---
title: "End users and user groups"
description: "How Outpost builds a list of the people who use your endpoints, and how to add logins, assign endpoints, group people, and merge duplicates."
url: "https://support.outpostplatform.com/endpoints/end-users/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "The Users section of the Outpost console lists the people who use endpoints. Outpost creates people from the accounts endpoints report; local-only ones show Needs review. Covers statuses (active, disabled, departed), logins and providers, assigning endpoints as primary, shared, or service, user groups for profile targeting, and merge suggestions. Needs identity:read and identity:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "identity:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/endpoints/end-users.md"
license: "CC BY 4.0"
---

# End users and user groups

The **Users** section lists the people who use your endpoints and the accounts
they sign in with. It exists so that settings can follow a person: a profile
assigned to a user or a user group reaches every endpoint that person uses.
These people are [end users](/get-started/concepts/#end-user). They never sign
in to the console. Your team's console accounts are on
[Invite your team](/depot/invite-your-team/).

The section has three pages: **All users**, **User groups**, and **Merge
suggestions**.

## Before you begin

- Reading people and user groups needs `identity:read`.
- Adding, changing, merging, and removing them needs `identity:manage`.

## How people get onto the list

Outpost adds people on its own from the accounts your endpoints report. Each
account is matched to a person by its security identifier first, so a person
who is renamed in the directory keeps their record. You can also add people by
hand.

The **Source** column says where each person came from:

| Shown | Meaning |
| --- | --- |
| **Discovered** | Outpost created this person from an account an endpoint reported. |
| **Added by hand** | Someone on your team created this person. |
| **Needs review** | Only a local account on one computer vouches for this person. They may be a duplicate of someone else. See [Merge duplicate people](#merge-duplicate-people). |

### Statuses

A person is `active`, `disabled`, or `departed`. A departed person keeps their
history but stops picking up policy. New people are `active` unless you choose
otherwise.

The list opens on the **Still on the roster** view, which shows active and
disabled people. The other built-in views are **Active only**, **Recently
added**, and **Departed**.

Search matches the beginning of a word in a name or an email address. Names and
addresses are stored encrypted, so a search for the middle of a word finds
nothing: "grant" finds Alicia Grant, and "rant" does not.

## Add a person by hand

1. Go to **Users** > **All users**, and select **New user**.
2. In **Display name**, enter the person's name.
3. Optional: enter their **Primary email**. It identifies the person and is
   not used to sign them in.
4. Optional: in **Site**, choose the site this person belongs to, so a
   site-scoped profile reaches them.
5. Select **Create user**.

Their logins are added afterwards.

## Add a login

A login is an account a person signs in with. Outpost matches what endpoints
report against logins.

1. Open the person, and select the **Logins** tab.
2. In **Provider**, choose where the account lives: **Windows local**,
   **Active Directory**, **Microsoft Entra ID**, **Okta**, **Google
   Workspace**, **macOS local**, or **Linux local**.
3. In **Identifier**, enter the account name as the endpoint reports it, such
   as `CONTOSO\jokafor`. Case and domain form do not matter.
4. Optional: select **This is their primary login**. A person has at most one.
5. Select **Add login**.

## Assign endpoints to a person

Assigning an endpoint to a person decides whose settings apply to it when
nobody is signed in, such as during a maintenance run at night.

1. Open the person, and select the **Endpoints** tab.
2. Under **Assign another endpoint**, find the endpoint by hostname, serial
   number, model, or user.
3. In **Assign as**, choose how the person uses it:

   | Choice | Meaning |
   | --- | --- |
   | `primary` | The endpoint is theirs. Their policy applies with nobody at the console. |
   | `shared` | They are one of several people who use it. |
   | `service` | A non-human account that runs on the endpoint. |

4. Select **Assign** beside the endpoint.

**This person's endpoints** lists every endpoint assigned to them. An endpoint
where they are signed in at the console is marked **At the console**. Select
**Unassign** to remove one.

## Group people

A user group is a named set of people a profile can be assigned to.

1. Go to **Users** > **User groups**, and select **New group**.
2. Enter a **Name** and, optionally, a **Description**.
3. In **Mirrored from**, leave **Local group** unless the group mirrors a group
   in a directory. For a mirrored group, choose the directory and enter its
   **Source id**.
4. Select **Create group**.

To add someone, open the group and, in **Add a member**, choose the person. Or
open the person, select the **Groups** tab, and use **Add to a group**. Adding a
person to a group changes which profiles resolve for them.

## Merge duplicate people

Outpost suggests people it believes are the same human, for example a local
account that matches someone from your directory. Nothing is merged until you
decide.

1. Go to **Users** > **Merge suggestions**.
2. For each suggestion, compare **Keep** and **Fold in**. A **Strong match**
   has strong evidence. A **Weak match** needs a closer look.
3. Select **Merge** to fold the second person into the first, or **Not the
   same** to dismiss the suggestion for good.

A merge moves everything that pointed at the folded-in person to the one you
keep: their logins, group memberships, endpoint assignments, and the profiles
assigned to them. The folded-in person is removed.

:::caution
A weak match on an account that exists on five or more computers with no
matching full name often belongs to a shared or break-glass account, not a
person. The suggestion says so. Merging it moves that account's policy onto a
real person.
:::

## Other tabs on a person

| Tab | Contents |
| --- | --- |
| **Profile** | Name, email, phone, title, site, and status. **Remove user** is here. On the MSP plan, also the person's contact tags. See [Client contacts, sites, and contact tags](/msp/contacts-and-sites/). |
| **Groups** | The user groups this person is in. |
| **Sync** | Their Outpost Sync status and files. See [Outpost Sync](/sync/). |
| **Documentation** | Articles and assets that name this person. See [Documentation](/documentation/). |

## Verify

Open a person you merged into. Their **Logins** tab lists the logins of both
people, and **Merge suggestions** no longer shows the pair.

## Next steps

- [Profiles](/automation/profiles/)
- [Organize endpoints with sites, device groups, and tags](/endpoints/organize-endpoints/)