> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Manage users and groups

> Create and manage user accounts and group memberships in Cloud Hub.

User and group management controls access and permissions in Itential Cloud. Use these tools to configure security settings and manage identity for your organization.

## Users

To view and manage users, select **Administration → Users** from the sidebar.

![](/_fern-img/f09bb415e1806ca29380c4556326d31a6c1743ff9afbc3532a03eb80b99ba770.webp)

The users table shows all user accounts in your Itential Cloud account. Each user belongs to an identity provider, which handles authentication. All Itential Cloud accounts include a built-in identity provider called **Local**. If you have SSO configured, additional identity providers appear in the list.

The users table includes the following columns:

* **Source**: The identity provider that manages the user. **Local** indicates the built-in identity provider.
* **Verified**: Applies only to Local identity provider users.
  * **Unverified**: The user received an invitation but hasn't signed in yet.
  * **Verified**: The user has signed in at least once and verified their identity.
  *

### Add a new user

You can only add new users to a **Local** source. If you are using SSO, manage users through your identity provider.

#### Open New User

Click **+ New User**.

#### Enter user details

Enter the user's first name, last name, and email address.

#### Save

Click **Add** to create the user, or **Cancel** to back out.

### Edit user account settings

#### Locate the user

Find the desired user account in the **Users** table.

#### Open the user record

Click the user's row, or select **Edit** from the **More (⋮)** menu.

#### Make changes

From the user's account details page, toggle group memberships or select **Edit** from the **More (⋮)** menu to update user details.

#### Save

Click **Save**.

### Reset a user's password

#### Open the reset option

Select **Reset Password** from the **More (⋮)** menu on either the user list page or the user details page.

An email containing a password reset link is sent to the address associated with the account.

Password reset for accounts managed by an SSO identity provider must be done through the identity provider.

### Remove a user

The impact of removing a user depends on their identity provider:

* **Local provider**: The user is permanently deleted from your Cloud Hub account and cannot log in.
* **SSO provider**: The user is removed from your account but still exists in your SSO provider. If you do not configure rules to block them, they can access their account again the next time they log in via SSO.

#### Remove the user

Select **Remove User** from the **More (⋮)** menu on either the user list page or the user details page.

## Groups

Permissions are granted to user accounts and service accounts via membership in **groups**. A group contains a collection of **roles**, where each role corresponds to a permission. A user or service account that belongs to a group inherits all permissions granted by the roles assigned to that group.

To view and manage groups, select **Administration → Groups** from the sidebar.

![](/_fern-img/2127ca58c33d5ee9f84e070217108ec088f7705a2e21db3ca107d9bad79b1b56.webp)

### Default groups

Every Itential Cloud account includes two built-in groups:

| Group      | Description                                                                                                              |
| ---------- | ------------------------------------------------------------------------------------------------------------------------ |
| **admins** | Configured with all possible roles by default. Assign users to this group carefully, as they will have full permissions. |
| **users**  | Configured with read-only roles by default.                                                                              |

You can modify or delete these built-in groups to suit your organization's security needs.

### Create a new group

#### Open New Group

Click **+ New Group** on the Groups page.

#### Name the group

Enter a name and an optional description.

#### Create

Click **Create**, or **Cancel** to back out.

Newly created groups have no users, service accounts, or roles assigned.

### Assign users to a group

#### Open the group

Locate the desired group and click its row, or select **Edit** from the **More (⋮)** menu.

#### Select members

In the **Group Settings** window, click the **Members** tab and select the checkboxes of the desired user accounts.

#### Save

Click **Save**, or click the **Groups** breadcrumb to back out without saving.

Associating service accounts with groups is done through [service account](./service-accounts) configuration.

### Assign roles to a group

#### Open the group

Locate the desired group and click its row, or select **Edit** from the **More (⋮)** menu.

#### Select roles

In the **Group Settings** window, click the **Roles** tab. By default, all roles available across your Itential Cloud account are displayed. To show only roles for a specific application, select the application from the dropdown.
Select the checkboxes of the desired roles.

#### Save

Click **Save**, or click the **Groups** breadcrumb to back out without saving.

### Delete a group

#### Delete the group

Locate the desired group and click its row, or select **Delete Group** from the **More (⋮)** menu.

Deleting a group is permanent and cannot be undone.

## Common tasks quick reference

| Task                                     | How                                                                                                                             |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Add a new team member                    | **Administration** → **Users** → **New User** → Enter details → **Add**                                                         |
| Grant access to a production environment | Find user → Add to `production` group → **Save**                                                                                |
| Temporarily suspend access               | **Administration** → **Users** → Select user row → **More (⋮)** → **Disable User**                                              |
| Remove an inactive user                  | **Administration** → **Users** → **More (⋮)** → **Remove User**                                                                 |
| Create an access template                | **Administration** → **Groups** → **New Group** → Enter details → **Save** → Select group → Assign members and roles → **Save** |
| Bulk assign permissions                  | **Administration** → **Users** → Select user → Toggle groups → **Save**                                                         |