> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/identity-and-access-management/local-accounts.md).

# Local accounts

{% hint style="info" %}
For security best practices, integrate your identity provider with Coherent's Keycloak.

See [IAM fundamentals](/identity-and-access-management/iam-fundamentals.md) and [Benefits of identity provider versus local accounts](/identity-and-access-management/single-sign-on/benefits-of-identity-provider-versus-local-accounts.md).
{% endhint %}

`tenant-admin`s can create local user accounts if [Single sign-on](/identity-and-access-management/single-sign-on.md) is not configured.

## View users

1. Sign in using `tenant-admin` credentials.
2. Select **Options** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
3. Select **Users**.

## Change how users are displayed

* **Activated** / **Deactivated**: Select between viewing activated users and deactivated users.
* **Search**: Enter a search term and the list will update.
* **Filter**: View only users who are members of the selected user group.
* **Sort**: Change the sort order of the items by selecting the **List view** headers.
* Select **View user groups** to see the user groups the user is a member of.

## Add user

1. Select **New user**.
2. Enter the **First name**, **Last name**, and **Email**.
3. **Select how you would like to add user to user groups**:
   * **Apply existing user's settings**: Search for a user and copy their user group membership.
   * **Select user groups**: Select the user groups. Make sure to include `user:pf` as it is required for sign in.
4. Enable multifactor authentication for local accounts for better security. Select **Require Multi-Factor Authentication**.
5. To set an expiration date on the account, enable **Set expiration date and time** and entering a date and time. This is useful to provide limited access to other users who need to access your tenant temporarily.
6. **Select how you would like to add user.**
   * **Invitation link**: The user will receive a "Complete your registration" email. This is recommended as it verifies the user account.
   * **Create credentials**: Enter a password for the user or select **Generate** if you want Spark to generate a secure password. Make sure to copy the password before continuing.
7. Select **Submit**.

## Edit user

1. Select the ellipsis menu and select **Edit user**.
2. Change the **First name**, **Last name**, user groups, multifactor authentication, access expiration, or **Invitation link**.
3. Select **Submit**.

## Deactivate users

Users cannot be deleted from Spark in order to maintain auditing and tracking of events.

1. Select the ellipsis menu and select **Deactivate user**.
2. The **Deactivated** users screen will display with the deactivated user at the top of the list.
3. The user account will be deactivated and no longer able to access Spark.

## Multifactor authentication sign in

<details>

<summary>Authenticator apps</summary>

* [FreeOTP](https://freeotp.github.io/): [Apple App Store](https://apps.apple.com/us/app/freeotp-authenticator/id872559395), [Google Play](https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp)
* Google Authenticator: [Apple App Store](https://apps.apple.com/us/app/google-authenticator/id388497605), [Google Play](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2)
* [Microsoft Authenticator](https://support.microsoft.com/en-us/authenticator/): [Apple App Store](https://apps.apple.com/us/app/microsoft-authenticator/id983156458), [Google Play](https://play.google.com/store/apps/details?id=com.azure.authenticator)

</details>

1. When the user signs in for the first time, they will be prompted to open the authenticator app and to scan the provided QR code.
2. Input the number generated by the authenticator app into the **One-time code** field.
3. Under **Device Name**, enter a name to identify the device that is being used.
4. Select **Submit**.
5. For each subsequent sign in, the user will be prompted to provide the one-time password from the authenticator app.

## Prevent brute force attacks

1. Sign in to the target Spark tenant. Access the **Keycloak console** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
2. Follow the instructions in the [Keycloak Server Administration Guide](https://www.keycloak.org/docs/latest/server_admin/index.html#password-guess-brute-force-attacks) to adjust the **Security defences** for **Brute force detection**.