User Management

User management allows you to control who has access to your Legend instance. Administrators can create new user accounts, modify existing accounts, deactivate users who no longer need access, and delete accounts that are no longer required.

Accessing User Management

To access user management:

1. Click your user menu in the top-right corner
2. Select Admin Panel from the dropdown
3. Click Users in the admin sidebar

Only users in the Admins group can access user management.

Viewing Users

The user management page displays a list of all user accounts in your Legend instance. For each user, you can see:

• Name: The user’s display name
• Email: The user’s email address
• Role: The user’s role (admin or user)
• Status: Whether the account is active or inactive
• Last Login: The date and time of the user’s most recent login
• Created: The date the account was created

You can sort the user list by clicking on column headers. Use the search box to find specific users by name or email.

Creating Users

To create a new user account:

1. Click the Create User button on the user management page
2. Enter the user’s first name
3. Enter the user’s last name
4. Enter the user’s email address (must be unique)
5. Enter an initial password (must meet password requirements)
6. Select the user’s role:
   • User: Standard access to view and edit entities
   • Admin: Full administrative access
7. Click Create to create the account

The new user will receive an email notification with their account details (if email is configured). They can log in immediately using the credentials you provided.

Password Requirements

Initial passwords must meet the same requirements as user-created passwords:

• At least 12 characters long
• Contains at least one uppercase letter (A-Z)
• Contains at least one lowercase letter (a-z)
• Contains at least one number (0-9)

Consider using a password manager to generate secure initial passwords.

Bulk User Creation

Legend does not currently support bulk user creation through the interface. To create multiple users, you must create each account individually.

For large-scale user provisioning, consider using OIDC/SSO integration with your identity provider. See Single Sign-On (OIDC) for details.

Editing Users

To edit an existing user account:

1. Find the user in the user list
2. Click the Edit button next to the user’s name
3. Modify the user’s information:
   • First name
   • Last name
   • Email address (must remain unique)
   • Role (admin or user)
   • Group memberships
4. Click Save to apply the changes

Changes take effect immediately. The user does not need to log out and back in for most changes to take effect, though role changes may require a new login session.

Changing Roles

When you change a user’s role:

• User to Admin: The user gains access to the admin panel and all administrative functions
• Admin to User: The user loses access to the admin panel but retains access to regular features

Admin Role Changes

Be careful when removing admin privileges. Ensure at least one administrator account remains active. If you remove admin privileges from the last admin account, you will lose access to administrative functions.

Group Memberships

Users can belong to multiple groups. Group memberships control:

• Access to restricted entities
• Edit permissions for specific entity types
• Visibility of admin functions (for admin group members)

To modify group memberships:

1. Edit the user account
2. In the Groups section, select or deselect groups
3. Save the changes

See Group Management for details on creating and managing groups.

Deactivating Users

Deactivating a user account temporarily disables access without deleting the account. Deactivated users:

• Cannot log in to Legend
• Do not count against your license tier limits
• Retain all their data and relationships
• Can be reactivated later if needed

To deactivate a user:

1. Find the user in the user list
2. Click the Deactivate button next to the user’s name
3. Confirm the deactivation

The user’s account status changes to “Inactive” and they can no longer log in.

To reactivate a user:

1. Find the deactivated user in the user list (use the filter to show inactive users)
2. Click the Activate button next to the user’s name
3. Confirm the reactivation

The user can log in again with their existing credentials.

License Management

Deactivating users is the recommended way to manage license usage. When a user leaves your organization or no longer needs access, deactivate their account rather than deleting it. This preserves their data and allows you to reactivate the account if needed.

Deleting Users

Deleting a user account permanently removes the account from Legend. This action cannot be undone.

To delete a user:

1. Find the user in the user list
2. Click the Delete button next to the user’s name
3. Confirm the deletion by typing the user’s email address
4. Click Delete to permanently remove the account

What happens when you delete a user:

• The user account is permanently removed
• The user can no longer log in
• All audit log entries for the user are preserved (for compliance)
• Entity ownership is transferred to the system (unowned)
• Relationships involving the user are removed

Deletion Is Permanent

Deleted user accounts cannot be recovered. If you need to preserve the account for future reference, deactivate it instead of deleting it.

When to Delete vs Deactivate

Deactivate when:

• The user is temporarily unavailable (leave, sabbatical)
• The user might return to the organization
• You want to preserve the account for audit purposes
• You need to free up a license seat temporarily

Delete when:

• The user account was created in error
• The user has permanently left and you don’t need to preserve the account
• You need to reclaim the email address for a new account
• Compliance requirements mandate account deletion

Password Management

Password Requirements

All passwords in Legend must meet these requirements:

• At least 12 characters long
• Contains at least one uppercase letter (A-Z)
• Contains at least one lowercase letter (a-z)
• Contains at least one number (0-9)

Special characters are allowed but not required.

Resetting Passwords

Users can reset their own passwords through the login page:

1. Click “Forgot password?” on the login page
2. Enter their email address
3. Follow the instructions in the reset email

Administrators cannot reset user passwords directly. If a user cannot reset their password, administrators can:

1. Deactivate the user account
2. Create a new account with the same email address (after deleting the old one)
3. Provide the new credentials to the user

Password Security

Legend uses industry-standard password hashing (scrypt) to protect user passwords. Passwords are never stored in plain text and cannot be recovered, only reset.

Password Expiration

Legend does not currently enforce password expiration. Users can keep the same password indefinitely. If your organization requires password rotation, you must enforce this through policy rather than technical controls.

User Roles

Legend supports two user roles:

User Role

Users with the “User” role can:

• View all entities they have access to
• Create new entities
• Edit entities they own or have permission to edit
• Delete entities they own
• Manage their own profile
• View audit logs (read-only)

Users cannot:

• Access the admin panel
• Create or manage other users
• Modify system settings
• Manage groups or categories

Admin Role

Users with the “Admin” role have all the permissions of the User role, plus:

• Access to the admin panel
• Ability to create and manage users
• Ability to modify system settings
• Ability to manage groups and categories
• Ability to configure OIDC/SSO
• Ability to manage licenses
• Ability to create and restore backups
• Ability to configure alerts and link health monitoring

Admin Privileges

Admin users have full control over the Legend instance. Only grant admin privileges to users who need them. Follow the principle of least privilege: give users the minimum permissions they need to perform their job.

Best Practices

Account Creation:

• Create accounts with unique email addresses
• Use strong initial passwords and communicate them securely
• Assign appropriate roles based on job responsibilities
• Add users to relevant groups for access control

Account Maintenance:

• Review user accounts periodically
• Deactivate accounts for users who no longer need access
• Update roles when job responsibilities change
• Remove group memberships that are no longer relevant

Security:

• Follow the principle of least privilege
• Limit admin accounts to essential personnel
• Monitor audit logs for unusual activity
• Use OIDC/SSO for centralized authentication when possible

Compliance:

• Maintain audit logs for regulatory requirements
• Document account creation and deletion procedures
• Review access permissions regularly
• Implement offboarding procedures for departing users

Troubleshooting

Cannot create user:

• Verify the email address is unique
• Check that the password meets requirements
• Ensure you have administrator privileges

Cannot edit user:

• Verify you have administrator privileges
• Check that you’re not editing your own account (some changes may be restricted)

User cannot log in:

• Verify the account is active (not deactivated)
• Check that the password is correct
• Ensure the user is using the correct email address

Cannot delete user:

• Verify you have administrator privileges
• Check that you’re not trying to delete your own account
• Ensure you’ve confirmed the deletion by typing the email address

Next Steps

After managing users, proceed to Group Management to set up access control groups, or Categories and Tags to organize your entities.