercise uses a user policy and does not alter the automatic unlock schedule. [2]

Add the user and policy

  1. Create the person. Open Site Manager › People › Create New › Create New User. Enter the person's correct name and email, then create the user. Open Access and confirm the person appears in People. Keep ordinary door access separate from administrative privileges; this employee does not need permission to configure the installation. [1]
  2. Inspect inherited access. Open the person's existing policies before adding another. Check whether the site's default policy already grants broad or always-allowed access. Ubiquiti combines allowed periods from multiple policies, so a narrow new schedule does not cancel a broader existing permission. Remove unintended assignments through the approved administration workflow before testing. [3]
  3. Create the schedule. In Access › Settings › Policies & Schedules › Predefined Schedules, choose Create New. Name it Staff Weekdays and enter Monday through Friday, 07:30 to 18:00. Review the displayed days and hours before saving. Configure applicable holiday exceptions deliberately rather than assuming the weekly pattern handles them. [3]
  4. Create the access policy. Open Policies & Schedules › Policies › Create New. Name it Staff Entrance Weekdays, select only Staff Entrance, select the intended person or authorised group, and choose Staff Weekdays. Save and reopen the policy to verify the location, people and schedule. Do not set this policy as the default for all future users unless that is an explicit site decision. [3]

Register and assign a credential

  1. Register an NFC card. In Access › Settings › Card Inventory › Add New › Add NFC Card, choose the reader that will enrol it and continue. Present the card as prompted; Ubiquiti's reader workflow specifies holding it to the reader for five seconds. Give the credential a useful inventory label and confirm it is the card physically in your hand. [4]
  2. Assign it to the person. Go to People › select the user › Settings › Credentials › NFC Card. Add an existing card and assign the newly enrolled credential. Check the resulting owner. Avoid assigning a card already issued to someone else. The inventory record should connect the physical card, named person and issue date. [4]
  3. Check the reader method. Open Devices › select the reader › Settings and confirm NFC is enabled. Keep the site's existing two-step authentication requirements where configured. Supported methods depend on the reader and hub; a PIN, face or phone method available on one model may be absent on another. [5]

Verify both allowed and denied use

  1. Test permitted entry. During the authorised period, present the new card at Staff Entrance. Check the physical result and the corresponding access event in the application. Confirm the displayed person, location and time. Wait for configuration synchronisation before treating a newly saved permission as deployed.
  2. Test a denial deliberately. Try a door outside the policy, with the site's authorised supervisor present. Test outside-hours behaviour using an approved temporary test schedule, then restore Staff Weekdays and recheck it. Use the test user's credential rather than an administrator credential that may have additional permissions. Confirm the actual denial in the event history.
  3. Practise offboarding. With the test user's consent and a known recovery method available, remove the credential or the relevant user access assignments. Confirm that the card no longer grants entry, then restore only the authorised production configuration. Record what was revoked and when.

Troubleshooting and recovery

For unexpected denial, check credential ownership, reader method, door selection, timezone, schedule and device connectivity. For unexpected access, inspect every assigned policy and any automatic door-unlock schedule. A permitted time in another policy can explain the result.

Credentials must reach the hub before new permissions can operate there. Ubiquiti documents locally stored credentials and limitations on applying new credentials while a hub is disconnected. Verify synchronisation instead of repeatedly creating duplicate users or cards. [6]

Restore the saved user assignments and schedule if the exercise affects normal operation. Finish with a short handover recording the person, credential label, permitted doors, schedule, revocation procedure and date of the successful allow-and-deny tests.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.