## Invite new users

URL: https://docs.atlan.com/product/capabilities/governance/users-and-groups/how-tos/invite-new-users

> Invite new users to your Atlan workspace by email when SSO is not enforced, or provision them through your identity provider when SSO is enforced.

Add people to your Atlan workspace so they can sign in. How you do it depends on your authentication setup: email invites when SSO is not enforced, identity provider assignment when it is.

## Prerequisites

Before you invite users, make sure:

- You are an **admin** in Atlan. Members and guests cannot invite other users.
- You know which **[role](https://docs.atlan.com/llms/governance/access-control/delegate-administration/llms.txt)** each new user should have (Admin, Member, or Guest).
- You are using a non-disposable email address. Atlan blocks invitations to disposable email addresses (such as `mailinator.com` or `tempmail.com`).

:::info Usernames are permanent

Atlan uses usernames as a unique identifier across the platform and does not support changing them later. Ask each new user to choose their preferred username during their first login.

:::

## Invite users

The way you add new users depends on whether SSO is enforced for your workspace. Choose the tab that matches your setup.

### Without SSO

When SSO is not enforced, you invite users from the Atlan UI by entering their email address and assigning each one a role.

1. In Atlan, click **Settings** from the left menu to open the workspace settings.

 If you are using the old UI, click **Admin** from the left menu instead. Both lead to the same place.

2. Under _Workspace_, click **Users** to see the list of existing users, then click the **Invite Users** button in the top right.

3. Under _Invite users to Default_, enter one or more email addresses, and select a role for each user from the dropdown next to their email. The role you choose determines what each user can do once they sign in.

 For example:

 ```
 alex.carter@yourcompany.com - Member
 jordan.lee@yourcompany.com - Admin
 ```

4. Click the **Send Invite** button. Atlan emails each invited user a sign-up link valid for **7 days**. If a link expires before the user signs up, return to the same _Users_ page and resend the invitation.

To remove a user later, return to **Settings → Workspace → Users**, find the user in the list, and click **Remove**. To automatically deactivate users when they leave your identity provider, set up [User offboarding](https://docs.atlan.com/llms/governance/access-control/user-offboarding/llms.txt).

### With SSO

When SSO is **enforced** for your workspace, the **Invite Users** button in the Atlan UI is disabled. Instead, users come in through your identity provider (IdP) such as Okta, Azure AD, Google, or any SAML 2.0 provider. A user profile is created automatically on their first sign-in.

1. In your identity provider, open the **Atlan** application you configured during [SSO setup](https://docs.atlan.com/llms/governance/access-control/authentication-and-authorization/llms.txt). If you have not configured SSO yet, follow your provider's setup guide first: [Okta](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt), [Azure AD](https://docs.atlan.com/llms/governance/access-control/enable-azure-ad-for-sso/llms.txt), [Google](https://docs.atlan.com/llms/governance/access-control/enable-google-for-sso/llms.txt), [JumpCloud](https://docs.atlan.com/llms/governance/access-control/enable-jumpcloud-for-sso/llms.txt), [OneLogin](https://docs.atlan.com/llms/governance/access-control/enable-onelogin-for-sso/llms.txt), or [generic SAML 2.0](https://docs.atlan.com/llms/governance/access-control/enable-saml-2-0-for-sso/llms.txt).

2. Assign the new user (or the IdP group that contains them) to the Atlan application. The exact steps depend on your IdP, so refer to your provider's documentation for the assignment flow.

3. Ask the new user to sign in to Atlan with their SSO credentials. On their first sign-in, Atlan automatically creates a user profile for them. You do not need to send a manual invite.

:::info Control the default role for SSO-provisioned users

By default, new SSO-provisioned users are assigned the **Member** role. To change this, see [Set default user roles for SSO](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt).

For fully automated user lifecycle management (provisioning, updates, and deprovisioning), set up [SCIM provisioning](https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/configure-scim-provisioning) alongside SSO.

:::

## Need help?

If you have any issues while inviting users, contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) for assistance.

## Next steps

- [Assign roles](https://docs.atlan.com/llms/governance/access-control/add-and-manage-users/llms.txt): Give each new user the role that sets what they can do.
- [Organize teams in groups](https://docs.atlan.com/llms/governance/access-control/manage-groups/llms.txt): Bundle users so you can assign access in bulk.

---