> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-user-management.md).

# SSO User Management

## Overview

When Enterprise SSO is enabled, user accounts from your identity provider appear in <code class="expression">space.vars.product\_acronym</code> after the user's first SSO login. These SSO users are managed differently from local users, and the **Settings > Tenants and Users > Users** page reflects this separation.

## Local Users and SSO Users Tabs

The Users page organizes users into two tabs:

| Tab             | Who appears here                                                                      | Available actions                            |
| --------------- | ------------------------------------------------------------------------------------- | -------------------------------------------- |
| **Local Users** | Users created directly in <code class="expression">space.vars.product\_acronym</code> | Edit, Enable, Disable, Delete, Manage Quotas |
| **SSO Users**   | Users who have authenticated via your enterprise identity provider                    | Manage Quotas only                           |

**Why SSO users have restricted actions:** SSO user accounts are owned by your identity provider. Editing, enabling, disabling, or deleting them through <code class="expression">space.vars.product\_acronym</code> is not supported because those changes must be made in the identity provider. Deprovisioning an SSO user requires removing or disabling the account in your IdP; the next time that user attempts to log in, access will be denied.

## Managing Quotas for SSO Users

You can manage resource quotas for SSO users from the **SSO Users** tab, the same way you manage quotas for local users:

1. Navigate to **Settings > Tenants and Users > Users**.
2. Select the **SSO Users** tab.
3. Select the user.
4. Choose **Manage Quotas**.
5. Adjust the quota values and select **Save**.

## Tenant Membership for SSO Users

SSO users are not listed in the user selection when creating or editing a tenant. Tenant membership for SSO users is controlled through SAML group mappings:

1. Navigate to **Settings > Enterprise SSO > SAML Groups**.
2. Create or edit a SAML group mapping.
3. Under **Tenants & Roles**, assign the tenant and role for members of that IdP group.

When an SSO user logs in, <code class="expression">space.vars.product\_acronym</code> evaluates the SAML group mappings and assigns tenant membership and roles based on the user's IdP group membership. See [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md) for how role inheritance from SAML groups works.

## Related Pages

* [Enterprise SSO](/private-cloud-director/identity-and-multi-tenancy/enterprise-sso.md): overview of SSO setup and supported identity providers
* [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md): how roles are assigned via SAML group mappings
* [SSO Troubleshooting Guide](/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-troubleshooting.md): diagnosing login failures and authorization issues


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/enterprise-sso/sso-user-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.