Manage Users

The User Management page is where Admins create user accounts, assign roles, and control access to the Granica Console. It is available under Settings → User Management and is only accessible to users with the Admin role.

User table

The user list displays all accounts in your Granica deployment. Each row shows:

Add a user

Click + Add User in the top-right corner to open the Add User dialog. There are two account types depending on how the user will authenticate.

SSO users (identity provider)

Choose SSO when the user will sign in via your organization's identity provider (Okta, Microsoft Entra ID, Google Workspace, etc.). SSO must be configured before creating SSO accounts — see SSO Integration.

1. Select SSO as the authentication type.
2. Choose the protocol: OIDC or SAML 2.0 (the protocol your IdP is configured with).
3. Enter the user's Full Name.
4. Enter the user's Email address. This must exactly match the email address that the identity provider asserts during login. The username is automatically derived from the email local-part.
5. Select a Role (Viewer, Editor, or Admin).
6. Click Create User.

The user can immediately sign in via your identity provider using that email address. No password is set or required.

Bulk add SSO users from a CSV

When SSO is configured, the Add User dialog shows an Add One / Upload CSV toggle. Use Upload CSV to create many SSO accounts at once instead of adding them one at a time.

1. Select SSO as the authentication type and choose the protocol (OIDC or SAML 2.0). The selected protocol applies to every user in the file.
2. Click Upload CSV.
3. Select a Role. The chosen role is applied to all users in the file.
4. Click the upload area and choose your .csv file.
5. Click Create User to process the file.

CSV format — the first row must be a header row containing full_name and email columns (column order does not matter, and other columns are ignored):

full_name,email
Jane Smith,jane@company.com
Ravi Patel,ravi@company.com

For each row, the username is automatically derived from the email local-part, and the account is created with the role and protocol selected in the dialog.

After processing, the dialog reports how many accounts were added and lists any rows that failed with the reason (for example, a duplicate email). Successful rows are still created even when some rows in the same file fail, so you can fix the listed rows and re-upload just those.

Password users (local credentials)

Choose Password when the user will sign in with a username and password managed directly by Granica. This is useful for service accounts, break-glass users, or environments without SSO.

1. Select Password as the authentication type.
2. Enter the user's Full Name.
3. Enter a Username — this is the login identifier and cannot be changed after creation.
4. Enter the user's Email address.
5. Enter an initial Password. The user can change it after their first login.
6. Select a Role (Viewer, Editor, or Admin).
7. Click Create User.

Assign and change roles

The user's role is set when the account is created. To change it later:

1. Find the user in the user table.
2. Click the role badge (e.g., Viewer) in the Role column.
3. Select the new role from the dropdown.

The change takes effect immediately on the user's next request. See Role-Based Access Control for a full description of what each role can do.

Edit a user

Click the ⋯ (Actions) menu on any user row to access management options:

Protected accounts

The built-in admin and granica-admin accounts are marked as protected and cannot be deleted or deactivated through the UI. The granica-admin account serves as a break-glass login and is exempt from SSO enforcement. See SSO Integration for details.