The **Users** module manages the end users of the selected environment — the people who sign in to *your* application, not your console team. The page header reads **"Users"** with the subtitle _"Manage your users in this view for the selected environment."_

![Users](/content/console/users.explore.png)

Three actions sit in the top-right of every tab:

| Action | Does |
|--------|------|
| **Invite user** | Sends an invitation email; the recipient completes signup themselves. |
| **Import Users** | Bulk-imports users, for migrating off another provider. |
| **Create user** | Creates a user directly, with an email and optional password. |

> **Warning**
>
> Users are scoped per environment. A user created in `dev` does not exist in
> `prod`. Import or invite separately per environment.

The rail on the left holds six tabs.

## Analytics

`?tab=usersAnalytics` — the growth and composition view, over a selectable window (default: Last 90 days).

**User growth** plots cumulative users as a line or bar chart, with four headline counters: **Total users**, **Active**, **MFA enabled**, and **Providers**.

Two breakdown cards sit beside it:

- **Sign-in providers** — count and share per provider, so you can see which methods people actually use.
- **Status & security** — Active users, Inactive users, and MFA-enabled users, each with a count and percentage.

The MFA number is the one worth watching: it tells you whether an optional MFA rollout is landing before you consider enforcing it.

## Explore

`?tab=explore` — the user table, titled _"Explore and manage users in this environment."_

Filter with the free-text search field plus **All statuses** and **All providers** dropdowns. Columns are Username, Email, Status, MFA, Provider, Last Login, and Created; the sortable ones carry sort arrows.

Each row has an expand chevron for inline detail and a **"⋯"** menu for per-user actions. Tick the checkboxes to enable **Selection actions** for bulk operations. Paging controls at the bottom set results per page.

Clicking through to a user opens their detail page at `/dashboard/users/{id}`, where you can edit their profile, metadata, role and group assignments, and sessions.

## Waitlist

`?tab=waitlist` — _"People who tried to sign up while your project is in waitlist mode."_

The table lists Email, Status, Source, Joined at, and Invited at. Entries only appear when the sign-up mode is set to **Waitlist** in [Authentication > Restrictions](/docs/console/authentication), or when waitlist mode is toggled on in the Settings tab below. Approve an entry to convert it into a real user and send them an invitation.

## Provisioning

`?tab=provisioning` — inbound directory sync, with **SCIM** and **HRIS** sub-tabs.

### SCIM

The **SCIM Base URL** is the same for every tenant:

```
https://api.authdog.com/v1/scim/v2
```

The environment is resolved from the bearer token, not from the URL — so you paste this one URL into your identity provider and let the token do the scoping.

**Bearer Tokens** are the credentials your IdP uses to authenticate SCIM requests. Click **"Generate token"** to mint one. The token value is shown once at creation.

**Group → Role Mapping** auto-assigns an Authdog role when an IdP group is provisioned. Each rule matches on **Group name** and maps to a **Role**; members inherit that role's permissions on group sync. **"Re-apply to existing groups"** backfills rules against groups that were provisioned before the rule existed.

### HRIS

Mirrors SCIM for HR systems, provisioning **Employees** and **Departments** rather than users and groups, with its own token list.

> **Caution**
>
> Generated SCIM and HRIS tokens are shown once. Store them in your IdP
> immediately; if lost, revoke and generate a new one.

## Escalation

`?tab=escalation` — time-boxed user impersonation, titled _"Request escalation"_: _"Grant a support operator time-boxed permission to impersonate a user. The impersonation session cannot outlive the granted window."_

Fill in the form to create a grant:

| Field | Details |
|-------|---------|
| **Escalation type** | `Impersonation`. |
| **Duration (minutes)** | How long the grant stays valid. |
| **Actor** | The console user who may impersonate. |
| **Target** | The end user to impersonate. |
| **Reason** | Optional free text, retained in audit history. |

**Escalation grants** below lists active and past grants with Actor, Target, Duration, Status, Expires, and actions.

Impersonation must also be enabled for the environment — see the Settings tab and [Authentication > Features](/docs/console/authentication). Every grant, start, and revoke is recorded as a `USER_IMPERSONATION_*` audit event.

> **Caution**
>
> Impersonation lets an operator act as a real user. Keep durations short,
> require a reason, and review grants in [Audit](/docs/console/audit).

For self-service, approval-gated elevation of *console* privileges rather than user impersonation, see [Elevate](/docs/console/elevate).

## Settings

`?tab=settings` — the environment's account and sign-in policy, in four cards.

### General Security Settings

_"Configure authentication methods and account policies."_

| Toggle | Effect |
|--------|--------|
| **Authentication with Email OTP** | Sign-in using a one-time code sent by email. |
| **Authentication with Email/Password** | Sign-up and sign-in with a password; the password policy is enforced. |
| **Enable MFA with Authenticator App** | Time-based one-time codes (TOTP). |
| **Allow user to delete their account** | Exposes account deletion in your UI. |
| **Enable user impersonation** | Lets admins sign in as a user to troubleshoot. |
| **Prevent account enumeration** | Hides whether an email is already registered during sign-up. |

### Registration & sign-in

| Toggle | Effect |
|--------|--------|
| **Enable user registration** | Off means only existing users can sign in. |
| **Require signup for first login** | Off lets a first-time sign-in create the account automatically. |
| **Email verification required** | Users must verify their email before accessing the app. |
| **Waitlist mode** | New users land in the [waitlist](#waitlist) pending approval. |
| **Refresh Identity on signin** | Forces a refresh of user identity and claims at each sign-in. |

**Sessions** in the same card sets **Allow concurrent sessions** (multiple devices at once) and **Session timeout (minutes)** for idle invalidation.

### Multi-Factor Authentication

_"Configure MFA availability, enforcement, and verification methods."_

**MFA available to users** lets users opt in from their profile; **Enforce MFA for all users** requires setup on first login. The methods you can offer are **Authenticator application** (TOTP), **Passkey**, and **Backup codes**.

### Permission Model

Shows the active authorization model for the environment — RBAC by default — with a link across to [Authorization](/docs/console/authorization), which is where the model is actually changed.

## Related

| Read | To learn how to |
|------|-----------------|
| [Authentication](/docs/console/authentication) | Configure sign-in methods, providers, and policies |
| [Authorization](/docs/console/authorization) | Assign roles, groups, and permissions to users |
| [Audit](/docs/console/audit) | Review user lifecycle and impersonation events |
| [Elevate](/docs/console/elevate) | Grant just-in-time console privileges with approval |
| [Provisioning](/docs/concepts/provisioning) | Understand SCIM and HRIS directory sync |