Manage cloud users

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/security/01_cloud_access_management/02_manage-cloud-users.md)

This guide is intended for users with the Admin role in ClickHouse Cloud.

## Add users to your organization[​](#add-users "Direct link to Add users to your organization")

### Invite users[​](#invite-users "Direct link to Invite users")

Administrators may invite multiple users at a time and assign one or more roles at the time of invitation.

Access organization settings and select Users and roles

### Access organization settings and select Users and roles[​](#users-and-roles-1 "Direct link to Access organization settings and select Users and roles")

From the services page, select the name of your organization. Select the `Users and roles` menu item from the popup menu.

Select 'Invite members' in the upper left corner

### Select 'Invite members' in the upper left corner[​](#invite-members "Direct link to Select 'Invite members' in the upper left corner")

Click the `Invite members` button in the upper left corner.

Enter the email address of new members and assign roles

### Enter the email address of new members and assign roles[​](#add-email-and-roles "Direct link to Enter the email address of new members and assign roles")

Enter email addresses at the top of the invitation screen. Select one or more roles to assign the users.

Click

### Click `Send invites`[​](#send-invites "Direct link to send-invites")

Click `Send invites` at the bottom of the screen. Users will receive an email from which they can join the organization. For more information on accepting invitations, see [Manage my account](/docs/cloud/security/manage-my-account).

### Add users via SAML identity provider[​](#add-users-via-saml "Direct link to Add users via SAML identity provider")

Enterprise plan feature

SAML SSO is available in the Enterprise plan. To upgrade, visit the plans page in the cloud console.

If your organization is configured for [SAML SSO](/docs/cloud/security/saml-setup), follow these steps to add users to your organization.

1. Add users to your SAML application in your identity provider. The users won't appear in ClickHouse until they have logged in once.
2. When the user logs in to ClickHouse Cloud, they will automatically be assigned the default role selected in your SAML configuration.
3. Follow the instructions in the `Manage user role assignments` below to grant permissions

### Enforcing SAML-only authentication[​](#enforce-saml "Direct link to Enforcing SAML-only authentication")

Once you have at least one SAML user in the organization assigned to the Admin role, remove users with other authentication methods from the organization to enforce SAML only authentication for the organization.

## Manage user role assignments[​](#manage-role-assignments "Direct link to Manage user role assignments")

Users assigned the Admin role may update permissions for other users at any time.

Access organization settings and select Users and roles

### Access organization settings and select Users and roles[​](#users-and-roles-2 "Direct link to Access organization settings and select Users and roles")

From the services page, select the name of your organization. Select the `Users and roles` menu item from the popup menu.

Select the user to update and select Edit

### Select the user to update and select Edit[​](#select-user-to-update "Direct link to Select the user to update and select Edit")

Select the menu item at the end of the row for the user that you wish to modify access for. Select `edit` from the popup menu.

Update permissions

### Update permissions[​](#update-permissions "Direct link to Update permissions")

Click in the `Roles` box to expand the menu. Select the check boxes to add or remove roles from the user. Refer to [Console roles and permissions](/docs/cloud/security/console-roles) for a listing of roles and associated permissions.

Save your changes

### Save your changes[​](#save-changes "Direct link to Save your changes")

Save your changes with the `Save changes` button at the bottom of the tab.

## Remove a user[​](#remove-user "Direct link to Remove a user")

Remove SAML users

SAML users that have been unassigned from the ClickHouse application in your identity provider aren't able to log in to ClickHouse Cloud. The account isn't removed from the console and will need to be manually removed.

Follow the steps below to remove a user.

1. Select the organization name in the lower left corner
2. Click `Users and roles`
3. Click the three dots next to the user's name and select `Remove`
4. Confirm the action by clicking the `Remove user` button

- [Add users to your organization](#add-users)
  - [Invite users](#invite-users)- [Access organization settings and select Users and roles](#users-and-roles-1)- [Select 'Invite members' in the upper left corner](#invite-members)- [Enter the email address of new members and assign roles](#add-email-and-roles)- [Click `Send invites`](#send-invites)- [Add users via SAML identity provider](#add-users-via-saml)- [Enforcing SAML-only authentication](#enforce-saml)- [Manage user role assignments](#manage-role-assignments)
    - [Access organization settings and select Users and roles](#users-and-roles-2)- [Select the user to update and select Edit](#select-user-to-update)- [Update permissions](#update-permissions)- [Save your changes](#save-changes)- [Remove a user](#remove-user)

Was this page helpful?