Console users are the people your organization has allowed to use the Rhythm Console. This article shows you where to find console users, what each field means, and how to create, edit, clone, disable, or delete a user. To learn how roles, policies, and individual statements shape a console user’s access, see Console Users and Their Access.
Where to Find It
Go to System & Security › Security › Users to open Manage Users. This page lists every console user for your organization, along with each person’s last name, first name, email address, and Active or Inactive status.
The Settings
| Setting | Options | Default | Effect |
|---|---|---|---|
| First Name, Last Name | Free text; both required | — | Shows the person’s name throughout the Console. |
| Free text; required | — | Stores the email address on the user record. Rhythm does not validate the format. This field is separate from the sign-in credential the person uses, so editing it does not change the email address they use to sign in. | |
| Phone | Free text; optional | — | Stores a contact number on the user record. |
| Profile picture | Image upload; optional | None | Shows the image wherever the user’s identity appears. |
| This user is disabled | On or off | Off (active) | Suspends the person’s Console access without deleting their record. |
| Default account | One of your accounts | — | Sets the account Rhythm opens for this person when they sign in. Choose this before you restrict the person to specific accounts. |
| Restrict the accounts this user can access | On or off | Off | When on, you choose which accounts the person can access. When off, the person is not limited to a named set of accounts. |
| Restrict the applications this user can access | On or off | Off | When on, you choose which applications the person can access. |
| Security roles, managed policies, customer policies, individual statements | Selectable, where your organization has advanced security | None attached | Controls what the person can do. See Security Roles, Policies, and Permission Statements. |
The account and application restriction sections appear only when your organization has advanced security. Roles, policies, and statements also appear only when advanced security is available. Without advanced security, creating a user gives the person an identity, with no additional access pieces to configure beyond your organization’s default access.
Dependencies and Order
If you plan to restrict a user to specific accounts, choose the person’s default account and include that account in the allowed accounts. Rhythm will not save a default account that is outside the person’s account restrictions, and it tells you before anything is saved. Attach roles and policies only after those roles and policies exist; see Set Up Security & Settings for a suggested order when you are configuring security for the first time.
Create, Edit, or Clone a Console User
Prerequisites
- Console access sufficient to reach System & Security › Security › Users, per your organization’s security settings. If the create or edit screen only lets you enter a name and email address, and the account, application, and role settings described above do not appear, your own console role does not include administrator-level access. Ask an administrator to complete the setup or grant you that access first.
- The person’s name and email address. If you are creating the person’s first account on a new email domain your organization has not used before, that domain may need to be recognized in your Rhythm account’s configuration before the save succeeds. Contact Support if creation fails for a domain you believe should be allowed.
- If your organization has advanced security and you are restricting access, have the account or accounts, application or applications, and any roles or policies you intend to attach.
- Go to System & Security › Security › Users.
- To add someone new, select Create User. To update an existing person, select the Edit icon on their row. To create a new person from an existing person’s settings, select the Clone icon on the source person’s row.
- Enter or review the person’s first name, last name, and email address. Add a phone number and photograph if you want them.
- If your organization has advanced security, choose the person’s default account, set any account or application restrictions, choose the specific accounts or applications they can access, and attach the roles, policies, or individual statements they need.
- Select Save Changes.
Result
The person is saved as a console user. When your organization has advanced security, Rhythm saves their restrictions, roles, policies, and statements with their profile. A cloned user starts with everything from the source person, including restrictions, roles, policies, and statements, so you can adjust the new record before saving it.
Warning
Cloning copies a person’s full access into the new record without showing you a summary first. If you are not sure the source person’s roles and policies are right for the new person, review them on the source person’s record before you clone.
Warning
If creating a new user fails with an error suggesting the email already exists, the person may already have a console identity under a different Rhythm account, even though you cannot see them in your own account’s user list. Standard user creation does not let you grant one identity access to both accounts. If the person genuinely needs access to both, contact Support instead of retrying the creation. Support can review whether the person should have access to both accounts instead of being created as a separate new user.
An administrator can also grant an existing console user access to a separate sandbox directly from that person’s record, without contacting Support, as long as the administrator has the appropriate permissions to edit that user.
If you need to know who created or last changed a particular console user and cannot find an audit log in the interface, the user’s record stores that information as metadata. Contact Support if you need help reading it.
If a Colleague Changes Email Addresses
Editing the email field on an existing console user’s record does not change the email address that person signs in with, because the user record email and the sign-in credential are separate. If a colleague moves to a new email address, such as after a company or domain change, create a new console user with the new address instead of editing the existing record. After you confirm the new user works, remove the old console user. Editing the old record’s email field alone will not let the person sign in with the new address.
The Security tab on a user’s record shows a history of the email identities that person has signed in with, sourced from your identity provider. This history can include older or unused addresses, and you cannot remove entries yourself.
If someone’s sign-in identity was created with an incorrect username or email, editing the user record will not fix it. The usual remedy is to delete that person’s console user and have them create their account again with the correct address, instead of trying to correct the existing identity in place.
Deleting the identity record behind a console user’s sign-in credential is a staff-managed action; a customer administrator cannot do it themselves. If you need an identity record removed rather than just the console user deleted, contact Support.
After a console user’s username is assigned, you cannot view or change it from this screen. If someone needs their username changed, contact Support rather than looking for a self-service option.
Disable or Delete a User
To suspend someone’s access without losing their record, open the user, turn on This user is disabled, and select Save Changes. Turn it off again to restore access. To remove a user entirely, select the Delete icon on their row in Manage Users and confirm. Rhythm warns you that deletion cannot be undone before it deletes the person’s record.