## 6.1.3.5.7 Managing Users and Their Authorizations Using the btp CLI
User authorizations are managed by assigning role collections to users (for example, Subaccount Administrator). Use the SAP BTP command-line interface (btp CLI) to manage roles and role collections, and to assign role collections to users.
##  Tip
All of these commands can be executed in the global account, a directory, or in a subaccount. To choose the level, use the btp target command. See Set a Target for Subsequent Commands with btp target [page 2425].
## Managing Users and Assigning Role Collections
Role collections are user-related authorizations that allow access to resources and services. You give users permissions by assigning role collections to them. All users in the global accounts, directories, and subaccounts are stored in identity providers, either in the default or in a custom identity provider. When the first role collection assignment to a user happens, SAP BTP creates a copy of this user in the global account, directory, or subaccount. This copy of the user is called shadow user.
When you do the first role collection assignment to a user through the btp CLI, such a shadow user is created by default. If you want to prevent this, you need to pass the --create-user-if-missing parameter with value false .
See Role Collections and Roles in Global Accounts, Directories, and Subaccounts [page 125] and User and Member Management [page 121].
| Task                                                                       | Run the command ...                   | Command help                            |
|----------------------------------------------------------------------------|---------------------------------------|-----------------------------------------|
| List users                                                                 | btp list security/user                | btp list secur- ity/user                |
| Get details about a specific user, including role collections              | btp get security/user                 | btp get secur- ity/user                 |
| Delete a user                                                              | btp delete security/user              | btp delete se- curity/user              |
| Assign a role collection to a user, user group, or to an attribute         | btp assign security/role-collection   | btp assign se- curity/role-col- lection |
| Unassign a role collection from a user, user group, or from an at- tribute | btp unassign security/role-collection | btp unassign security/role- collection  |
## Managing Roles
A role is an instance of a role template; you can build a role based on a role template and assign the role to a role collection. See Add Roles to Role Collections on the Application Level [page 2370].
| Task                                       | Run the command ...                                                               | Command help               |
|--------------------------------------------|-----------------------------------------------------------------------------------|----------------------------|
| List apps                                  | btp list security/app                                                             | btp list secur- ity/app    |
| Get details about a specific appli- cation | btp get security/app To get the ID of a specific app, run btp list security/app . | btp get secur- ity/app     |
| List roles                                 | btp list security/role                                                            | btp list secur- ity/role   |
| Get details about a specific role          | btp get security/role                                                             | btp get secur- ity/role    |
| Create a role                              | btp create security/role                                                          | btp create se- curity/role |
| Delete a role                              | btp delete security/role                                                          | btp delete se- curity/role |
| Add a role to a role collection            | btp add security/role                                                             | btp add secur- ity/role    |
| Remove a role from a role collec- tion     | btp remove security/role                                                          | btp remove se- curity/role |
## Managing Role Collections
Role collections consist of roles, which, in turn, are based on role templates. Role collections are specific to account entities, that is, there are different role collections in global accounts, subaccounts, and directories. There are predefined role collections, such as Global Account Administrator and Subaccount Viewer . For more information, see Role Collections and Roles in Global Accounts, Directories, and Subaccounts [page 125] and Working with Role Collections [page 2351].
| Task                                         | Run the command ...               | Command help                          |
|----------------------------------------------|-----------------------------------|---------------------------------------|
| List role collections                        | btp list security/role-collection | btp list secur- ity/role-collec- tion |
| Get details about a specific role collection | btp get security/role-collection  | btp get secur- ity/role-collec- tion  |
| Task                                        | Run the command ...                 | Command help                            |
|---------------------------------------------|-------------------------------------|-----------------------------------------|
| Create a role collection                    | btp create security/role-collection | btp create se- curity/role-col- lection |
| Change the description of a role collection | btp update security/role-collection | btp update se- curity/role-col- lection |
| Delete a role collection                    | btp delete security/role-collection | btp delete se- curity/role-col- lection |
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Signing Keys for Access Tokens [page 2447]
Managing Security Settings [page 2448]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
Security Administration: Managing Authentication and Authorization [page 2278]
Set a Target for Subsequent Commands with btp target [page 2425]
Role Collections and Roles in Global Accounts, Directories, and Subaccounts [page 125]
btp CLI Command Reference