Sign in with an account that holds the admin entitlement.
admin
Off means invite-only: the button disappears and the register route refuses. It never affects sign-in — people already invited keep working.
No password is set here — you get a single-use link that lets them choose their own. Nobody, including you, ever holds their password.
Sets the entitlement and the plan on every device they own — those are read in two different places, and setting only one leaves paid features with a free history window.
Suspending signs them out everywhere and stops their agents reporting. Nothing is deleted and it reverses in one click. The reset link is single-use — the console cannot set a password directly, because an operator who could set passwords could sign in as any customer indistinguishably from a real login.