> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-user-management.md).

# SSO User Management

## Overview

When Enterprise SSO is enabled, user accounts from your identity provider appear in <code class="expression">space.vars.product\_acronym</code> after the user's first SSO login. These SSO users are managed differently from local users, and the **Settings > Tenants & Users > Users** page reflects this separation.

## Local Users and SSO Users Tabs

The Users page organizes users into two tabs:

| Tab             | Who appears here                                                                      | Available actions                            |
| --------------- | ------------------------------------------------------------------------------------- | -------------------------------------------- |
| **Local Users** | Users created directly in <code class="expression">space.vars.product\_acronym</code> | Edit, Enable, Disable, Delete, Manage Quotas |
| **SSO Users**   | Users who have authenticated via your enterprise identity provider                    | Manage Quotas only                           |

**Why SSO users have restricted actions:** SSO user accounts are owned by your identity provider. Editing, enabling, disabling, or deleting them through <code class="expression">space.vars.product\_acronym</code> is not supported because those changes must be made in the identity provider. Deprovisioning an SSO user requires removing or disabling the account in your IdP; the next time that user attempts to log in, access will be denied.

## Managing Quotas for SSO Users

You can manage resource quotas for SSO users from the **SSO Users** tab, the same way you manage quotas for local users:

1. Navigate to **Settings > Tenants & Users > Users**.
2. Select the **SSO Users** tab.
3. Select the user.
4. Choose **Manage Quotas**.
5. Adjust the quota values and select **Save**.

## Tenant Membership for SSO Users

SSO users are not listed in the user selection when creating or editing a tenant. Tenant membership for SSO users is controlled through SAML group mappings:

1. Navigate to **Settings > Enterprise SSO > SAML Groups**.
2. Create or edit a SAML group mapping.
3. Under **Tenants & Roles**, assign the tenant and role for members of that IdP group.

When an SSO user logs in, <code class="expression">space.vars.product\_acronym</code> evaluates the SAML group mappings and assigns tenant membership and roles based on the user's IdP group membership. See [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md) for how role inheritance from SAML groups works.

## Related Pages

* [Enterprise SSO](/private-cloud-director/identity-and-multi-tenancy/enterprise-sso.md): overview of SSO setup and supported identity providers
* [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md): how roles are assigned via SAML group mappings
* [SSO Troubleshooting Guide](/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-troubleshooting.md): diagnosing login failures and authorization issues


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-user-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.