> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/admin-users-and-groups.md).

# Administration: users and groups

Every option of the devo admin commands that manage users, groups, invitations, the organization owner and Active Directory domains, with defaults.

This page describes every `devo admin` command that manages people: users, deleted users, two-factor authentication, user groups, invitations, the organization owner, and Active Directory domains. Most of these commands work with one workspace type only: Devolutions Cloud, Devolutions Server, or a local profile. The **Workspace** line under each command says where it works. A command run on a workspace type it doesn't support stops with `operationNotSupportedBySource` and names the type you need.

For the list of all commands, see [Commands](/cli/reference/commands.md). For step-by-step tasks, see [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md). The options every command accepts, such as `--context` or `--output json`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here.

{% hint style="info" %}
**Selecting a user or a group.** Commands that take a `<user>` or `<group>` argument read it as a name. Write `id:<value>` or add `--id` to pass an ID, and `name:<value>` to force a name. Some user commands also accept `email:<value>` or `--email`. Commands that change something refuse to run without `--yes` (aliases `-y` and `--confirmed`) and stop with `confirmationRequired`.
{% endhint %}

## devo admin user list

Lists the users of the selected workspace. Alias: `devo admin user ls`.

**Workspace:** All workspace types. A local profile lists users only when the profile contains them.

```bash
devo admin user list
```

This command has no options of its own.

## devo admin user get

Shows one user, selected by name, email, or ID.

**Workspace:** All workspace types. A local profile shows users only when the profile contains them.

```bash
devo admin user get <user> [--id | --email]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user to show: a user name by default. Write <code>id:&#x3C;value></code> for an ID, <code>email:&#x3C;value></code> for an email or login email, or <code>name:&#x3C;value></code> to force a name.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--email</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as an email or login email.</td></tr></tbody></table>

## devo admin user create

Creates a user on Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin user create <name> [--email <email>] [--password-env <variable> | --password-file <path>] [--first-name <name>] [--last-name <name>] [--authentication <type>] [--user-type <type>] [--administrator] [--disabled] [--force-password-change] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. User name (login) of the new user. It can't be empty.</td></tr><tr><td><code>--email &#x3C;email></code></td><td></td><td>Email address of the user.</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Name of the environment variable that holds the initial password. Use this option or <code>--password-file</code>, not both. A password is required when <code>--authentication</code> is <code>builtin</code> (the default), and it can't be empty. Line breaks at the end of the value are removed.</td></tr><tr><td><code>--password-file &#x3C;path></code></td><td></td><td>File that holds the initial password. Use this option or <code>--password-env</code>, not both.</td></tr><tr><td><code>--first-name &#x3C;name></code></td><td></td><td>First name of the user.</td></tr><tr><td><code>--last-name &#x3C;name></code></td><td></td><td>Last name of the user.</td></tr><tr><td><code>--authentication &#x3C;type></code></td><td><code>builtin</code></td><td>How the user signs in: <code>builtin</code> (Devolutions Server account; <code>custom</code> and <code>devolutions</code> are accepted too), <code>domain</code> (Active Directory; <code>ad</code> and <code>active-directory</code> are accepted too), or <code>azure-ad</code> (Microsoft Entra ID; <code>azuread</code>, <code>entra-id</code>, and <code>entraid</code> are accepted too). For <code>domain</code> and <code>azure-ad</code>, the password is optional.</td></tr><tr><td><code>--user-type &#x3C;type></code></td><td><code>user</code></td><td>Type of user: <code>admin</code> (or <code>administrator</code>), <code>user</code>, <code>restricted</code>, or <code>read-only</code> (or <code>readonly</code>). When you leave it out, the type is <code>admin</code> if you add <code>--administrator</code>, otherwise <code>user</code>.</td></tr><tr><td><code>--administrator</code></td><td>Off</td><td>Creates an administrator. Same as <code>--user-type admin</code>; ignored when you also pass <code>--user-type</code>.</td></tr><tr><td><code>--disabled</code></td><td>Off</td><td>Creates the user disabled. Without it, the user is enabled.</td></tr><tr><td><code>--force-password-change</code></td><td>Off</td><td>Makes the user change the password at the next sign-in.</td></tr><tr><td><code>--display-name &#x3C;name></code></td><td></td><td>Not accepted by Devolutions Server: the command stops with <code>operationNotSupportedBySource</code>. Use <code>--first-name</code> and <code>--last-name</code>.</td></tr><tr><td><code>--login-email &#x3C;email></code></td><td></td><td>Not accepted by Devolutions Server: the command stops with <code>operationNotSupportedBySource</code>. Use <code>--email</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

## devo admin user update

Changes a user. Options you leave out keep their current value, and you must pass at least one change. Some options belong to one workspace type: you can't combine Devolutions Cloud options with Devolutions Server options in one command, and an option the selected workspace doesn't accept stops the command with `operationNotSupportedBySource`.

**Workspace:** Devolutions Cloud, Devolutions Server.

```bash
devo admin user update <user> [--id] [options] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user to change: a user name by default, or <code>id:&#x3C;value></code>. The user must match exactly one account.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--name &#x3C;name></code></td><td></td><td>New user name. On Devolutions Cloud, <code>--name</code> and <code>--display-name</code> both change the user's name: pass only one of them. Not accepted by Devolutions Server: use <code>--first-name</code> and <code>--last-name</code>.</td></tr><tr><td><code>--display-name &#x3C;name></code></td><td></td><td>New display name. On Devolutions Cloud, it changes the user's name, like <code>--name</code>. Not accepted by Devolutions Server: use <code>--first-name</code> and <code>--last-name</code>.</td></tr><tr><td><code>--email &#x3C;email></code></td><td></td><td>New email address. On Devolutions Cloud, pass a valid email address.</td></tr><tr><td><code>--login-email &#x3C;email></code></td><td></td><td>New login email. Not accepted by Devolutions Cloud or Devolutions Server.</td></tr><tr><td><code>--administrator &#x3C;true|false></code></td><td></td><td>Makes the user an administrator (<code>true</code>) or not (<code>false</code>). On Devolutions Server, <code>true</code> sets the user type to <code>admin</code> and <code>false</code> to <code>user</code>, unless you also pass <code>--user-type</code>. Any other value is refused.</td></tr><tr><td><code>--enabled &#x3C;true|false></code></td><td></td><td>Enables (<code>true</code>) or disables (<code>false</code>) the user. Any other value is refused.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Devolutions Cloud only. New description. Pass an empty value to clear it.</td></tr><tr><td><code>--locale &#x3C;locale></code></td><td></td><td>Devolutions Cloud only. New locale of the user. It can't be empty.</td></tr><tr><td><code>--workspace-access &#x3C;true|false></code></td><td></td><td>Devolutions Cloud only. Gives (<code>true</code>) or removes (<code>false</code>) Workspace access.</td></tr><tr><td><code>--web-login &#x3C;true|false></code></td><td></td><td>Devolutions Cloud only. Allows (<code>true</code>) or blocks (<code>false</code>) Devolutions web login for the user.</td></tr><tr><td><code>--user-vaults &#x3C;true|false></code></td><td></td><td>Devolutions Cloud only. Gives (<code>true</code>) or removes (<code>false</code>) access to user vaults.</td></tr><tr><td><code>--first-name &#x3C;name></code></td><td></td><td>Devolutions Server only. New first name.</td></tr><tr><td><code>--last-name &#x3C;name></code></td><td></td><td>Devolutions Server only. New last name.</td></tr><tr><td><code>--user-type &#x3C;type></code></td><td></td><td>Devolutions Server only. New user type: <code>admin</code> (or <code>administrator</code>), <code>user</code>, <code>restricted</code>, or <code>read-only</code> (or <code>readonly</code>).</td></tr><tr><td><code>--password-env &#x3C;variable></code></td><td></td><td>Devolutions Server only. Name of the environment variable that holds the new password. Use this option or <code>--password-file</code>, not both. The password can't be empty.</td></tr><tr><td><code>--password-file &#x3C;path></code></td><td></td><td>Devolutions Server only. File that holds the new password.</td></tr><tr><td><code>--force-password-change</code></td><td>Off</td><td>Devolutions Server only. Makes the user change the password at the next sign-in.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

On Devolutions Cloud, users synchronized from your organization's directory are managed by that directory, and Devolutions CLI refuses to change them with `cloudUserSynchronized`. A local profile can't change users: the command reports that the change isn't available for the profile.

## devo admin user delete

Deletes a user. Devolutions Cloud and Devolutions Server delete a user by ID, so a name is first matched to exactly one user. On Devolutions Server, a deleted user goes to the trash, where you can restore or purge it with the `devo admin user trash` commands. Alias: `devo admin user rm`.

**Workspace:** Devolutions Cloud, Devolutions Server.

```bash
devo admin user delete <user> [--id] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user to delete: a user name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--delete-sql-login</code></td><td>Off</td><td>Meant to also remove the user's SQL login. It has no effect on Devolutions Cloud or Devolutions Server.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

On Devolutions Cloud, users synchronized from your organization's directory can't be deleted with Devolutions CLI: the command stops with `cloudUserSynchronized`. A local profile can't delete users: the command reports that the change isn't available for the profile.

## devo admin user groups list

Lists the user groups a user belongs to. Alias: `devo admin user groups ls`.

**Workspace:** Devolutions Cloud, local profile (read only, when the profile contains groups).

```bash
devo admin user groups list <user> [--id | --email]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user: a user name by default, <code>id:&#x3C;value></code> for an ID or <code>email:&#x3C;value></code> for an email or login email.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--email</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as an email or login email.</td></tr></tbody></table>

## devo admin user trash list

Lists deleted users that are still in the trash. Alias: `devo admin user trash ls`.

**Workspace:** Devolutions Server.

```bash
devo admin user trash list [--page-number <number>] [--page-size <size>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>[&#x3C;user>]</code></td><td></td><td>Optional user name filter. Devolutions Server doesn't filter deleted users by name: leave it out, or the command stops with <code>invalidParameterValue</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID. Not used by Devolutions Server, since the user argument isn't accepted.</td></tr><tr><td><code>--case-sensitive</code></td><td>Off</td><td>Matches the user name with case sensitivity. Not used by Devolutions Server.</td></tr><tr><td><code>--page-number &#x3C;number></code></td><td><code>1</code></td><td>Page of deleted users to fetch, starting at 1.</td></tr><tr><td><code>--page-size &#x3C;size></code></td><td><code>10000</code></td><td>Number of deleted users per page. Devolutions Server returns at most 500 per page: a larger value is lowered to 500. The value must be at least 1.</td></tr></tbody></table>

## devo admin user trash restore

Restores a deleted user from the trash.

**Workspace:** Devolutions Server.

```bash
devo admin user trash restore id:<user-id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The deleted user. Devolutions Server selects deleted users by ID only: write <code>id:&#x3C;value></code> or add <code>--id</code>. The ID must be a GUID. Get it from <code>devo admin user trash list</code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the restore. Required.</td></tr></tbody></table>

## devo admin user trash purge

Permanently deletes a user from the trash. This can't be undone. Alias: `devo admin user trash rm`.

**Workspace:** Devolutions Server.

```bash
devo admin user trash purge id:<user-id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The deleted user. Devolutions Server selects deleted users by ID only: write <code>id:&#x3C;value></code> or add <code>--id</code>. The ID must be a GUID.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the permanent deletion. Required.</td></tr></tbody></table>

## devo admin user 2fa set

Sets up in advance the two-factor authentication method of a Devolutions Server user. Devolutions CLI first reads the server's two-factor configuration and refuses a method the server doesn't offer.

**Workspace:** Devolutions Server.

```bash
devo admin user 2fa set --user-security-id <id> --type <method> [--account-name <name>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-security-id &#x3C;id></code></td><td></td><td>Required. ID of the Devolutions Server user, as a GUID: the user ID that <code>devo admin user list</code> and <code>devo admin user get</code> show. You need the right to edit users, unless it's your own account.</td></tr><tr><td><code>--type &#x3C;method></code></td><td></td><td>Required. Two-factor method: <code>google-authenticator</code> (also <code>googleauthenticator</code>, <code>totp</code>, <code>authenticator</code>), <code>yubikey</code> (also <code>yubi-key</code>), <code>email</code>, <code>sms</code>, <code>duo</code>, <code>azure-mfa</code> (also <code>azuremfa</code>), or <code>radius</code>. See the methods your server offers with <code>devo admin settings two-factor get</code>.</td></tr><tr><td><code>--account-name &#x3C;name></code></td><td></td><td>Account name saved with the method.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin user 2fa clear

Removes the two-factor authentication method set for a Devolutions Server user.

**Workspace:** Devolutions Server.

```bash
devo admin user 2fa clear --user-security-id <id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-security-id &#x3C;id></code></td><td></td><td>Required. ID of the Devolutions Server user, as a GUID: the user ID that <code>devo admin user list</code> and <code>devo admin user get</code> show. You need the right to edit users, unless it's your own account.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin group list

Lists the user groups. Alias: `devo admin group ls`.

**Workspace:** Devolutions Cloud, local profile (read only, when the profile contains groups).

```bash
devo admin group list
```

This command has no options of its own.

## devo admin group get

Shows one user group, by name or ID.

**Workspace:** Devolutions Cloud, local profile (read only, when the profile contains groups).

```bash
devo admin group get <group> [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr></tbody></table>

## devo admin group create

Creates a user group.

**Workspace:** Devolutions Cloud.

```bash
devo admin group create <name> [--description <text>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;name></code></td><td></td><td>Required. Name of the new group.</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>Description of the group.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the creation. Required.</td></tr></tbody></table>

## devo admin group update

Renames a user group or changes its description. Options you leave out keep their value; pass at least `--name` or `--description`.

**Workspace:** Devolutions Cloud.

```bash
devo admin group update <group> [--id] [--name <new-name>] [--description <text>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group to change: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr><tr><td><code>--name &#x3C;new-name></code></td><td></td><td>New name of the group. An empty value is treated as "no change".</td></tr><tr><td><code>--description &#x3C;text></code></td><td></td><td>New description. Pass an empty value (<code>--description ""</code>) to clear it.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin group delete

Deletes a user group and its assignments. A group name is first matched to exactly one group. Groups synchronized from your organization's directory can't be deleted. Alias: `devo admin group rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin group delete <group> [--id] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group to delete: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo admin group members list

Lists the users who belong to a user group. Alias: `devo admin group members ls`.

**Workspace:** Devolutions Cloud, local profile (read only, when the profile contains groups).

```bash
devo admin group members list <group> [--id]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr></tbody></table>

## devo admin group members add

Adds a user to a user group.

**Workspace:** Devolutions Cloud.

```bash
devo admin group members add <group> <user> [--group-id] [--user-id | --user-email] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user to add: a user name by default, <code>id:&#x3C;value></code> for an ID or <code>email:&#x3C;value></code> for an email or login email.</td></tr><tr><td><code>--group-id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr><tr><td><code>--user-id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--user-email</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as an email or login email.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin group members remove

Removes a user from a user group. Alias: `devo admin group members rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin group members remove <group> <user> [--group-id] [--user-id | --user-email] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;group></code></td><td></td><td>Required. The group: a group name by default, or <code>id:&#x3C;value></code>.</td></tr><tr><td><code>&#x3C;user></code></td><td></td><td>Required. The user to remove: a user name by default, <code>id:&#x3C;value></code> for an ID or <code>email:&#x3C;value></code> for an email or login email.</td></tr><tr><td><code>--group-id</code></td><td>Off</td><td>Reads <code>&#x3C;group></code> as a group ID.</td></tr><tr><td><code>--user-id</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as a user ID.</td></tr><tr><td><code>--user-email</code></td><td>Off</td><td>Reads <code>&#x3C;user></code> as an email or login email.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin invitation list

Lists the pending user invitations of the organization, without their secrets. Alias: `devo admin invitation ls`.

**Workspace:** Devolutions Cloud.

```bash
devo admin invitation list
```

This command has no options of its own.

## devo admin invitation get

Shows one user invitation, without its secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin invitation get --invitation-id <id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--invitation-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID of the invitation, as a GUID. Get it from <code>devo admin invitation list</code>.</td></tr></tbody></table>

## devo admin invitation delete

Deletes a user invitation. Alias: `devo admin invitation rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin invitation delete --invitation-id <id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--invitation-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID of the invitation, as a GUID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo admin invitation remove-email

Removes one email address from a user invitation, so that person is no longer invited.

**Workspace:** Devolutions Cloud.

```bash
devo admin invitation remove-email --invitation-id <id> --email <email> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--invitation-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID of the invitation, as a GUID.</td></tr><tr><td><code>--email &#x3C;email></code></td><td></td><td>Required. Email address to remove. It must be a single valid email address, with no display name.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin owner get

Shows the owner of the Devolutions Cloud organization.

**Workspace:** Devolutions Cloud.

```bash
devo admin owner get
```

This command has no options of its own.

## devo admin owner set

Makes another user the owner of the Devolutions Cloud organization.

**Workspace:** Devolutions Cloud.

```bash
devo admin owner set --user-id <id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>Required. ID of the user who becomes the owner, as a GUID. Get it from <code>devo admin user list</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the owner change. Required.</td></tr></tbody></table>

## devo admin domain list

Lists the Active Directory domains configured on Devolutions Server, without their bind secrets. Alias: `devo admin domain ls`.

**Workspace:** Devolutions Server.

```bash
devo admin domain list
```

This command has no options of its own.

## devo admin domain users

Lists the users Devolutions Server finds in an Active Directory domain.

**Workspace:** Devolutions Server.

```bash
devo admin domain users --domain <domain-name> [--group <group-name>] [--no-cache]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--domain &#x3C;domain-name></code> (<code>--domain-name</code>)</td><td></td><td>Required. Name of the Active Directory domain to query. It can't be empty. See the configured domains with <code>devo admin domain list</code>.</td></tr><tr><td><code>--group &#x3C;group-name></code></td><td></td><td>Lists only the users of this Active Directory group.</td></tr><tr><td><code>--no-cache</code></td><td>Off</td><td>Asks Devolutions Server to query the domain again instead of using its cached list of domain users.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/admin-users-and-groups.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.