# Users and Groups

> Source: https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/rbac/users_and_groups
> For the complete documentation index, see [llms.txt](https://docs.synthesized.io/llms.txt).

Manage users and groups for access control and collaboration.

## Overview

The platform supports:

- **Local Users**: Username/password authentication
- **SSO Users**: SAML/OAuth integration
- **LDAP Users**: Active Directory integration
- **Groups**: Organize users for easier management

## Creating Users

### Local Users

Via Web UI: 1. Navigate to **Settings** → **Users** 2. Click **Create User** 3. Enter user details: \* Email: [user@example.com](mailto:user@example.com) \* Name: John Doe \* Role: Member 4. Set temporary password 5. Click **Create**

User receives password reset email.

### SSO/LDAP Users

Auto-provisioned on first login when SSO/LDAP is configured.

When [SAML group-to-role mapping](https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/authentication/sso#_saml_group_to_role_mapping) is enabled, users are automatically assigned roles based on their Identity Provider group memberships. Roles are updated on each login and cannot be changed in the Governor UI.

Similarly, [LDAP authorities](https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/authentication/ldap_activedirectory#authorities) can manage roles from the directory server.

## Managing Groups

### Creating Groups

1. Navigate to **Settings** → **Groups**
2. Click **Create Group**
3. Enter group name: "Data Engineers"
4. Add members
5. Assign to projects

### Group Permissions

Assign permissions to groups: \* All group members inherit permissions \* Easier than individual user management \* Sync with LDAP/AD groups

## User Status

- **Active**: Can log in and use the platform
- **Inactive**: Disabled, cannot log in
- **Pending**: Awaiting activation

## Best Practices

1. **Use Groups**: Assign permissions to groups, not individuals
2. **Regular Reviews**: Review user access quarterly
3. **Disable Inactive**: Disable accounts for departed users
4. **Principle of Least Privilege**: Grant minimum required access

## See Also

- [RBAC Configuration](https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/rbac/role_based_access_control)
- [SSO Integration](https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/authentication/sso)
- [Administration Guide](https://docs.synthesized.io/tdk/latest/user_guide/050_deployment_operations/administration/)