> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/tenant-administration/manage-users.md).

# Manage users

{% hint style="info" %}
Coherent's recommendation is to integrate Keycloak, our Identity and Access Management (IAM) with your Identity Provider (IdP). This provides the best security for user accounts. See [Identity and Access Management](/identity-and-access-management/recommendations.md) and [Benefits of IdP versus local accounts](/identity-and-access-management/benefits-of-idp-versus-local-accounts.md).

This functionality may be disabled if [Single Sign-On](/identity-and-access-management/single-sign-on.md) is enabled.
{% endhint %}

## User groups

Tenant administrators (`tenant-admin`s) can create user groups, which act like teams where different users are grouped together if they perform similar actions. For example, the Product team can be a part of the same user group, responsible for adding and updating the Excel files on Spark. User groups can control access to Folders, if part of a [Private tenant](/tenant-administration/private-tenant.md).

* In a *Shared tenant*, where every user has access to all folders and services within a tenant, the relevant user groups are `tenant-admin` and `user:pf`.
* In a [Private tenant](/tenant-administration/private-tenant.md) where users have restricted access to folders and services:
  * The relevant user groups also include `supervisor:pf` and any other user groups the administrators may want to create, such as regional or functional teams.
  * User groups can also define permissions for [Authorization - API keys](/spark-apis/authorization-api-keys.md).

### Default user groups

| User group                               | Description                                                                                                                                                                                                                                                                                                                                                                                             |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `supervisor:epos`                        | This is only used by Coherent Flow tenants.                                                                                                                                                                                                                                                                                                                                                             |
| :police\_officer: `supervisor:pf`        | This user group by default has access to all Folders and Services.                                                                                                                                                                                                                                                                                                                                      |
| :star2: `tenant-admin`                   | <p>Realm administrator that can manage User, Groups, Clients, Roles and Realm/Tenant.<br>In a <a data-mention href="/pages/xnvs0k85jDD6K3EkGvfi">/pages/xnvs0k85jDD6K3EkGvfi</a>, <code>tenant-admin</code>s cannot see all Folders and Services unless they added to the <code>supervisor:pf</code> group.<br><br><code>tenant-admin</code>s can also use APIs to access all objects within Spark.</p> |
| <p><code>tenant-moderator</code><br></p> | <p>Realm Moderator that can manage only User and Groups.<br>This group can remain unused.</p>                                                                                                                                                                                                                                                                                                           |
| `tenant-viewer`                          | <p>Realm Viewer it can only view Users and Groups.<br>This group can remain unused.</p>                                                                                                                                                                                                                                                                                                                 |
| `user:anonymous`                         | This is only used by Coherent Flow tenants.                                                                                                                                                                                                                                                                                                                                                             |
| `user:coherent.forms`                    | This is only used by Coherent Flow tenants.                                                                                                                                                                                                                                                                                                                                                             |
| `user:epos`                              | This is only used by Coherent Flow tenants.                                                                                                                                                                                                                                                                                                                                                             |
| :star: `user:pf`                         | Access to this user group is mandatory for a user to login to Spark.                                                                                                                                                                                                                                                                                                                                    |

### View user groups

1. Login using `tenant-admin` credentials.
2. Choose **Options** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
3. In the left-hand navigation that appears, select **User groups**.
4. Click **View users** to see all the users who are members of each user group.

### Add user groups

{% hint style="warning" %}
Newly created user group names should begin with the prefix `user:` or `supervisor:`, for example `user:NewUserGroup`.
{% endhint %}

{% hint style="info" %}
`supervisor` users are able to manage the users for folders they have access to. When a folder is created, `supervisor` user groups are also assigned access by default.
{% endhint %}

1. Follow [#view-user-groups](#view-user-groups "mention") to arrive at the *User groups* screen.
2. Click on **Add user group**.
3. Enter the required information.
4. Existing [#users](#users "mention") on Spark can be added to the user group.
5. Click **Submit** to finish adding the user group.

### Edit user groups

1. Follow [#view-user-groups](#view-user-groups "mention") to arrive at the *User groups* screen.
2. Click on the "three-dot menu" and select **Edit user group**.
3. A similar screen to [#view-user-groups](#view-user-groups "mention") appears.
4. Click **Submit** to finish making changes.

### Delete user groups

* Follow [#view-user-groups](#view-user-groups "mention") to arrive at the *User groups* screen.
* Click on the "three-dot menu" and select **Delete user group**.
* Any permissions related to the deleted user group will no longer apply.

## Users

`tenant-admin`s also have the ability to add users to their Spark environment. Users can be managed from the *Users* page inside Spark. Individual users added to Spark will then have the ability to log in and start creating APIs.

### View users

1. Login using `tenant-admin` credentials.
2. Choose **Options** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
3. In the left-hand navigation that appears, select **Users**.
4. In the three-dot menu for each user, click **View users** to see all the users who are members of each user group.

### Add users

{% hint style="warning" %}
`user:pf` is a mandatory user group for users to login to Spark!
{% endhint %}

1. Follow [#view-users](#view-users "mention") to arrive at the *Users* screen.
2. Click on **Add user**.
3. Enter the required information.
4. Users can be added to the relevant user groups. `user:pf` is required to access Spark!.
5. Alternatively, user permissions can be copied from an existing user.
6. Users can also be setup to use Multi-Factor Authentication to login. See [Multi-Factor Authentication (MFA)](/identity-and-access-management/multi-factor-authentication-mfa.md) for more information.
7. There is an option to choose between sending the user an invitation link or generating a password.
8. Click **Submit** to finish adding the user.

### Edit users

1. Follow [#view-users](#view-users "mention") to arrive at the *Users* screen.
2. Click on the "three-dot menu" and select *Edit user*.
3. A similar screen to [#add-users](#add-users "mention") appears.
4. Click **Submit** to finish making changes.

### Deactivate users

{% hint style="info" %}
Users cannot be deleted from Spark in order to support internal audit and tracking of events in Spark.
{% endhint %}

1. Follow [#view-users](#view-users "mention") to arrive at the *Users* screen.
2. Click on the "three-dot menu" and select **Deactivate user**.
3. The user account will be deactivated and no longer able to access Spark.