> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings → Users

> Manage the people who log into Protect — invite, edit, deactivate, manage SSO/MFA

## What this page is

[Settings → User Management → Users](/settings/users) at `/settings/users` lists every **platform user** — people who log into Protect itself. Not to be confused with [User Inventory](/user-inventory), which is the end-user list pulled from your identity providers.

<img src="https://mintcdn.com/threatawareltd/IwzdezxNqgZB-5I4/images/core/settings-users.png?fit=max&auto=format&n=IwzdezxNqgZB-5I4&q=85&s=9206f2a34216518ebae9795a2c6163d2" alt="Users page grouped by role — Super Admin (Gavin Watkins, Brandon Taylor, Julian Edwards, Charles Carr, Demo User, Demo Account, Martin Walker) and Analyst (Keith Bruce)" width="1440" height="900" data-path="images/core/settings-users.png" />

## Layout

Users are grouped by their assigned role, with each role section showing:

* Role name + role description
* Per-user cards: avatar, name, email, SSO/MFA state, last login, edit icon

Top-right controls:

* **Search** — filter the list
* **SSO Enabled ▾** — filter dropdown
* **+ Add User** — invite a new user

## Per-user state badges

| Badge                         | Meaning                                                |
| ----------------------------- | ------------------------------------------------------ |
| **SSO Enabled**               | User authenticates via your IdP (Entra ID, Okta, etc.) |
| **MFA Not Enabled**           | Password auth without MFA — a security red flag        |
| **MFA Enabled**               | Password auth with TOTP                                |
| **Never logged in**           | Invited but hasn't completed first sign-in             |
| **Last logged in N days ago** | Recent activity                                        |

## Adding a user

<Steps>
  <Step title="Click + Add User">
    Top-right of the page.
  </Step>

  <Step title="Provide details">
    * **Email** — the user's work email (matched against your IdP for SSO)
    * **Display name** — first / last
    * **Role** — one of the four defaults or a custom role
  </Step>

  <Step title="Enable SSO">
    Tick **Enable Single Sign-On** if the user has a matching IdP account. Protect adds them to the Entra ID / Okta application automatically.
  </Step>

  <Step title="(Optional) team membership">
    Assign to one or more [Teams](/settings/teams).
  </Step>

  <Step title="(Optional) data filters">
    Restrict the user's data view by tag / location / device type. See [Access Control](/access-control#data-level-permissions).
  </Step>

  <Step title="Save">
    User receives an invitation email if SSO is off, or can sign in immediately if SSO matches.
  </Step>
</Steps>

## Editing a user

Click any user card to edit:

* Change role
* Change SSO state
* Update team membership
* Update data filters
* Reset MFA (forces re-enrolment on next login)
* **Deactivate** (suspends without deleting — preserves audit trail)
* **Delete** (permanent; audit trail preserved with anonymised identity)

<Warning>
  **Prefer Deactivate over Delete.** Deactivation preserves the user's role assignments, team memberships, and the ability to reactivate. Delete is permanent.
</Warning>

## SSO and the mail attribute

Protect matches users to your IdP on the **mail** property, *not* UPN. Symptoms of a mismatch:

* User can't sign in even though their Entra ID account exists
* "User not found" on SSO redirect
* SSO Enabled badge but Never Logged In

Fix: populate the `mail` attribute in Entra ID / Okta for that user, then re-save in Protect.

## Bulk operations

For larger user bases:

* **CSV import** — bulk-invite users with role + team mappings
* **Auto-provisioning** — users land in Protect automatically when added to the Entra ID application (contact support to enable; users default to Limited Viewer role)

See [Access Control → Auto-provisioning mode](/access-control#auto-provisioning-mode).

## Offboarding flow

When someone leaves:

<Steps>
  <Step title="In your IdP, disable the user">
    They lose access to the ThreatAware application immediately.
  </Step>

  <Step title="In Protect, Deactivate the user">
    [Settings → Users](/settings/users) → click user → Deactivate. Their tokens revoke; their role assignments stay intact for audit.
  </Step>

  <Step title="(Quarterly) review and delete">
    Use the SSO Enabled ▾ filter and the "Last logged in N days ago" badges to find dormant accounts. Confirm the user has truly left, then Delete.
  </Step>
</Steps>

## Cross-references

<CardGroup cols={3}>
  <Card title="Access Control" icon="users-gear" href="/access-control">
    Conceptual overview
  </Card>

  <Card title="Settings → Roles" icon="shield" href="/settings/roles">
    Define what users can do
  </Card>

  <Card title="Settings → Teams" icon="users" href="/settings/teams">
    Group users for sharing
  </Card>
</CardGroup>