> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siftstack.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage user access

> Invite users, manage their status, and organize them into groups to control access to Sift.

Control who has access to Sift and what they can do by inviting users, organizing them into groups, and assigning roles that define their permissions.

## Before you begin

* You have an **Admin** role. Only Admins can invite, deactivate, and reactivate users.

## How user management works

Access in Sift is controlled through groups. Each user belongs to one or more groups, and each group is assigned a role that determines what its members can do. Users with email addresses matching any of the organization's configured domains are added automatically during sign-up. Users outside all configured domains must be manually invited and assigned to a group.

<Note>
  Organizations can be configured to allow more than one email domain (for example, when a company is acquired and employees use a new email address). To add an additional allowed domain to your organization, contact Sift support.
</Note>

Only users with the **Admin** role can invite, deactivate, and reactivate user accounts. Deactivating a user account automatically deactivates all API keys associated with that user.

To manage permissions for users, Sift uses authorization models. By default, [Role-Based Access Control (RBAC)](/documentation/reference/manage/authorization-models-settings#role-based-access-control-rbac) controls access through the groups you create in Sift. For more granular control, [Data Access Governance (DAG)](/documentation/reference/manage/authorization-models-settings#data-access-governance-dag) can be configured to further restrict access within the boundaries set by RBAC. To set up DAG, see [Set up Data Access Governance (DAG)](/documentation/manage/set-up-data-access-governance).

## Invite a user

1. Click your profile icon.
2. Select **Manage**.
3. Click **Users**.
4. Click **Invite User**.
5. In the **Email** box, enter the user's email address.
6. In the **Group** list, assign the user to a group.
7. Click **Send Invite**.

## Deactivate a user

1. Click your profile icon.
2. Select **Manage**.
3. In the **Users** table, find the row corresponding to the user you want to deactivate.
4. In that row, click <Icon icon="ellipsis-vertical" /> **Menu**.
5. Select **Deactivate**.

## Reactivate a user

1. Click your profile icon.
2. Select **Manage**.
3. Click **Show Inactive**.
4. In the **Users** table, find the row corresponding to the user you want to reactivate.
5. In that row, click <Icon icon="ellipsis-vertical" /> **Menu**.
6. Select **Activate**.

## Create a group

1. Click your profile icon.
2. Select **Manage**.
3. Click the **Groups** tab.
4. Click **Create Group**.
5. In the **Group name** box, enter a name for the group.
6. In the **Role** list, select a [role](/documentation/reference/manage/user-management-settings#group-roles) for the group.
7. Optional: Click the **All Assets** toggle to the off position to restrict the group's access to a defined subset of [Assets](/documentation/reference/manage/user-management-settings#groups).
8. Click **Create**.

## Reference

* [User Management settings](/documentation/reference/manage/user-management-settings)