# Manage users

Mosaic maintains a user record in the tenant and an application-specific account for each Mosaic application the user is registered with. You can manage the shared profile and the user's application associations centrally. A user who already exists in the tenant still needs to be registered with another application before accessing it. See [How users work](/guides/user/how_users_work#app-users).

You can manage users in the Admin Portal, using [Journeys](/guides/orchestration/concepts/journeys_overview), or via the [Users APIs](/openapi/user/user.openapi).

## View or search users

The **Users** page presents a list of all your users. For each user record, it displays the **profile verification status**, user identifiers (**user ID**, **email**, **phone number**, **external user ID**, and any custom identifiers), **last login**, and **apps** which the user can access. By default, the page shows the total user count and displays users organized according to the last login.

You can filter and count users through basic or advanced search, export search results in CSV format, and click a user to view the user's basic profile.

| ![user-basic-search](/assets/user-basic-search.76f32faf2419f5df1ade0fc00a062dc6eee2d4121880ee556ced42a9885002a7.2397ab79.gif) |
|  --- |


**Basic search** allows you to search users by tenant-level criteria like user status, email, phone number, etc. Custom identifiers are also searchable. 

**Advanced search** allows you to filter users based on query expressions structured according to the [SCIM protocol](/openapi/scim_search_syntax/#search-query-syntax). This functionality covers both built-in and custom attributes from Mosaic's proprietary [searchable fields](/openapi/scim_search_syntax/#searchable-fields).

Search results can be exported in CSV format. Upon user request, Mosaic generates the file and sends it to the email address used to log in to the portal.

For every search you launch, the total user count is adjusted based on the search results. Note that, for analytics purposes, you can retrieve user counts via API. For more see [Reporting and analytics](/guides/user/reporting_and_analytics).

## Create, edit, or delete users

You can manage your users from the **Users** page:

* Create a user by clicking **+ Add Users**, entering the user's email and/or phone number (at least one is required), and selecting which applications the user can access.
* Edit a user by clicking ![](/assets/action_icon.1ecac3af0cbb5a99cfdd0e9a3a7067f9df88a26acab052d3eced16c35ad4626a.9c1bb791.svg) and then **Edit user**.
* Delete a user by clicking ![](/assets/action_icon.1ecac3af0cbb5a99cfdd0e9a3a7067f9df88a26acab052d3eced16c35ad4626a.9c1bb791.svg) and then **Delete**. This is a soft delete. For what it removes, and how it differs from erasing user data or removing a user from an app, see [User lifecycle](/guides/user/user_lifecycle#delete-or-remove-a-user).


## Manage user profile

You can access a user profile from the **Users** page by clicking the relevant user in the table. These fields are displayed:

* **Personal info**:
  * **First Name**: The user's first name.
  * **Last Name**: The user's last name.
  * **Email**: The user's primary email.
  * **Secondary emails**: The user's secondary emails.
  * **Phone number**: The user's primary mobile number.
  * **Secondary phone numbers**: The user's secondary mobile numbers.
  * **Creation date**: The date the user record was created.
  * **Last login**: The date of the user's most recent login.
  * **Birthday**: The user's birthday.
  * **Language**: The user's preferred language.
* **Addresses**: The user's address: country, city, street address and type.
* **Custom attributes**: Tenant-specific attributes defined in the user schema.


These fields belong to the shared tenant-level user profile and can be edited in the Admin Portal. Application-specific fields, such as `external_account_id` and `custom_app_data`, belong to the user's account in a particular application. You can manage tenant-level and application-specific data through the [Users APIs](/openapi/user/user.openapi) or journeys, subject to the caller's permissions. To see the user schema, proceed to **Users** > **Edit Schema**.

The primary user's email and phone number can be modified in the Admin Portal or via the [Verification APIs](/openapi/user/verification.openapi)—in order to update these fields, the user has to complete the verification procedure. See [Update user's primary email and phone number](/guides/user/update_user_primary_email_phone)

Define custom attributes & identifiers
In addition to the built-in attributes, you can define **custom attributes** to extend the user schema in your tenant. This is useful when your customer-facing application needs to store domain-specific user data (e.g., loyalty tier or preferred store location), or when you want to support authentication flows with domain-specific identifiers (e.g., account number). For more about setting custom attributes and identifiers see our [Customize user schema](/guides/user/manage_user_schema) article.

## Manage user status

Change a user's status by clicking ![](/assets/action_icon.1ecac3af0cbb5a99cfdd0e9a3a7067f9df88a26acab052d3eced16c35ad4626a.9c1bb791.svg) and then selecting the required status. The available options depend on the user's current status:

* If the user is **Active** or **Pending**, you can select **Suspend user**.
* If the user is **Suspended**, you can select **Activate user**.


For what each status means and when it changes, see [User lifecycle](/guides/user/user_lifecycle).

## Manage user's apps

Users can only access the apps to which they have been assigned (see [App users](/guides/user/how_users_work/#app-users)). You can assign users to apps when you create the user via the Admin Portal. You can remove a user from specific apps by clicking ![](/assets/action_icon.1ecac3af0cbb5a99cfdd0e9a3a7067f9df88a26acab052d3eced16c35ad4626a.9c1bb791.svg) and then **Remove from apps**. Removing a user from an app does not delete the user. See [Remove a user from an app](/guides/user/user_lifecycle#remove-a-user-from-an-app).

Note
If the target Mosaic application's authentication flow allows user creation, it can register an existing tenant user with that application during login. Otherwise, register the user with the application before login. Having an account in another application does not by itself grant access or create a shared login session.

## Manage user's consents

You can review consents the user granted for each app by expanding app details in the user profile. The consent is granted for 30 days and is revoked after this period.

## Manage user groups

You can create groups and add users to the groups you created. This enables controlling which users have access to specific customer-facing application features using group membership. Like users, groups exist on the tenant level. To create and manage groups, see the relevant [APIs](/openapi/user/groups.openapi/other/creategroup).

## Manage user devices

You can check if there are devices registered for the user and linked to their user record. See [device management](/guides/user/how_devices_work) for details.

## Manage user authenticators

You can check and manage authenticators registered for the user and linked to their user record. See [Manage user authenticators](/guides/user/manage_authenticators) for details.

## Monitoring

View recommendations issued for the user and track their activity.