> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Manage Users
> Detailed guide to how to add, manage and delete users in Truefoundry
Users can be added manually to a tenant or in an automated way by setting up Single Sign-On (SSO) with your Identity Provider (IdP). This page explains how users are provisioned, invited, assigned roles, deactivated, and deleted.
We recommend setting up SSO since its more secure and also makes it easier to
manage users. You can setup SSO with your Identity Provider (IdP) by reading
[SSO Overview](/docs/sso).
## User provisioning
The dedicated **Provisioning** settings page and the SCIM, JIT, and Invite-only provisioning modes described below are available starting from **v0.143**. On earlier versions, SCIM is configured inline in the SSO form. See the [Identity and Access Revamp announcement](/docs/change-announcements/identity-and-access-revamp-v0.143) for migration details.
User provisioning controls how user accounts are created and removed in a TrueFoundry tenant. Provisioning is configured per tenant, so each tenant can have its own SSO and provisioning settings.
Go to **Settings > Security & Access > Provisioning** to configure the provisioning mode.
TrueFoundry supports three provisioning modes:
| Mode | What it does | Best for |
| ---------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **SCIM** | Your IdP syncs users and groups into TrueFoundry automatically. Deprovisioning is also handled by your IdP. | Organizations that want the IdP to be the source of truth for user and group lifecycle. |
| **Just-in-time (JIT)** | TrueFoundry creates a user dynamically the first time a valid token is received from your IdP. | Organizations that use SSO but do not want to configure SCIM sync. |
| **Invite-only** | Admins manually invite users to the tenant. | External collaborators, early rollouts, or tenants where every user should be approved manually. |
Provisioning creates or controls TrueFoundry user accounts. It is separate from [Identity Providers](/docs/platform/identity-providers), which validate externally issued JWTs for API and gateway access.
### Capability matrix
| Capability | SCIM | JIT | Invite-only |
| ---------------------------------------- | ------------------ | ----------------------- | ----------- |
| Create users automatically | Yes, from IdP sync | Yes, on first SSO login | No |
| Deactivate or remove users automatically | Yes, from IdP sync | No | No |
| Sync groups or teams automatically | Yes | No | No |
| Requires SSO | Recommended | Yes | No |
| Requires admin invite | No | No | Yes |
| Best suited for external collaborators | No | No | Yes |
### Configure a provisioning mode
Each tenant uses exactly one provisioning mode at a time. Pick the tab below that matches the mode you've selected on the **Provisioning** page.
TrueFoundry supports [SCIM (System for Cross-domain Identity Management)](https://scim.cloud/) to automatically create, update, and deactivate users and groups from your identity provider. SCIM is available for both OIDC and SAML v2 SSO configurations.
SCIM enables automatic lifecycle management for both **users** and **teams**. Adding or removing a user in your IdP adds or removes the corresponding user in TrueFoundry, and IdP groups are synced as TrueFoundry teams. For team-specific behavior and the group name convention, see [Provision teams via SCIM](/docs/platform/team-management#provision-teams-via-scim).
Turn on **SCIM** under **Settings > Security & Access > Provisioning**.
After saving your SSO configuration, expand the SSO configuration to view the SCIM URL along with other metadata. Copy this URL for your identity provider's SCIM settings.
Click the **key icon** next to your SSO configuration to generate and copy the SCIM authentication token.
Store this token securely. You need it to authenticate SCIM requests from your identity provider.
In your identity provider's SCIM provisioning settings:
* Set the **SCIM Base URL** to the SCIM URL from TrueFoundry.
* Set the **Authentication** method to Bearer Token.
* Use the SCIM token as the Bearer token value.
Make sure IdP group names follow the naming rules described in [Provision teams via SCIM](/docs/platform/team-management#provision-teams-via-scim) so that they sync as valid TrueFoundry teams.
Use **Just-in-time (JIT)** provisioning when you want TrueFoundry to create users dynamically at login. When a user signs in with SSO and TrueFoundry receives a valid token from your IdP, TrueFoundry creates the user if they do not already exist.
Users see a button like `Login with Google|Azure|Okta|Keycloak` depending on the IdP you have set up.
JIT is useful when your IdP is the source of truth for authentication, but you do not want to configure SCIM user sync.
JIT requires SSO to be enforced. Otherwise, users who are not yet present in TrueFoundry can still be added manually or invited depending on your tenant settings.
Use **Invite-only** when admins should explicitly control who can join the tenant. In this mode, admins invite users from **Access > Users**. This is useful for external collaborators, early rollouts, or tenants where access should be granted manually instead of automatically from the IdP.
## Manage users
If you use Invite-only provisioning, or you want to invite users who are not part of your IdP, use the **Invite User** button on the **Access > Users** page. You need to enter the email of the user you want to add.
While inviting users manually, there is a checkbox for `Send email to set
password`. If you check this checkbox, the user will receive an email with a
link to set their password. You should not check this box if you want the user
to sign in via SSO - since no password needs to be set in that case.
Admins can deactivate a user's account. This will prevent the user from logging in to the platform. This can be useful if you do not want to delete the user's account, but just want to deactivate them temporarily.
Admins can delete a user's account that are no longer part of your organization. This will remove the user account from the list of users and will not affect any resources created by the user.
Before deleting the user, you MUST remove the user explicitly from all
resources and teams, otherwise the system will not allow the deletion.
This is needed only if you are managing users manually and have not set up SSO.
**Admins** can initiate a password reset process for a user. This will send an email to the user with a link to reset their password.
* Looking for how to assign **Admin** or **Member** roles to a user? See [Assign a role to a user](/docs/platform/manage-user-roles-and-permissions#assign-a-role-to-a-user).
* Looking for how to create or revoke **Personal Access Tokens (PATs)** for a user? See [API Keys — Personal Access Tokens (PATs)](/docs/generating-truefoundry-api-keys#personal-access-tokens-pats).
## Manage users programmatically
Admins can manage users programmatically using APIs. See the complete API reference [here](https://docs.truefoundry.com/api-reference/users/list-users).