# Users and groups

> Add users to the company, understand their protection status, assign administrators, export the directory to CSV, and organize groups and subgroups.

URL: https://docs.ironchip.com/en/identidad/administracion/usuarios-y-grupos/

In the users section you manage everyone registered on the platform: you can add users, assign them roles and permissions, control the protection of their accounts, and organize them into groups to grant access and permissions together.

## Users

### View the user list

In the admin console, inside **Directory**, click **Users** to see all the users of the company.

[Image: Side menu of the console with the Users option of Directory highlighted]

### Add a user

1. In **Directory > Users**, click **Add user**.

   [Image: User list with the Add user button highlighted]

2. In the window that opens, enter the details of the user: name (**Name**), surname (**Surname**), email address (**Email**), external email (**External email**), and preferred language (**Preferred language**).
3. Turn on **Send invitation** if you want to register the user in Ironchip.

   [Image: Add a new user window with the user details and the Send invitation switch]

4. Click **Add**, in the bottom right corner.

If you do not turn on **Send invitation**, the user is created but does not receive any Ironchip email to register. A red crossed-out shield appears in the protection column: the registration is incomplete. It is common to leave the switch off when users arrive through LDAP synchronization.

To complete the registration, the user must verify: the user receives a QR code by email and must scan it to be securely registered on the platform.

If you have many users, you can also add or update them automatically with [user synchronization](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/), which keeps the platform database up to date.

### Protection status

The **Protection** column of the list shows how far each user's registration has progressed:

| Shield | Meaning                                                                                                        |
| ------ | -------------------------------------------------------------------------------------------------------------- |
| Red    | The user has not completed the registration.                                                                   |
| Orange | The invitation was sent and the user received the email, but has not verified yet.                             |
| Green  | The user has verified and the registration is finished. The account is active and protected by Ironchip.       |
| Gray   | The account is disabled. See [how to enable it](https://docs.ironchip.com/en/identidad/administracion/dispositivos/#enable-an-account). |

[Image: Protection column of the user list with shields in different states]

The shield states follow this cycle:

```text
Red      Incomplete registration: the invitation has not been sent.
  ↓      The invitation is sent.
Orange   Invitation sent: the user has not verified yet.
  ↓      The user scans the QR code.
Green    Verified: the account is active and protected.

Gray     Disabled account. Enable Ironchip turns it back to green.
```

### Options for each user

The list shows, for each user:

- Their details: **User**, **Email** (the email address used to register), **External email**, **User Name**, **Sam Account Name**, and **ID**.
- **Protection**: the status of the account, that is, whether it is registered in Ironchip or not.
- **Options**: a dropdown with these actions:
  - **Add a device**: add a device.
  - **Recover account**: recover the account.
  - **Delete user**: delete the user.

[Image: Options dropdown of a user with Add a device, Recover account, and Delete user]

For the first two actions, see [Devices](https://docs.ironchip.com/en/identidad/administracion/dispositivos/).

### Assign an administrator

To assign an administrator, the user must already be registered on the platform. If not, [add the user](#add-a-user) first.

1. Go to the **Users** tab, inside the **Directory** folder.
2. Add the user to the **Ironchip Administrators** group. See [how to add users to a group](#add-users-to-a-group).

### Export the list to CSV

1. In **Directory > Users**, click **Export CSV**, to the left of **Add user**. The complete list of users of the company is downloaded.

   [Image: Export CSV button of the user list]

2. When the download finishes, click **Close** to close the export window.

   [Image: Export window with the Close button]

The CSV is useful for audits, periodic reviews of the directory, or for cross-checking the data with other systems (Active Directory, SCIM, etc.).

## Groups

Groups organize users hierarchically and speed up permission management: instead of assigning access user by user, you grant access to a whole group and every member inherits those permissions.

In **Directory > Groups** you see the groups created in the company. Two always exist:

- **All users**: includes every user registered on the platform. It cannot be modified or deleted.
- The administrators group (**Ironchip Administrators**): it can be modified but not deleted.

[Image: List of the company groups in Directory > Groups]

### Create a group

1. In **Groups**, click **Add group**, at the top right.

   [Image: Group list with the Add group button highlighted]

2. Enter the group name in **Group name**. In this same step you can turn on **Email invitation sending** to send the invitation by email to the users you add to the group.

   [Image: Add a new group window with the Group name field and the Email invitation sending switch]

3. Click **Add**.

### Add users to a group

The new group appears on the main screen with the rest of the groups, with the user counter at 0.

1. In the group row, click **Options** and then **Manage group**.

   [Image: New group with 0 members and the Options menu with the Manage group option]

2. On the group page, click **Add**.

   [Image: Group page with the Add button highlighted]

3. In the window that opens, select the users you want to add.

   [Image: Window with the list of users and their checkboxes to add them to the group]

4. Click **Add**. The console confirms that the users were added successfully.

   [Image: Users added successfully message]

### Subgroups

Subgroups are an essential part of user and permission management in Ironchip: they let you organize users hierarchically and manage rights and privileges more efficiently within your security structure.

To add a subgroup:

1. On the group page, open the **Child Groups** section and click **Add**. A window opens with the available groups.

   [Image: Window with the list of groups that can be added as subgroups]

2. Select the subgroups you want to add.
3. Click **Add** to confirm.

To remove a subgroup, select it in the same section and click **Delete**.

[Image: Child Groups section with a subgroup selected and the Delete button]