# Users

> Users in Cloud Management Platform (CMP) belong to groups and are granted roles that determine what they can see and do

---

Site [llms.txt](/llms.txt)

---

Administrators can create users, add them to groups, and assign roles. Users can be created directly in CMP or synced from an external authentication system such as [LDAP](/docs/cmp/configure/access-and-security/users/ldap-authentication/) or [SSO](/docs/cmp/configure/access-and-security/users/sso-saml/).

To view or manage users, go to **Admin** > **Users**. The list shows each user's global roles, state, and last login. Select a user's email address to open their profile, where you can edit their group and role assignments, as well as their permissions.

## Users, groups, and roles

| Term | Description |
| --- | --- |
| **Users** | People who can log in to CMP, created directly in CMP or synced from an external system such as LDAP or SSO. |
| **Groups** | Contain users and are associated with environments. |
| **Group roles** | Grant users certain privileges for the environments associated with a group.<br>**Example:** a user who is a requestor in a group called Finance Dept can request servers in all environments that the group can access. |
| **Special roles** | Automatically grant permissions to users who meet specific criteria for an object (for example, Server Owner). They are not shown on the group or user details page. |
| **Global roles** | Grant users platform-wide privileges (such as Super Admin). |

The permissions granted by roles can include built-in CMP functionality (such as *server.control_power*) as well as server actions and resource actions, granted individually or in bulk. For the full model, see [Groups, roles, and permissions](/docs/cmp/configure/access-and-security/groups-roles-permissions/).

---

Section pages:

- [Create a user](/docs/cmp/configure/access-and-security/users/create-a-user/): Create users in Cloud Management Platform (CMP) and manage their passwords and email verification
- [Grant users access to OneFuse](/docs/cmp/configure/access-and-security/users/onefuse-access/): Enable Cloud Management Platform (CMP) users to access OneFuse
- [Single sign-on and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/): Let users log in to Cloud Management Platform (CMP) through your organization's single sign-on (SSO) identity provider, using SAML
- [LDAP authentication](/docs/cmp/configure/access-and-security/users/ldap-authentication/): Connect Cloud Management Platform (CMP) to an LDAP or Active Directory server so that users can log in with their directory credentials