> For the complete documentation index, see [llms.txt](https://docs.certinext.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.certinext.io/documentation/user-roles-and-access-control/role-based-access-control/assigning-a-role-when-creating-a-new-user.md).
# Assigning a Role When Creating a New User
#### Who Can Create Users
Only the Administrator role can add new users to an account (permission: `settings.users.add`). Managers can invite users but cannot create them directly.
#### Before You Begin
Before adding a user, confirm you have the user's full name, their email address (which becomes their login ID), their mobile phone number (optional but recommended for two-factor authentication), the role you want to assign, and whether the user should be limited to specific groups.
#### Step-by-Step: Adding a New User
Log in to CERTInext as an Administrator. If your email is associated with more than one account, click Proceed next to the relevant account on the account-selection screen.
In the left-hand navigation menu, click Settings to expand it, then click Users & Roles. The Settings :: Users page opens, showing all existing users with their email addresses, roles, creation dates, and statuses. Confirm the new user does not already exist.
Click the **+ Create User** button in the top-right corner of the page. The Add User page opens.
Fill in each field as follows. In the **User Information** section, enter the user's full name as it should appear in the system, their work email address (they will receive an activation email here), their mobile number using the country dial code selector (optional), and their internal Employee ID if your organisation uses one.
In the **Group Access** section, leave the "Limit this user to access specific groups" checkbox unchecked to give the user account-wide access subject to their role's scope. Check it to limit the user to specific groups - additional group-selection controls appear when checked. This setting interacts with the group-level access scopes described later in this article. For example, a Manager role carries `view_all` scope for certificates by default. If you additionally check this option and select Group A only, that Manager will see all certificates within Group A but not those in Group B or Group C.
In the **Assign Role** section, click the radio button next to the desired role. Each option has an information icon - hover over it for a brief description of the role. Click **Save**.
CERTInext creates the user record, sets the status to "Pending for Activation", and sends an activation email to the address provided. The new user will not have access until they complete the activation process.
### How a New User Activates Their Account
After an Administrator creates a user account, the new user receives an activation email. They must follow the link in that email to set a password before they can log in. The activation experience varies depending on whether the user's email address is already registered in CERTInext.
**If the email address is brand new to the platform:** The user opens the activation email and clicks the activation link. On the password-setup screen, they enter a strong password in the New Password field, repeat it in Confirm Password, and click Save Password. When the passwords match and meet the platform's complexity requirements, the account activates and a "You're All Set!" confirmation screen appears. The user then clicks Login, enters their email and newly set password, and signs in.
**If the email address is already registered on another CERTInext account:** The activation link leads to a "Verify your identity to link this account" screen. The user enters their existing CERTInext password and clicks Authenticate. After a green "Account authenticated successfully" banner appears, they click Login and sign in normally. The new account now appears alongside their existing accounts in the account-selection screen.
After activation, the user's status in Settings > Users & Roles changes from "Pending for Activation" to "Active" immediately.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.certinext.io/documentation/user-roles-and-access-control/role-based-access-control/assigning-a-role-when-creating-a-new-user.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.