# User Support Guide

Learn about customer support operations on users in the FusionAuth Admin UI.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

This guide provides step-by-step instructions for basic operations in the FusionAuth Admin UI for individuals who support end users (e.g. a customer service representative resetting a password).

This guide also contains information about customizing Admin UI forms for developers who build tools for customer service representatives.

## Add a Support User

To add a support user:

1.  Follow the instructions in the [Add a New User](#add-a-new-user) section below to create a support user account.
2.  As a user with the `user_manager` role, follow the instructions in the [Assign a Role to an Existing User](#assign-a-role-to-an-existing-user) section, assigning the support user account the `user_support_viewer` or `user_support_manager` role.
3.  The support user should now be able to access the Admin UI with the appropriate privileges.

### Support User Roles

Support users are likely to be assigned one of the following roles:

*   `user_support_viewer`: Can view user information in the Admin UI, but cannot make any changes.
*   `user_support_manager`: A special role tuned for tier 1 technical support personnel with a mix of capabilities, including reading user information and writing non-admin user information.

Tip

For more information about roles in FusionAuth, see [roles](https://fusionauth.io/docs/get-started/core-concepts/types/roles.md#fusionauth-admin-ui-roles).

### Privilege Escalation

Caution

Prefer the `user_support_manager` role to the `user_manager` role to avoid undesired privilege escalation.

If you grant someone the `user_manager` role, they can then create a user, set the user's email address and password, and grant that user the `admin` or any other FusionAuth role. They could then log in as that user and have `admin` privileges.

This is working as designed, as the `user_manager` role provides full control of all users. Read more about this design choice in this [GitHub issue](https://github.com/FusionAuth/fusionauth-issues/issues/2170).

To prevent this escalation, use the `user_support_manager` role, which can add users, but cannot register a user for the FusionAuth admin application.

## Add A New User

To add a user, you need one of the following roles:

*   `user_manager`
*   `user_support_manager`
*   `admin`

1.  Log in to the Admin UI using your admin credentials and select Users from the left sidebar of the dashboard.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/users-tab.png)
    
2.  Click on the green plus icon to open the **Add User** form:
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/new-user-form.png)
    
3.  Complete the fields for the new user. You can choose to set the user's password or let the user set their own password by toggling the Send email to set up password button.
    
4.  Click on the save icon in the top right corner to create the user.
    

## Send A Password Reset

Use the Password Reset operation to help an end user regain access to their account.

1.  Log in to the Admin UI.
    
2.  Navigate to Users and search for the user whose password needs to be reset.
    
3.  Click on the user icon to open the user's details page.
    
4.  Click on the down arrow next to the Edit user button to open a dropdown with user management options.
    
5.  Select Send password reset to send password reset instructions to the end user by email.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/send-password-reset.png)
    
6.  Confirm the password reset by clicking Submit in the popup.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/confirm-reset.png)
    

## Require A Password Change

You might need a user to change their password for security reasons without sending a password reset email. You can use this feature to require the user to change their password the next time they log in.

1.  Log in to the Admin UI.
    
2.  Navigate to Users and search for the user whose password needs to be changed.
    
3.  Click on the user icon to open the user's details page.
    
4.  Click on the down arrow next to the Edit user button to open a dropdown with user management options.
    
5.  Select Require password change from the dropdown.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/require-password-change.png)
    
6.  Click Submit in the **Confirm require password change** popup.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/confirm-change.png)
    

## Verify User Information

You might need to verify a user's information for security purposes or to ensure up-to-date user data.

1.  Log in to the Admin UI.
    
2.  Navigate to Users and search for the user whose information needs to be updated.
    
3.  Click on the user icon to open the user's details page.
    
4.  Here you can view user information such as **Email** address, **Mobile Phone** number, **Birthdate**, and **Username**.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/verify.png)
    
5.  To update the information, click the Edit user button to open the Edit User form.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/edit-user.png)
    
6.  To save your changes, click the save icon.
    

## Log A User Out

You might need to log a user out of their account for security reasons, following a data breach, or to perform system maintenance.

1.  Log in to the Admin UI using your admin credentials.
    
2.  Navigate to Users and search for the user who needs to be logged out.
    
3.  Click on the user icon to open the user's details page.
    
4.  Select the Sessions tab to view the user's current sessions.
    
5.  Click on the trash icon to delete a single session or Delete all sessions to clear all the user's sessions and the user will be logged out.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/sessions.png)
    

## Delete A User

Caution

The Delete user action is destructive and cannot be reversed. Instead, FusionAuth recommends that you [Lock](#lock-a-user-account) (deactivate) the user, which is not destructive and can be reversed.

1.  Log in to the Admin UI.
2.  Navigate to Users and search for the user whose account needs to be locked.
3.  Click on the user icon to open the user's details page.
4.  Click on the down arrow next to the Edit user button to open a dropdown with user management options.
5.  Select Delete account .
6.  Click Submit in the "Confirm delete account" dialog.

## Lock a User Account

You might need to lock a user account for security or troubleshooting purposes.

1.  Log in to the Admin UI.
    
2.  Navigate to Users and search for the user whose account needs to be locked.
    
3.  Click on the user icon to open the user's details page.
    
4.  Click on the down arrow next to the Edit user button to open a dropdown with user management options.
    
5.  Select Lock account .
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/lock-account.png)
    
6.  Click Submit in the **Confirm lock account** dialog.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/confirm-lock.png)
    

## Unlock a User Account

To unlock a locked account:

1.  Click on the down arrow next to the Edit user button to open a dropdown with user management options.
    
2.  select Unlock account .
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/unlock-account.png)
    
3.  Click Submit in the **Confirm unlock** dialog.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/confirm-unlock.png)
    

## Assign a Role to an Existing User

To assign a role to an existing user, you need one of the following roles:

*   `user_manager`
*   `admin`

1.  On the Users page, search for the user you will assign the role to and click on the user icon in the action column to open the user details page.
    
2.  Scroll down and click the **Add registration** button.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/add-registration.png)
    
3.  Select an **Application** if you have configured multiple applications.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/select-application.png)
    
4.  On the Add User Registration page, scroll down to the **Roles**. Select the role to assign to the user, in this case, **User support manager (user\_support\_manager)**.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/roles.png)
    
5.  To assign the new roles to the user, click the save icon.
    

## Add a Comment

You can use User Comments to take notes on Users.

1.  Log in to the FusionAuth admin UI using your admin credentials.
    
2.  Navigate to Users and search for the user you want to leave a comment on.
    
3.  Click on the user icon to open the user's details page.
    
4.  Click on the down arrow next to the Edit user button to open a dropdown with user management action options.
    
5.  Select the Add a comment option.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/add-comment.png)
    
6.  Add your comment to the **Comment** field and click Submit to save. Previously added comments can be viewed under the History tab on the User details page.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/write-comment.png)
    

## Remove a User Action

You can remove a user action using the following steps:

1.  Log in to the FusionAuth admin UI using your admin credentials.
    
2.  Navigate to Users and search for the user you want to remove the action on.
    
3.  Click on the user icon to open the user's details page.
    
4.  Select the Current actions tab to view the user's current actions.
    
5.  To cancel a user action click on the red X cancel action icon.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/remove-user-action.png)
    
6.  Confirm you want to cancel the action by clicking Submit on the **Confirm cancellation** dialog and optionally leave a **Comment**.
    
    ![image](https://fusionauth.io/img/docs/operate/deploy/confirm-action-cancellation.png)
    

## Remove an MFA Method with the `mfa_deleter` Role

If your support team needs to remove a user's MFA method without requiring the user's one-time code, assign the `mfa_deleter` role.

This role allows support personnel to remove a user's MFA method from the Users -> Manage User -> Multi-Factor tab by clicking the disable button and confirming removal.

### Guardrails for `mfa_deleter`

FusionAuth applies additional safeguards to this role:

*   The target user cannot be registered to the FusionAuth admin application.
*   The target user must be notifiable through at least one verified primary identity and a configured tenant template:
    *   verified email + `tenant.emailConfiguration.adminTwoFactorMethodRemoveEmailTemplateId`
    *   verified phone number + `tenant.phoneConfiguration.adminTwoFactorMethodRemoveTemplateId`

If these conditions are not met, MFA removal is blocked in the Admin UI.

Caution

Do not combine `mfa_deleter` with roles that can modify tenant configuration (for example, `email_template_manager`, `message_template_manager`, `tenant_manager`). A user who can both remove MFA methods and change tenant notification templates can weaken these safeguards.

## Customize Admin UI Forms

> **PLAN:** This feature requires [at least a Starter plan](https://fusionauth.io/docs/get-started/core-concepts/plans-features.md#starter-features).

To customize forms, you need the `form_manager` role.

You can customize the forms and fields used in the Admin UI or the [Form APIs](https://fusionauth.io/docs/apis/custom-forms/forms.md).

### Customize User Form

This form is what you see when you are adding or editing a user in the admin UI. This is configurable at the Tenant level.

If you need to capture and validate custom data, you can do so by creating a form field, by navigating to Customizations -> Form Fields . You should create any needed fields before you create a form. Otherwise you can use the standard form fields.

Create a form, by navigating to Customizations -> Forms . Select Admin User as the type. Add the needed sections and fields.

You should modify your theme to add labels for these custom fields for proper display in the admin UI. For example, if you added a field stored in `user.data.favoriteColor`, you'd add the following key to the messages file of your theme to add a label of `Favorite Color` to the field in the admin UI.

```plaintext
user.data.favoriteColor=Favorite Color
```

This field is not localizable, so you'll only need to modify the default messages file. [Learn more about modifying the messages file in your theme](https://fusionauth.io/docs/theme/localization.md#messages).

You can also add a tooltip by adding a related key to the messages file:

```plaintext
{tooltip}user.data.favoriteColor=A user's favorite color. This is used to generate a custom logo with the correct color scheme.
```

Configure the FusionAuth admin UI to use these forms by navigating to Tenants -> Your Tenant -> General and then to the Form settings section. Set the **Admin user form** field to your new form.

Learn more in the [Tenant documentation](https://fusionauth.io/docs/get-started/core-concepts/types/tenants.md#general).

### Customize Registration Form

This form is what you see when you are adding or editing a user registration to an application using the admin UI. This is configurable at the Application level.

If you need to capture and validate custom data, you can do so by creating a form field, by navigating to Customizations -> Form Fields . You should create any needed fields before you create a form. Otherwise you can use the standard form fields.

Create a form, by navigating to Customizations -> Forms . Select Admin Registration as the type. Add the needed sections and fields.

You should modify your theme to add labels for these custom fields for proper display in the admin UI. For example, if you added a field stored in `registration.data.backgroundColor`, you'd add the following key to the messages file of your theme to add a label of `Desired Background Color` to the field in the admin UI.

```plaintext
registration.data.backgroundColor=Desired Background Color
```

You can also add a tooltip by adding a related key to the messages file:

```plaintext
{tooltip}registration.data.backgroundColor=The desired background color. This will be used in the application and should be a hex code.
```

This field is not localizable, so you'll only need to modify the default messages file. [Learn more about modifying the messages file in your theme](https://fusionauth.io/docs/theme/localization.md#messages).

Then, configure the FusionAuth admin UI to use these forms by navigating to Applications -> Your Application -> Registration and then to the Form settings section. Set the **Admin Registration** field to your new form.

Learn more in the [Application documentation](https://fusionauth.io/docs/get-started/core-concepts/types/applications.md#registration).

## User Management Outside of the Admin UI

If you want to create your own customer user support forms because custom Admin UI forms don't meet your needs, you can use the [APIs](https://fusionauth.io/docs/apis.md) or one of the [Client Libraries](https://fusionauth.io/docs/sdks.md) to build any workflow you desire.

For instance, suppose you wanted to take the following actions in one screen:

1.  Create a user
2.  Add them to a group
3.  Verify their identity against an external database
4.  Register them to an application with a role based on their identity
5.  Ensure they had first name, last name and favorite color set

In this case, a custom form built against the FusionAuth APIs is the best path forward. The Admin UI, while flexible, is not capable of this level of customization.

Related

[APIs Change a User's Password API API documentation for the FusionAuth Change a User's Password API. user managementpassword reset](https://fusionauth.io/docs/apis/users/change-password.md)

[APIs User Action API Learn about the APIs for invoking a User Action on a User. user management](https://fusionauth.io/docs/apis/actioning-users.md)

[APIs User Action Reason API Learn about the APIs for creating, retrieving, updating and deleting user action reasons. user management](https://fusionauth.io/docs/apis/user-action-reasons.md)

[APIs Create a User Action API API documentation for the FusionAuth Create a User Action API. user management](https://fusionauth.io/docs/apis/user-actions/create-a-user-action.md)
---

## Other pages in Operate

> For the full index of this section, see [Operate](https://fusionauth.io/docs/llms-operate.txt).

- [FusionAuth CLI](https://fusionauth.io/docs/operate/cli.md): Learn about the FusionAuth CLI tool.
- [Deploy](https://fusionauth.io/docs/operate/deploy.md): Learn how to manage FusionAuth configuration changes over time.
- [Monitor](https://fusionauth.io/docs/operate/monitor.md): Understand how your FusionAuth instance operates through logs, alerts, and measurements.
- [Secure](https://fusionauth.io/docs/operate/secure.md): Learn how to secure your installation by limiting network traffic.
- [Technical Support](https://fusionauth.io/docs/operate/technical-support.md): Learn how you can get technical support for FusionAuth.
- [Troubleshooting](https://fusionauth.io/docs/operate/troubleshooting.md): Learn how to troubleshoot issues that might arise while install or running FusionAuth.