> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/for-devops-and-administrators/manage/users-and-access.md).

# Manage users, groups, and access

Manage users, groups, roles, and vault access from a terminal with Devolutions CLI, and see which tasks each workspace type offers.

`devo admin` lets you look after the people and permissions of your workspace from a terminal or a script: list users, update an account, organize groups, and decide who can open a vault. Most of these tasks depend on the workspace type, so each table on this page has a WORKSPACE column. On Devolutions Cloud and Devolutions Server, a command the workspace doesn't offer stops with `operationNotSupportedBySource` and says which type you need. A local profile refuses with its own error code and a message that explains why.

## Before you start

* Sign in with an account that has administrator rights on the workspace. See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md) or [Sign in to Devolutions Server](/cli/guides/connect/devolutions-server.md).
* Check which workspace is selected with `devo status`. Add `--context <context-name>` to a command to run it on another one.
* Commands that change something need `--yes`. Without it, they change nothing and stop with `confirmationRequired`.
* Users and groups are selected by name by default. Write `id:<value>` or add `--id` to select by ID, and `email:<value>` or `--email` to select a user by email. In `devo admin group members add` and `remove`, the matching options are `--group-id`, `--user-id`, and `--user-email`.

## Users

<table><thead><tr><th width="230">TASK</th><th>COMMAND</th><th width="210">WORKSPACE</th></tr></thead><tbody><tr><td>List users, see one user</td><td><code>devo admin user list</code><br><code>devo admin user get "&#x3C;user>"</code></td><td>Devolutions Cloud, Devolutions Server, local profile (read only, when the profile allows it)</td></tr><tr><td>See the groups of a user</td><td><code>devo admin user groups list "&#x3C;user>"</code></td><td>Devolutions Cloud, local profile (read only, when the profile allows it)</td></tr><tr><td>Create a user</td><td><code>devo admin user create "&#x3C;login>" --email &#x3C;email> --password-env &#x3C;VARIABLE_NAME> --yes</code></td><td>Devolutions Server</td></tr><tr><td>Update a user</td><td><code>devo admin user update "&#x3C;user>" --enabled false --yes</code></td><td>Devolutions Cloud, Devolutions Server</td></tr><tr><td>Delete a user</td><td><code>devo admin user delete "&#x3C;user>" --yes</code></td><td>Devolutions Cloud, Devolutions Server</td></tr></tbody></table>

Some options of `devo admin user update` belong to one workspace type:

* **Devolutions Cloud only**: `--description`, `--locale`, `--workspace-access`, `--web-login`, and `--user-vaults`.
* **Devolutions Server only**: `--first-name`, `--last-name`, `--user-type`, `--password-env`, `--password-file`, and `--force-password-change`. On Devolutions Server, change a user's name with `--first-name` and `--last-name`: `--name` and `--display-name` aren't accepted.

You can't combine options of both types in one command.

On Devolutions Cloud, users synchronized from your organization's directory are managed by that directory. Devolutions CLI refuses to update or delete them.

{% hint style="info" %}
A new user's password is read from an environment variable (`--password-env`) or a file (`--password-file`), never from the command line, so it doesn't end up in your shell history.
{% endhint %}

## Groups

<table><thead><tr><th width="230">TASK</th><th>COMMAND</th><th width="210">WORKSPACE</th></tr></thead><tbody><tr><td>List groups, see one group and its members</td><td><code>devo admin group list</code><br><code>devo admin group get "&#x3C;group>"</code><br><code>devo admin group members list "&#x3C;group>"</code></td><td>Devolutions Cloud, local profile (read only, when the profile allows it)</td></tr><tr><td>Create, rename, or delete a group</td><td><code>devo admin group create "&#x3C;group>" --yes</code><br><code>devo admin group update "&#x3C;group>" --name "&#x3C;new-name>" --yes</code><br><code>devo admin group delete "&#x3C;group>" --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Add or remove a member</td><td><code>devo admin group members add "&#x3C;group>" "&#x3C;user>" --yes</code><br><code>devo admin group members remove "&#x3C;group>" "&#x3C;user>" --yes</code></td><td>Devolutions Cloud</td></tr></tbody></table>

Deleting a group also removes its assignments. Groups synchronized from your organization's directory can't be deleted.

## Roles and vault access

<table><thead><tr><th width="230">TASK</th><th>COMMAND</th><th width="210">WORKSPACE</th></tr></thead><tbody><tr><td>List roles</td><td><code>devo admin role list --scope vault</code> (or <code>--scope entry</code>)<br><code>devo admin role get &#x3C;role-id></code></td><td>Devolutions Cloud</td></tr><tr><td>See who can open a vault</td><td><code>devo vault access list "&#x3C;vault>"</code></td><td>Devolutions Cloud</td></tr><tr><td>Give a user or group access to a vault</td><td><code>devo vault access grant "&#x3C;vault>" --user "&#x3C;user>" --role Readers --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Remove a user's or group's access</td><td><code>devo vault access revoke "&#x3C;vault>" --group "&#x3C;group>" --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>See, give, or remove a role on one entry</td><td><code>devo entry access list --vault-id &#x3C;vault-id> --entry-id &#x3C;entry-id></code><br><code>devo entry access get --vault-id &#x3C;vault-id> --entry-id &#x3C;entry-id> --user-id &#x3C;user-id></code><br><code>devo entry access grant --vault-id &#x3C;vault-id> --entry-id &#x3C;entry-id> --user-id &#x3C;user-id> --role-id &#x3C;role-id> --yes</code><br><code>devo entry access revoke --vault-id &#x3C;vault-id> --entry-id &#x3C;entry-id> --group-id &#x3C;group-id> --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>See the direct permissions of an entry</td><td><code>devo entry permission get "&#x3C;entry>"</code></td><td>Devolutions Cloud, local profile (when the profile allows it)</td></tr><tr><td>List permission sets</td><td><code>devo admin access permission-sets</code></td><td>Devolutions Server</td></tr></tbody></table>

`--role` accepts a role name or ID: `Restricted`, `Readers`, `PrivilegedReaders`, `Operators`, `PrivilegedOperators`, `Contributors`, or `VaultOwners`. Each grant or revoke works on a single user (`--user`) or group (`--group`).

On a local profile, `devo admin role list` and `devo admin access permission-sets` aren't available: role lists are for Devolutions Cloud, and permission sets for Devolutions Server.

## Devolutions Cloud only

<table><thead><tr><th width="230">TASK</th><th>COMMAND</th><th width="210">WORKSPACE</th></tr></thead><tbody><tr><td>Review and clean up invitations</td><td><code>devo admin invitation list</code><br><code>devo admin invitation get --invitation-id &#x3C;invitation-id></code><br><code>devo admin invitation remove-email --id &#x3C;invitation-id> --email &#x3C;email> --yes</code><br><code>devo admin invitation delete --id &#x3C;invitation-id> --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Manage system permissions</td><td><code>devo admin access system list</code><br><code>devo admin access system get --user-id &#x3C;user-id></code><br><code>devo admin access system grant --user-id &#x3C;user-id> --permission &#x3C;permission> --yes</code><br><code>devo admin access system revoke --group-id &#x3C;group-id> --permission &#x3C;permission> --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Manage system vault roles</td><td><code>devo admin access system-vault list</code><br><code>devo admin access system-vault get --user-id &#x3C;user-id></code><br><code>devo admin access system-vault grant --user-id &#x3C;user-id> --role-id &#x3C;role-id> --yes</code><br><code>devo admin access system-vault revoke --group-id &#x3C;group-id> --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Review or remove Devolutions Gateway instances</td><td><code>devo admin gateway list</code><br><code>devo admin gateway get --gateway-id &#x3C;gateway-id></code><br><code>devo admin gateway settings get</code><br><code>devo admin gateway delete --gateway-id &#x3C;gateway-id> --yes</code><br><br>The results never include the gateways' secrets.</td><td>Devolutions Cloud</td></tr><tr><td>See or change the organization owner</td><td><code>devo admin owner get</code><br><code>devo admin owner set --user-id &#x3C;user-id> --yes</code></td><td>Devolutions Cloud</td></tr><tr><td>Review or change system settings</td><td><code>devo admin settings get</code><br><code>devo admin settings update --force-two-factor-authentication --yes</code></td><td>Devolutions Cloud</td></tr></tbody></table>

{% hint style="danger" %}
`devo admin access system revoke` without `--permission` removes **all** system permissions of the user or group. `devo admin owner set` hands the organization to another user. Double-check the IDs before you add `--yes`.
{% endhint %}

## Devolutions Server only

<table><thead><tr><th width="230">TASK</th><th>COMMAND</th><th width="210">WORKSPACE</th></tr></thead><tbody><tr><td>Restore or purge deleted users</td><td><code>devo admin user trash list</code><br><code>devo admin user trash restore id:&#x3C;user-id> --yes</code><br><code>devo admin user trash purge id:&#x3C;user-id> --yes</code></td><td>Devolutions Server</td></tr><tr><td>Preconfigure a user's two-factor method</td><td><code>devo admin user 2fa set --user-security-id &#x3C;id> --type google-authenticator --yes</code><br><code>devo admin user 2fa clear --user-security-id &#x3C;id> --yes</code></td><td>Devolutions Server</td></tr><tr><td>Inspect Active Directory domains</td><td><code>devo admin domain list</code><br><code>devo admin domain users --domain &#x3C;domain-name></code></td><td>Devolutions Server</td></tr><tr><td>Review or change authentication settings</td><td><code>devo admin settings auth-modes get</code><br><code>devo admin settings auth-modes set --domain true --azure-ad false --yes</code><br><code>devo admin settings two-factor get</code><br><br><code>auth-modes set</code> turns domain, Azure AD, and custom authentication (<code>--custom</code>) on or off with <code>true</code> or <code>false</code>. Options you leave out keep their value. Devolutions CLI refuses a change that would leave no primary authentication mode turned on.</td><td>Devolutions Server</td></tr><tr><td>Review and register licenses</td><td><code>devo admin license list</code><br><code>devo admin license users list --serial-env &#x3C;VARIABLE_NAME></code><br><code>devo admin license register --serial-env &#x3C;VARIABLE_NAME> --yes</code><br><code>devo admin license trial start --yes</code><br><br>The serial or license JWT comes from an environment variable (<code>--serial-env</code>) or a file (<code>--serial-file</code>), never from the command line. <code>license list</code> shows serials partly hidden. Add <code>--replace</code> to replace the existing licenses, and <code>--auto-assign true</code> to assign supported licenses to new users automatically.</td><td>Devolutions Server</td></tr><tr><td>Review privileged access</td><td><code>devo admin pam account list</code><br><code>devo admin pam provider list</code><br><code>devo admin pam provider get --provider-id &#x3C;provider-id></code><br><br><code>pam account list</code> returns 100 accounts per page by default (<code>--page</code>, <code>--page-size</code> up to 500), optionally for one folder (<code>--vault-id</code>). The results don't include passwords.</td><td>Devolutions Server</td></tr><tr><td>Publish Devolutions Gateway revocation lists</td><td><code>devo admin gateway revocation-list publish --yes</code><br><br>Add <code>--gateway-id &#x3C;gateway-id></code> to publish the list of one gateway only.</td><td>Devolutions Server</td></tr></tbody></table>

Devolutions Server selects deleted users by ID only, and `devo admin user trash list` takes no name filter there. `devo admin domain list` doesn't show the domain's bind secrets.

{% hint style="danger" %}
`devo admin user trash purge` deletes the user permanently. It can't be undone.
{% endhint %}

## Good to know

* Every `devo admin` command, with all its options, is in the [command reference](/cli/reference/commands.md).
* Add `--output json` to feed the results to a script. See [Read results as JSON](/cli/for-devops-and-administrators/automate/json-output.md).
* A command says the workspace doesn't support it? See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## Next

* [Review activity logs](/cli/for-devops-and-administrators/manage/logs.md)
* [Manage vaults and entries](/cli/for-devops-and-administrators/manage/vaults-and-entries.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/for-devops-and-administrators/manage/users-and-access.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.