> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/platform-access-control/add-users.md).

# Manage users

A Harness user is any individual registered with Harness with a unique email address. Users can be associated with multiple Harness accounts, and they can be in multiple user groups. You can assign [roles](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-manage-roles.md) and [resource groups](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md) directly to users, or they can inherit them from [user groups](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-user-groups.md).

You can [add users manually](#add-users-manually) or through [automated provisioning](#use-automated-provisioning). You can create user groups at all [scopes](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes).

{% hint style="info" %}
**SERVICE ACCOUNTS**

You can also create [service accounts](/harness-ai/use-harness-platform/platform-access-control/add-and-manage-service-account.md) in Harness.
{% endhint %}

### Use automated provisioning <a href="#use-automated-provisioning" id="use-automated-provisioning"></a>

You can [manually add users](#add-users-manually) and user groups in Harness, and you can use automated provisioning, including:

* [Okta SCIM](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-users-with-okta-scim.md)
* [Microsoft Entra ID SCIM](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-users-and-groups-using-azure-ad-scim.md)
* [OneLogin SCIM](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-users-and-groups-with-one-login-scim.md)
* [Just-in-time provisioning](/harness-platform/3.0/harness-platform-resources/platform-access-control/provision-use-jit.md)

When you use automated provisioning, users and user groups are imported from your IdP, and then you [assign roles and resource groups](#assign-roles-and-resource-groups) to the imported users and groups in Harness. For imported users and groups, you manage group metadata, group membership, and user profiles in your IdP, and you manage their role and resource group assignments in Harness. You can also create users and user groups directly in Harness, but any users or groups imported from your IdP must be managed in your IdP.

For example, if you use Okta as your IdP, you could create a user group in Okta and assign users to that group in Okta. When the user group is first imported into Harness, the group and the group members are not associated with any roles or resource groups. You must assign roles and resource groups to the user group in Harness. The group members then inherit permissions and access from the role and resource group that is assigned to the user group.

### Add users manually <a href="#add-users-manually" id="add-users-manually"></a>

To add users in Harness, you need a role, such as **Account Admin**, that has [permission](/harness-platform/3.0/harness-platform-resources/platform-access-control/permissions-reference.md) to invite and manage users.

{% hint style="info" %}
You can add up to 50,000 users in paid plans. Free plans and Harness Community Edition accounts are limited to 1,500 users.
{% endhint %}

{% hint style="info" %}
When a new user is added to a project, the user is automatically added to the `All Organization Users` user group of the parent organization. However, when a user is removed from a project, they are not removed from the `All Organization Users` user group of the parent organization.
{% endhint %}

1. In Harness, go to the [scope](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes) where you want to add the user.
   * To add a user at the account scope, select **Account Settings**, and then select **Access Control**.
   * To add a user at the organization scope, go to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To add a user at the project scope, go to **Projects**, select the relevant project, and then select **Access Control**.
2. Select **New User**.
3. In **Users**, enter the email address that user will use to log into Harness.

   You can add multiple users at once by entering multiple email addresses.
4. In **User Groups**, you can assign the user to one or more [user groups](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-user-groups.md).

   When assigned to a user group, the user inherits the [roles and resource groups](#assign-roles-and-resource-groups) assigned to that group.

   You can also assign roles and resource groups directly to individual users.

   Users are not required to belong to user groups; however, user groups make it easier to manage permissions and access. Instead of modifying each user individually, you can edit the permissions and access for the entire group at once.
5. In **Role Bindings**, you can assign roles and resource groups directly to the new user.

   If you selected any **User Groups**, the role and resource group assignments inherited from those groups *are not* listed in **Role Bindings**.

   If you didn't select any user groups, you must apply a role binding. Without a role binding (directly or inherited from a user group), the user won't have any permissions or access in Harness.
6. Select **Apply**. Users receive a verification email at the address(es) you entered. When the user logs into Harness, the user creates a password, the email address is verified, and the user's name attribute is updated.

#### Set default landing URL for invited users <a href="#set-default-landing-url-for-invited-users" id="set-default-landing-url-for-invited-users"></a>

{% hint style="info" %}
Currently, this feature is behind the feature flag `PL_PREFERENCE_LANDING_PAGE_URL`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
{% endhint %}

When inviting a new user, you can set a default landing URL to which the user will be directed upon their login. This feature helps guide users to a specific page or dashboard based on their preferences.

1. In the invitation form, enter the email addresses of the users you want to invite.
2. In the **Default Landing URL** field, specify the URL you want the invited user to be redirected to after they accept the invitation. For example, you can set it to `https://app.harness.io/ng/account/<account-id>/module/ssca/projects` for the SCS homepage.
3. Send the invitation.

After the user accepts the invite and logs in, they will be redirected to the specified URL.

#### Update user preferences <a href="#update-user-preferences" id="update-user-preferences"></a>

{% hint style="info" %}
Currently, this feature is behind the feature flag `PL_PREFERENCE_LANDING_PAGE_URL`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
{% endhint %}

Users can update their default landing URL from their profile settings:

1. Sign in as the invited user.
2. Go to the user profile.
3. Select the **Preferences** tab.
4. Update the **Default Landing URL** to the desired page, such as `https://app.harness.io/ng/account/account/<account-id>/module/cf/home/projects` for the Feature Flags homepage.
5. Save the changes.

The next time the user logs in, they will be redirected to the updated URL.

#### Invitation emails <a href="#invitation-emails" id="invitation-emails"></a>

When you add a user, Harness checks your [authentication method](/harness-ai/use-harness-platform/authentication.md) and email invite preferences to determine if an email invitation should be sent:

* **Login via a Harness Account or Public OAuth Providers:** The invited user gets an email invitation. The user is listed on **Pending Users** until the user accepts the invitation.
* **SAML**, **LDAP**, or **OAuth** *and* you have enabled the feature flag `PL_NO_EMAIL_FOR_SAML_ACCOUNT_INVITES`: Harness adds the user directly to the **Active Users** list, and Harness *doesn't* send an email to the user.
* **SAML**, **LDAP**, or **OAuth** *and* you have enabled the feature flag `AUTO_ACCEPT_SAML_ACCOUNT_INVITES`: Harness adds the user directly to the **Active Users** list, and Harness sends a notification email to the user.
* **SAML**, **LDAP**, or **OAuth** *and* you have enabled both feature flags: `PL_NO_EMAIL_FOR_SAML_ACCOUNT_INVITES` takes precedence over `AUTO_ACCEPT_SAML_ACCOUNT_INVITES`. Harness adds users directly to the **Active Users** list, and Harness *doesn't* send invitation emails.

### Assign roles and resource groups <a href="#assign-roles-and-resource-groups" id="assign-roles-and-resource-groups"></a>

You assign [roles](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-manage-roles.md) and [resource groups](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md) to users to grant them permissions and access in Harness. Users can inherit roles and resource groups from [group membership](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-user-groups.md), or you can assign roles and resource groups directly to individual users. For more information about assigning roles and resource groups, go to [RBAC in Harness: Role binding](/harness-ai/use-harness-platform/platform-access-control.md#role-binding).

{% hint style="warning" %}
**LEAST PRIVILEGE**

RBAC is additive. The total expanse of a user/service account's permissions and access is the sum of all the roles and resource groups from all user groups they belong to, as well as any roles and resource groups assigned directly to them as an individual user/service account.

It is important to follow the principle of least privilege (PoLP). This is a security principle that means users are granted the absolute minimum access/permissions necessary to complete their tasks and nothing more.

While Harness includes some built-in roles and resource groups, to ensure the least privilege, consider:

* Being selective in the way you apply roles and resource groups.
* Creating your own roles and resource groups as needed for refined access control.
  {% endhint %}

To manage users in Harness, you need a role, such as **Account Admin**, that has [permission](/harness-platform/3.0/harness-platform-resources/platform-access-control/permissions-reference.md) to manage users.

#### View role bindings <a href="#view-role-bindings" id="view-role-bindings"></a>

1. In Harness, go to the [scope](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes) where the user exists.
   * To edit a user at the account scope, select **Account Settings**, and then select **Access Control**.
   * To edit a user at the organization scope, go to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To edit a user at the project scope, go to **Projects**, select the relevant project, and then select **Access Control**.
2. Select the user you want to view.
3. Switch to the **Role Bindings** tab.
4. Select a [**Scope**](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes).
   * **All**: List role bindings across all scopes.
   * **Account only**: List role bindings only at the account scope.
   * **Organization** **only**: List role bindings in the scope of a specific organization, but not the projects under that organization.
   * **Organization and Projects**: List role bindings in the scope of a specific organization and all projects under that organization.
5. Review the role bindings.

   The **Assigned Through** column indicates the source of the role binding. Assignments are either **Direct** or inherited from a user group. If inherited, the user group name is listed.

   The **Assigned At** column indicates the scope at which the assignment was made. If assigned at an organization or project scope, the organization and project name are listed.

#### Edit direct assignments <a href="#edit-direct-assignments" id="edit-direct-assignments"></a>

Use these steps to manage directly assigned role bindings.

1. Follow the steps to [view role bindings](#view-role-bindings).
2. Select **Manage Roles**.
3. In **Role Bindings**, select **Add**, then select a [role](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-manage-roles.md) and a [resource group](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-resource-groups.md). Repeat to add more role bindings.
4. To delete a role binding, select the **Delete** icon.
5. Select **Apply** to save the changes.

#### Edit inherited assignments <a href="#edit-inherited-assignments" id="edit-inherited-assignments"></a>

There are several ways to edit inherited role bindings:

* Edit group membership through an individual user's profile. This is best for changing group membership for a single user.
* [Edit membership in the user group's settings](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-user-groups.md#edit-group-members), rather than editing each user individually. This is useful for adding and removing multiple users at once.
* [Edit role bindings in the user group's settings](/harness-platform/3.0/harness-platform-resources/platform-access-control/add-user-groups.md#assign-roles-and-resource-groups). Do this to change inherited role bindings without changing group membership.
* Editing group membership in your IdP. If you use [use automated provisioning](#use-automated-provisioning), group membership is managed through your IdP.

To edit group membership through a user's profile:

1. Follow the steps to [view role bindings](#view-role-bindings).
2. Switch to the **Group Memberships** tab.
3. Select a [**Scope**](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes).
   * **All**: List groups across all scopes.
   * **Account only**: List groups only at the account scope.
   * **Organization** **only**: List groups in the scope of a specific organization, but not the projects under that organization.
   * **Organization and Projects**: List groups in the scope of a specific organization and all projects under that organization.
4. Select **Add to a new User Group**, and then modify the user's group membership by selecting or deselecting groups accordingly.
   * To add the user to a group, search for and select the relevant group.
   * To remove the user from a group, search for and deselect the relevant group.
5. Select **Apply Selected**.

### Delete users <a href="#delete-users" id="delete-users"></a>

Use these steps to delete a user from Harness.

{% hint style="info" %}
If you [use automated provisioning](#use-automated-provisioning), user accounts are managed by your IdP. Delete or deactivate the user in your IdP to revoke their access to Harness.
{% endhint %}

{% hint style="warning" %}
**IMPORTANT NOTE**

When a user is deleted from an account and then added back, their permissions are not restored immediately. It may take 5–10 minutes for the user to inherit their previous permissions.
{% endhint %}

1. Make sure you have a role, such as **Account Admin**, that has [permission](/harness-platform/3.0/harness-platform-resources/platform-access-control/permissions-reference.md) to manage users.
2. In Harness, go to the [scope](/harness-ai/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes) where the user exists.
   * To delete a user at the account scope, select **Account Settings**, and then select **Access Control**.
   * To delete a user at the organization scope, go to **Account Settings**, select **Organizations**, select the relevant organization, and then select **Access Control**.
   * To delete a user at the project scope, go to **Projects**, select the relevant project, and then select **Access Control**.
3. Locate the user you want to delete.
4. Select **More options** (⋮), and then select **Delete**.