> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/identities.md).

# Manage identities

Create, find, change the state of, entitle and delegate administration of users — and shape the forms and rules that govern how identities are captured.

## What this is, and when you need it

A user record is OpenIAM's single statement that a person exists. Everything else in the product hangs off it: the accounts that person holds on managed systems, the roles and groups that entitle them, the credentials they sign in with, the requests they raise, the reviews they appear in, and the audit trail of every change to any of it. That is why almost every administrative task starts by finding one person, and why an error on this object travels further than an error anywhere else — a wrong status or a wrong user type reaches every managed system the next time provisioning runs.

This section covers the user record and everything an administrator does to it: creation, search, state changes, entitlements, accounts on managed systems, delegation, bulk change, the forms users are captured on, self-registration, and conversion between user types.

A **service account** — what is increasingly called a machine identity or a non-human identity — is a user record like any other in OpenIAM, distinguished by its user type rather than by a separate object, so everything on these pages applies to it.

It assumes the vocabulary in [The OpenIAM object model](/administration-guide/start/object-model.md) — in particular the distinction between a **user** (`USERS`) and an **identity** (`LOGIN`), because most surprising behaviour in this section comes from confusing the two.

## Choose your outcome

| I want to…                                                                                                                 | Go to                                                                                                                   |
| -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Add a person                                                                                                               | [Create a user](/administration-guide/identities/create-a-user.md)                                                      |
| Find one person among many, or work out why search cannot find them                                                        | [Find a user](/administration-guide/identities/find-a-user.md)                                                          |
| Deactivate, delete, enable, disable, activate, terminate, mark deceased, or put someone on leave — now or on a future date | [Run a user lifecycle action](/administration-guide/identities/user-lifecycle-actions.md)                               |
| Grant or revoke a role, group, resource or organization on one person                                                      | [Grant and revoke access](/administration-guide/identities/grant-and-revoke-access.md)                                  |
| Offboard a leaver, and find out which parts of it the product does not automate                                            | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md)                                    |
| Work out why one person cannot sign in                                                                                     | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md)                                               |
| Link somebody's privileged or non-production second account to them                                                        | [Manage related accounts](/administration-guide/identities/related-accounts.md)                                         |
| Resolve the accounts a reconciliation found on a managed system with no user behind them                                   | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md)                                  |
| Let a manager or help desk administer only their own population                                                            | [Scope a delegated administrator](/administration-guide/identities/delegated-administration.md)                         |
| Change hundreds of users, or hundreds of entitlements, at once                                                             | [Change many users at once](/administration-guide/identities/bulk-operations.md)                                        |
| Add a field to the user form, reorder it, make it conditional, or validate it in Groovy                                    | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md)                           |
| Give one audience its own SelfService page for a slice of the user record                                                  | [Add a custom user page to SelfService](/administration-guide/identities/add-a-selfservice-user-page.md)                |
| Let people register themselves, with or without a sponsor and an approval                                                  | [Configure self-registration](/administration-guide/identities/self-registration.md)                                    |
| Convert a contractor into an employee, or merge two records during that conversion                                         | [Convert a user's type](/administration-guide/identities/convert-a-user-type.md)                                        |
| Look up a page-template field type, a data-model binding or a validation contract                                          | [Page template reference](/administration-guide/identities/page-templates-and-custom-fields/page-template-reference.md) |
| Look up a lifecycle menu item, its audit action, or one of the 21 user statuses                                            | [User lifecycle reference](/administration-guide/reference/user-lifecycle-reference.md)                                 |

## Start here

If you are new to this section, read it in this order: [Create a user](/administration-guide/identities/create-a-user.md), [Find a user](/administration-guide/identities/find-a-user.md), [Grant and revoke access](/administration-guide/identities/grant-and-revoke-access.md), [Run a user lifecycle action](/administration-guide/identities/user-lifecycle-actions.md). Everything else in the table above is a specialisation of one of those four.

## Four things that decide how this section behaves

**Every action is separately entitleable.** The buttons on a user record are `MENU_ITEM` resources in `RES`, members of `USER_INFO_PAGE` and `USER_ENTITLEMENTS_PAGE` through `res_to_res_membership`. A missing button is a missing grant with a name. [User lifecycle reference](/administration-guide/reference/user-lifecycle-reference.md) lists all eleven lifecycle menu items with their resource IDs, the audit action each one records and the status it leaves behind.

**There are two creation paths, and they are different routes.** `/webconsole/new-user-template` renders the template-driven form; `/webconsole/newUser` renders the classic full form. They honour different configuration, so a field you configured can be absent from the one you happen to be on. See [Create a user](/administration-guide/identities/create-a-user.md).

**Status changes are asynchronous and effective-dateable.** A lifecycle action reports success as soon as the provisioning request is queued, not once the managed systems have changed. A future-dated action does not queue anything at all — it parks the user in a `PENDING_*` status for a batch task to pick up, and that batch task ships disabled. See [Run a user lifecycle action](/administration-guide/identities/user-lifecycle-actions.md).

**Search is served from an index, not from `USERS`.** The user search screen and the orphan screen read OpenSearch indexes (`users`, `orphan`). **A record that is correct when you open it directly and absent from search means the index, not the data** — that asymmetry is the whole diagnosis, and the repair is [Rebuild a search index](/administration-guide/operations/rebuild-a-search-index.md). It is the single most common "OpenIAM has lost my user" report, and it is not a data problem.

## Before you change anything

[Change configuration safely](/administration-guide/start/change-safely.md) applies here as everywhere. Two risks are specific to identities and worth stating up front:

{% hint style="warning" %}
**`REMOVE_USER` is called "Delete" in the UI and is not a database delete.** The English display name for the `REMOVE_USER` menu item is `Delete`, and it drives a deprovisioning request that leaves the user at status `REMOVE`. The OpenIAM record survives; the accounts on the managed systems may not. Nothing in OpenIAM restores a target account it deleted.

**Bulk operations skip exactly two accounts and nothing else.** OpenIAM removes user IDs `0001` and `3001` from every bulk selection, whatever you selected. Any other account you select, including your own, is in scope. See [Change many users at once](/administration-guide/identities/bulk-operations.md).
{% endhint %}

## Related

* [The OpenIAM object model](/administration-guide/start/object-model.md) — users versus identities, and what an entitlement is
* [Connect applications and automate lifecycle](/administration-guide/lifecycle.md) — where the accounts these pages create actually land
* [Reference](/administration-guide/reference.md) — the enum values, properties and audit actions these pages cite

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/identities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.