> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Add users

You can add users in the following ways:

- [Manually](#add-users-manually)

  - Users added manually are managed locally in IDaaS.
  - Locally managed users can be synchronized to a directory provided they already exist in the directory (see [Synchronize IDaaS users with a directory](#synchronize-users-from-a-directory)).

- [Synchronize users from an Active Directory](#synchronize-users-from-a-directory)

  - Synchronizing users makes it easier to add and update individual users without having to wait for a full directory sync to complete.

  - You must use a supported Gateway to synchronize individual users from a directory.

    note
    Before you begin, define the required custom user attributes. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

## Add users manually

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.

2. Click Circle Plus icon. The **Add User** page appears.

info
If you have a directory synced to your IDaaS account, a drop-down list appears prompting you to **Create a local user** or **Sync a user**. If you do not have a directory synced to your account, you will not see the drop-down list.

To add the user manually, select **Create local user**.

3. Under **Personal Information**, enter the attributes as required.

   - First Name
   - Last Name
   - User ID
   - Email: The email address is used to send authenticator and account information emails.
   - Mobile: The mobile device number is used to send SMS one-time passwords to the user. It can also be used to send VOICE one-time passwords to the user if the user does not have a phone number.
   - Phone: The phone number is used to send a voice message of one-time passwords to the user.
   - Security ID: This setting is required to use Smart Login with Microsoft Windows.

   note
   Attributes flagged with an asterisk (*) are mandatory. By default, First Name, Last Name, Email, and User ID are set as mandatory. For information on changing them, see "Edit a system attribute" in [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

4. From the **Language Preference** drop-down list, select the language of the user.

note
Selecting **Account Default** sets the user's language preference to the account language setting. The account language setting is defined at Menu icon **>** **Theme**. If the account language setting changes, the user's language also changes.

5. Under **Permissions**, do the following:

   1. From the **Select Group to add** drop-down list, assign the user to the required group. You can add the user to more groups by selecting them, one at a time, from the drop-down list.

   note
   If no groups are selected, the user is assigned to the **All IDaaS Users** group by default.

   2. If applicable, from the **Select Access Management Role to add** drop-down list, select the access role assigned to the user for OAuth resource authorization.

      > You can associate more Access Management Roles with the user by selecting them, one at a time, from the drop-down list. For more information, see [Configure Role-Based Access Control (RBAC)](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/configure-role-based-access-control-rbac.md).

   3. From the **Select Role** drop-down list, select the user role.
      > The role determines which features the user can access in IDaaS. The default setting is **No Role Assigned**. For more information, see [Create, assign, and manage roles](/docs/people-and-access/manage-members/create-assign-and-manage-roles.md).

6. If applicable, under **Required Attributes**, on the line below each required attribute, enter the value for the attribute. For more information on attributes, see [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

7. Under **Optional User Attributes**, add the details for the attribute. For example, if you add an optional user attribute called Alternate Email for OTP delivery, enter the alternate email address in the attribute field.

8. If you want to add unique attributes applicable only to the specific user, for example, a user has three mobile devices with different numbers and you want OTP to be delivered to all three numbers, you can add the required attribute, as follows:

   1. Under **Optional Attributes**, click **Add**. The optional attribute dialog box appears.
   2. Enter a **Name** for the attribute.
   3. Enter a **Value** for the attribute, for example the mobile number for SMS OTP delivery.
   4. Select **Use this attribute for OTP delivery** if you want the attribute to be used for OTP delivery by SMS, Voice, or Email.
   5. If you select **Use this attribute for OTP delivery**, select the OTP delivery option (SMS, voice, or email) from the drop-down list.
   6. Click **OK**.

9. Optional. Add **Aliases** to allow the user to log in using their User ID or an alias.

   1. Under **Aliases**, click **Add**. The **Add Alias** dialog box appears.
   2. In the **Add Alias** field, enter the alias.
   3. Click **OK**.
   4. Repeat these steps to add another alias.

note

- All aliases must be unique in the system.
- An alias must not be the same as a User ID in the system.
- You can add up to 10 aliases.

10. Click **Save**.

## Synchronize users from a directory

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.

2. Click Circle Plus icon. A drop-down list appears.

3. Select **Sync from directory**. The **Sync User** dialog box appears.

4. In the **User ID** field, enter the User ID of the user in the Active Directory.

note
This value depends on the **User ID Attribute Mapping** that is configured in the directory configuration. See [Manage directories](/docs/identity-providers.md).

5. Select the **Directory** from the drop-down list. This is the directory from which the user is synchronized.

6. Click **Sync**.

### Synchronize IDaaS users with a directory

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.

2. Click Refresh CW icon next to the user you want to synchronize with a directory. The **Sync User** dialog box appears.

note
To synchronize a user, the user must already exist in the directory.

3. Select the **Directory** from the drop-down list.

4. Click **Sync**. The user is synchronized with the directory.

note
Depending on the **User Desynchronization Policy** of the directory, the user may be deleted upon being synchronized. See [Manage directories](/docs/identity-providers.md) for more information.