# Users & Accounts

Accounts organize your data; Users control who can access it.

## Accounts

An Account groups related data — Security Groups, API Keys, Forms — into a logical unit: a project, a department, a client, or any other boundary that makes sense for how you run Sentinel.

**Creating an account.** Admins create new accounts, then assign Users to them (see below).

**Configuration:**

- **Default Accounts** — automatically assign newly created users (added manually or via SSO) to one or more accounts.
- **Status** — setting an account to inactive suspends all of its API Keys and Forms.
- **Features** — selectively disable Alerts, Logs, Forms, Redirects, or Training Data per account; disabled features return `403` on any attempt to use them.

## Users

Sentinel is a multi-user application built for team collaboration. Each user has a role, assigned **per account**:

- **Admin** — full access to that account's data.
- **Member** — read and limited write access, but only to Forms, Redirects, and Training Data.
- **Read-only** — view-only access to Forms, Redirects, and Training Data.

### Role permissions

| | Admin | Member | Read-only |
|---|---|---|---|
| Security Groups | Full access | No access | No access |
| API Keys | Full access | No access | No access |
| Alerts | Full access | No access | No access |
| Logs | Full access | No access | No access |
| Dashboard | Full access | Limited* | Limited* |
| Forms | Full access | Full access | Read-only |
| Redirects | Full access | Full access | Read-only |
| Training Data | Full access | Full access | Read-only |
| Users, Accounts, Threat Intelligence | No access | No access | No access |

\* Limited dashboard access restricts filtering options, such as which API key's data you can view.

> **Note:**
>
> Managing **Users**, **Accounts**, and **Threat Intelligence** requires **Root** privileges regardless of role — even an Admin can't access these without Root.

### Adding a user

1. Go to **Admin → Users → Create User**.
2. Enter a unique username.
3. Optionally enable **Root** privileges.
4. Set a password.
5. Select which accounts the user should access, and assign their role for each.
6. Confirm to create the user.

## Multi-factor authentication (MFA)

Each user can enable MFA independently:

1. Log in and open the user menu (top-right).
2. Select **Enable MFA**.
3. Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, and Okta Verify are all supported.
4. Verify with a one-time code, then confirm.

Enabling MFA logs the user out for the change to take effect. If a user loses access to their authenticator device, an administrator can disable MFA for them from User Management.

## JWT tokens

Users authenticate with a JWT stored in a secure cookie. If a user's device is compromised, invalidate their existing sessions from the Users admin panel: open the user's **More** menu and select **Invalidate JWT**. This regenerates the user's `jwtVersion` value, which immediately invalidates every JWT issued to them so far — they'll need to log in again.

## SSO

For centralizing login through your identity provider instead of managing passwords in Sentinel directly, see [SSO](/docs/sentinel/security/sso/).