Before you begin
- An Admin or Super Admin account (the page is admin-only)
- The person's Entra sign-in email; people from another organization must already exist in your directory as Entra guests (see Add a Guest / External User)
Opening User Administration
In the sidebar, go to Administration → Tenants → User Administration. The page has two tabs: User Management (the list of users) and Roles (custom roles). Above the list, tiles show Total Users, Admins, Active and Pending; click one to filter the list. Accounts without admin access see an admin-required message instead.
What Add User does
Click Add User, enter the person's email (Atlas suggests matching people from your directory as you type), choose a role, and set Tenant Access. Operator is preselected. On submit, Atlas creates a pre-registered user record carrying that role. It shows as Pending until the person signs in for the first time, then becomes Active. Add User does not create an identity in Entra and does not email the user.
People from outside your organization can sign in only if they already exist in your Entra directory as guests. Invite them as Entra guests first; Atlas does not send guest invitations from this page.
Bulk adding users
Choose Bulk Add (from the list toolbar or the arrow beside Add User) and paste email addresses separated by new lines, commas, or semicolons, then pick one role for all of them. Invalid and duplicate lines are skipped, and addresses that already exist keep their current role. Reports Viewer and Read Only need a specific tenant for each person, so add those users one at a time.
Roles you can assign
The role picker offers Super Admin, Admin, Operator, Security Admin, Auditor, Help Desk, Billing Viewer, Reports Viewer, Read Only, and Portal User. Super Admin and Admin are marked High risk, and only a Super Admin can grant Super Admin. Portal User is for end users of the User Portal and cannot sign in to the admin console. The Role Reference card below the list summarises each role; for the full breakdown, see Add Users & Assign Roles.
A "Too many admins" banner appears when admins make up a large share of your users, suggesting you move some to Operator or Auditor.
Custom roles
On the Roles tab, Create role lets you name a role and pick exactly which permissions it grants, then Assign users to it. A user can hold one custom role at a time, and it replaces their built-in role's permissions (Admins keep full access). The users list shows the custom role under the user's role badge.
Managing existing users
Change a user's role from the role badge in their row. From the row's actions menu you can Edit tenant access, Disable access (sign-in stops immediately; the account is kept and can be re-enabled), Request data erasure (the account is disabled straight away and deleted on a scheduled date, after which the person's name, email and IP addresses are removed from the audit trail; you can cancel until then), or Remove user. Changing to or from Super Admin, Admin, Operator or Security Admin asks you to confirm. You cannot change your own role, or disable, erase or remove yourself. Every change is recorded in the audit log, and Export CSV downloads the list.
Tenant access
Each user has access to All Tenants (the default) or Specific Tenants that you tick. Reports Viewer and Read Only must always be limited to specific tenants, so All Tenants is unavailable for them; switching an existing user to one of these roles asks you to set their tenant access first. You can only grant access to tenants your organization manages.