# Manage user accounts
URL: https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html

> How to create LDAP or local authentication user accounts, set permissions, and manage membership of groups and organizations.

# Manage user accounts

The DataRobot deployment provides support for local authentication users. These are user accounts you create manually (through APP ADMIN > Manage Users). DataRobot provides restrictions for login and password settings. The login credentials for these locally authenticated users are stored as fully qualified domain names.

**SaaS:**
> [!NOTE] Availability information
> Required permission: Org Admin

**Self-Managed: LDAP:**
> [!NOTE] Availability information
> Required permission: Can manage users

The DataRobot deployment provides support for three types of user accounts:

User Account Type
Description
Internal
This is the default DataRobot administrator account, which authenticates using admin@datarobot.com. This account has full administrator access to the deployed cluster. You cannot revoke administrator privileges; the only change you can make to this account is password updates.
Local authentication
These are user accounts you create manually (through
APP ADMIN > Manage Users
). DataRobot provides restrictions for login and password settings. The login credentials for these locally authenticated users are stored as fully qualified domain names.
LDAP authentication configuration
These user accounts are created through an authentication integration with a defined LDAP directory service; you do not use the DataRobot UI to create these user accounts.

LDAP accounts

When LDAP users sign into DataRobot for the first time, their user profiles are created and saved in DataRobot but their passwords are not. Usernames for these LDAP-authenticated users are simple usernames and not fully qualified domain names. Passwords cannot be changed. Not that if a user is removed from the LDAP Directory server or group, they are not able to access DataRobot. The user account, however, remains intact.

> [!NOTE] Note
> [Local authentication](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html#create-user-accounts) is not supported when LDAP is enabled (i.e., no "mixed mode").

See the instructions below for creating local authentication accounts.


## Create user accounts

Both system and organization administrators can create and add new users to the DataRobot installation (org admins can only create users in their own organization). First, create a user account for yourself, so that you can access DataRobot as a user in addition to using the default administrator account. Use the following steps to create your own user account, and then repeat them for each additional user. See details on the [different types of administrators](https://docs.datarobot.com/en/docs/platform/admin/admin-overview.html#administrator-role) for more information.

> [!NOTE] Note
> These steps show access to the flow using the NextGen UI, which has a separate menu for system admin features. In Classic UI, navigation can be performed by accessing the user profile icon at the top right of the screen. Once launched, the configuration happens within the Classic UI admin section; use the dropdown to return to NextGen.
> 
> [https://docs.datarobot.com/en/docs/images/switch-ui-version.png](https://docs.datarobot.com/en/docs/images/switch-ui-version.png)

**SaaS:**
Click the admin icon, located to the left of your user icon, and select
Users
Click
Create a user
at the top of the displayed page.
In the displayed modal, enter the username (i.e., email address), first name, and password for the new user (other account settings are optional at this point). Refer to
Change your password
for password requirements.
Click
Create user
. If successful, you see the message "Account created successfully".
Click
View user profile
to view and configure user settings for this user (such as organization membership or permissions), or click
Close
.

**Self-Managed:**
Expand the profile icon located in the upper right and click
APP ADMIN > Users
from the dropdown menu.
Click
Create a user
at the top of the displayed page.
In the displayed dialog, enter the username (i.e., email address), first name, and password for the new user (other account settings are optional at this point). If shown, selecting
Require Clickthrough Agreement
may be necessary for your cluster deployment. Refer to
Change your password
for password requirements.
Click
Create user
. If successful, you see the message "Account created successfully" and the username for the new account.
Click
View user profile
to view and configure user settings for this user, or click
Close
.


The new user will now be listed in the Users table. You can open the User Profile to see some important information including the user's application-assigned ID.

## Invite users

Both [system and organization administrators](https://docs.datarobot.com/en/docs/platform/admin/admin-overview.html#administrator-role) can invite new users to join a DataRobot organization or installation (org admins can only create users in their own organization). You can invite up to twenty individuals at a time to join DataRobot as a regular or [non-builder user](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html#non-builder-user-seats).

1. Click the admin icon, located to the left of your user icon, and selectUsers
2. ClickInvite usersat the top of the displayed page.
3. Enter a username (email address or username) for each individual you want to invite, and then, underOrganization, begin typing the name of the organization. Select an organization from the list that appears below.
4. You can either send invitations to join the DataRobot organization as a regular or non-builder user. Non-builder users can only interact with applications and do not count towards the organizations maximum active user limit.

**User:**
To send invitations to join as regular users, click Invite.

**Non-builder user:**
To send invitations to join as non-builder users, select the box next to Non-builder account.

Under Available applications, enter the applications you want to share with the users, and then click Invite. By default, non-builder users can access all applications associated with the organization they're invited to join.

[https://docs.datarobot.com/en/docs/images/invite-nonbuilder.png](https://docs.datarobot.com/en/docs/images/invite-nonbuilder.png)


## Set admin permissions for users

**SaaS:**
As an admin, you can set organization admin permissions for other DataRobot users within the application, including your personal user account. These permissions allow the recipient to enable or disable features per user, as needed. Visit the Settings page to see a list of available features; hover over a feature name for a brief description.

Below are the steps to enable administrator access for any user. This user will have administrator access to all DataRobot functionality configured for the application.

> [!NOTE] Note
> Consider and control how you provide admin settings to non-administrator users. One way to do this is to add settings only on an as-needed basis and then remove those settings when related tasks are completed.

From the
Users
page, locate the user and select to open the user's profile page.
Click
Membership
to display the organization and groups that the user is a member of.
Under the
Organization
header, check the box in the
Org Admin
column to enable organization admin permissions for the user.

[https://docs.datarobot.com/en/docs/images/org-admin-2.png](https://docs.datarobot.com/en/docs/images/org-admin-2.png)

This user can now modify settings for other users. At any point, if you want to disable these permissions for the user, uncheck the box; the user will no longer have administrator capabilities.

**Self-Managed:**
As an admin, you can set admin permissions for other DataRobot users within the application, including your personal user account. These permissions allow the recipient to enable or disable features per user, as needed. Visit the Settings page to see a list of available features; hover over a feature name for a brief description.

Below are the steps to enable administrator access for any user. This user will have administrator access to all DataRobot functionality configured for the application.

> [!NOTE] Note
> Consider and control how you provide admin settings to non-administrator users. One way to do this is to add settings only on an as-needed basis and then remove those settings when related tasks are completed.

From the
Users
page, locate the user and select to open the user's profile page.
On
User Profile
, click
Change Permissions
to display the
User Permissions > Manage Settings
page for the user
Select the Admin setting “Can manage users” and click
Save
.

This user now can modify settings for other users. At any point, if you want to disable the “Can manage users” setting for this user, uncheck the box and click Save; the user will no longer have administrator capabilities.


## Assign seat licenses to users

> [!NOTE] Premium
> The ability to assign seat licenses is a premium feature. This capability is only available to:
> 
> Multi-tenant SaaS organizations that have a seat license allocation.
> Single-tenant SaaS/self-managed installations that have a license key with a cluster-level seat allocation, allowing system adminstrators for that installation to allocate seats to the organizations.
> 
> Contact your DataRobot representative for enablement information.

Users must be assigned seat licenses to grant them access to specific functionality.
There are three main types of users that manage or use seat licenses:

- System administrator (sys admin) : Provides overall license management, allocation, and assignment of seats across organizations within the installation.
- Organization administrator (org admin) : Manages users, assignments, and assignment of seats within their organization.
- User : Consumes assigned seats and accesses licensed features.

> [!WARNING] Warning
> A user account can only be assigned one role at a time, so the sys admin and org admin must be two separate accounts.

### Allocate seats to the organization (sys admin)

> [!NOTE] Note
> These steps show access to the flow using the NextGen UI, which has a separate menu for system admin features. In the Classic UI, navigate to this section through the user profile icon in the top-right corner of the screen. In both cases, the configuration process happens in the Classic UI admin section. Use the UI version dropdown to return to NextGen.
> 
> [https://docs.datarobot.com/en/docs/images/switch-ui-version.png](https://docs.datarobot.com/en/docs/images/switch-ui-version.png)

Before users can be assigned seats, the system administrator must allocate seats to the organization.
For DataRobot-managed deployments, this is done by the DataRobot team.
For self-managed deployments, this is done by the system administrator.

> [!WARNING] Required feature flags
> Seat licenses require the following feature flags to be enabled: `Enable MLOps agentic workflow`, `Enable MMM agentic workflow tracing`.

1. Click the admin icon, located to the left of your user icon, and selectLicense.
2. In theAllocate Seatstable, clickAllocate seats.
3. In theAllocate seatsmodal, select an organization and enter the number of seats to allocate.
4. ClickAllocate.

#### Allocate additional seats

As a system administrator, you can allocate additional seats to an organization that already has seat licenses allocated.

1. Navigate to the profile page of the organization that needs additional seats.
2. Under Organization Details , locate the Seat Licenses section.
3. Find the seat license you want to modify and enter the new seat count in the input field.
4. ClickSave. The organization now has additional seats allocated.

### Assign seats to users (system or org admin)

Once the organization has been allocated seats, the licenses can be applied to individual user accounts by the system or organization administrator.
To assign the licenses currently allocated for an organization:

1. Click the admin icon, located to the left of your user icon, and selectSeat License.
2. Click the seat license you want to assign. NoteThe licenses available will vary based on the type(s) of license allocated to the organization.
3. Click theAssign seatsbutton. WarningThe following step is only available for system administrators. Organization administrators can skip to step 6.
4. (System admin only) In theOrganizationfield, specify the organization that contains the users to be assigned seats.
5. In theUsernamesfield, specify the users to be assigned seats.
6. When you're done selecting users, clickAssign.

Seats can be removed from users by clicking the Actions menu for the user in the Assigned Seats section and selecting Revoke seat.

> [!NOTE] Note
> The Organization field shown in the image above is only available for system administrators.

### Non-builder user seats

Non-builder users can only interact with published applications—they do not have access to DataRobot functionality or public APIs. Using an application, non-builders can run predictions, add prompts, start chats, view/delete, and upload data.

By default, non-builder users can access all applications associated with the organization they're invited to join as well as basic user settings. Non-builder users do not count towards an organization's maximum active user allocation.

If you're a system admin, you must first [allocate seats to your organization](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html#allocate-seats-to-the-organization-sys-admin). Then you can assign the license to specific users by:

- Assigning seats to newly-created or existing users.
- Inviting non-builder users.

> [!NOTE] Non-builder seats vs Active user seats
> If your organization has reached its maximum user allocation, you cannot create a non-builder user via the user creation flow—you must either assign a Non-builder seat to an existing user or invite a new user.

## Self-Managed AI Platform admins

> [!NOTE] Note
> The following feature is only available on the Self-Managed AI Platform.

### Additional permissions options

To set permissions and supported features for users, repeat the previous process selecting the desired permissions from those listed in the user's User Permissions > Manage Settings page. See the settings and features description for information on the available admin settings and optional features.

For each user you can also:

- Set their maximum personal worker allocation .
- Set their RAM usage limit.
- Set their file upload size limit.
- Set the rate at which the Deployment page refreshes (three second minimum).
- Assign them to an organization (you must create the organization first).

## RBAC for users

Role-based access (RBAC) controls access to the DataRobot application by assigning users roles with designated privileges. The assigned role controls both what the user sees when using the application and which objects they have access to. RBAC is additive, so a user's permissions will be the sum of all permissions set at the user and group level.

To assign a user role:

1. From theUserspage, locate and select the user to open their profile page.
2. Click thePermissionstab to view a list of settings and permissions.
3. In the left panel, clickPlatform > Admin Controls. Then, open theUser roledropdown menu and select the appropriate role(s) for the user.
4. When you're done, clickSave changes.

Review the [role and access definitions](https://docs.datarobot.com/en/docs/reference/misc-ref/rbac-ref.html) to understand the permissions enabled for each role.

> [!TIP] Tip
> Avoid granting access to specific features by assigning roles at the user-level because this makes managing permissions more difficult—causing you to have to modify several users, rather than a few groups, as well as increasing the possibility of having users with non-standardized levels of access. Make sure access to features required to complete work are defined at the group- or org-level, and that the user is a member.

> [!NOTE] Note
> Note that RBAC overrides [sharing-based role permissions](https://docs.datarobot.com/en/docs/reference/misc-ref/roles-permissions.html). For example, consider a user is assigned the Viewer role via RBAC, which only has Read access to objects. If this user has a project shared with them that grants Owner permissions (which offers Read and Write access), the Viewer role takes priority and denies the user Write access.

## Manage execution environment limits

The execution environment limit allows you to control how many custom model environments a user can add to the [Custom Model Workshop](https://docs.datarobot.com/en/docs/classic-ui/mlops/deployment/custom-models/custom-model-workshop/index.html). In addition, the execution environment version limit allows you to control how many versions a user can add to each of those environments. These limits can be:

1. Directly applied to the user: Set in a user's permissions. Overrides the limits set in the group and organization permissions.
2. Inherited from a user group: Set in the permissions of the group a user belongs to. Overrides the limits set in organization permissions.
3. Inherited from an organization: Set in the permissions of the organization a user belongs to.

If the environment or environment version limits are defined for an organization or a group, the users within that organization or group inherit the defined limits. However, a more specific definition of those limits at a lower level takes precedence. For example, an organization may have the environment limits set to 5, a group to 4, and the user to 3; in this scenario, the final limit for the individual user is 3.

For more information on adding custom model execution environments, see the [Custom model environments documentation](https://docs.datarobot.com/en/docs/classic-ui/mlops/deployment/custom-models/custom-model-environments/custom-environments.html).

To manage the execution environment limits in the platform settings:

1. Click your profile avatar (or the default avatar) in the upper-right corner of DataRobot, and then, underAPP ADMIN, clickUsers.
2. From theUserspage, locate and select the user to open their profile page.
3. Click thePermissionstab to view a list of settings and permissions.
4. On thePermissionstab, clickPlatform, and then clickAdmin Controls.
5. UnderAdmin Controls, set either or both of the following settings:
6. ClickSave changes.

## Change your password

You can change passwords for your own user accounts. If you need help generating a new password for the default administrator, contact Customer Support.

To change your password:

1. Expand the profile icon located in the upper right and clickUser Settings.
2. On the User settings page, clickAuthentication.
3. On the displayed page, enter your current password and then the new password twice (to create and confirm). ClickChange Password.

DataRobot enforces the following password requirements:

- Only printable ASCII characters
- Minimum one capital letter
- Minimum one number
- Minimum 8 characters
- Maximum 512 characters
- Username and password cannot be the same

## Manage groups and organization membership

SaaS admins can manage groups; Self-Managed admins can manage groups and organizations.

> [!NOTE] Note
> Users can have membership in up to 50 groups.

**Saas:**
Configuring groups helps you to manage users across the DataRobot platform. For more information, see:

Group overview
Creating groups

Once created, you can add one or more users as members from the group creation page. To add users individually, follow the steps below.

> [!NOTE] Note
> Users can see which groups they belong to from the Membership page, but they do not have permissions to make changes to those memberships.

Browse to the Users page, select the user, and in User Profile click Membership. The User Membership page shows the currently configured groups for this user.

[https://docs.datarobot.com/en/docs/images/org-admin-1.png](https://docs.datarobot.com/en/docs/images/org-admin-1.png)

Work with the page as follows:

Field
Description
1
Add user to groups
Opens a dialog where you can enter the name(s) of groups to add the user to. Note that if a group is assigned to an organization, you can only add members from that organization.
2
Group name
Opens the group configuration to allow editing of the name and description.

**Self-Managed:**
Configuring groups and organizations helps you to manage users and resources across the DataRobot platform. For more information, see:

Group overview
Creating groups
Organization overview
Creating organizations

Once created, you can add one or more users as members from the group and organization creation pages. To add users individually, follow the steps below.

> [!NOTE] Note
> Users can see which organization and groups they belong to from the Membership page, but they do not have permissions to make changes to those memberships.

Browse to the Users page, select the user, and in User Profile click Membership. The User Membership page shows the currently configured organization and any groups for this user.

[https://docs.datarobot.com/en/docs/images/admin-usermembership-unconfigured.png](https://docs.datarobot.com/en/docs/images/admin-usermembership-unconfigured.png)

Work with the page as follows:

Field
Description
1
Organization
Enter the name for the organization. Each user can be a member of only one organization.
2
Go to org profile
Click to view the organization's profile.
3
Add user to groups
Opens a dialog where you can enter the name(s) of groups to add the user to. If the user is a member of an organization, only groups also part of the same organization, or part of no organization, are available for selection. Users can have membership in up to 50 groups.
4
<Group_name>
Opens the group configuration to allow editing of the name and description.

When you next look at this user's profile, you see the organization for the user.

[https://docs.datarobot.com/en/docs/images/admin-org-orgprofile.png](https://docs.datarobot.com/en/docs/images/admin-org-orgprofile.png)


## Deactivate user accounts

You cannot delete a user account from DataRobot—this ensures that your company's data is not lost, regardless of employee movement. However, the admin can block a user's access to DataRobot while ensuring the data and projects they worked on remain intact.

From APP ADMIN > Manage Users, locate the user:

- To deactivate, click the padlock icon next to their name, changing it to locked .
- To restore access, click the padlock icon to open .

You can also change user account access from Users > User Profile by clicking Enable User or Disable User.

## View latest user activity

From APP ADMIN > User Activity Monitor, you can quickly access the [user activity monitor](https://docs.datarobot.com/en/docs/platform/admin/monitoring/main-uam-overview.html#view-activity-and-events), which shows all app activities recorded for this user.

---
