Prerequisites

• For an overview of the Identities feature, refer to the section: Identity Management.

Configuration

1. Log in to the Admin Portal and navigate to the Identities > Users page.

2. Click the dropdown button and select "Add manually".

3. Fill in the fields and click Save.

User Profile

• Username -- Enter the username of the user. If this user belongs to an external IdP, the username must match the IdP username.

• First name -- Enter the first name of the user. This field is optional.

• Last name -- Enter the last name of the user. This field is optional.

• Personal Desktop -- Enter the workstation IP address of the user, or another internal IP address, to log in remotely using RDP. This is an optional field. For more information on the Personal Desktop feature, refer to the section: Configuring Personal Desktop.

• Phone Number -- Enter the phone number of the user. This field is optional; however, if MFA is configured, a phone number is required to receive the OTP.

• Email -- Enter the email address of the user. This field is optional; however, if MFA is configured, an email address is required to receive the OTP.

• Supervisors -- Select users from the drop-down menu to choose the supervisor(s) to approve the user's login to the Cyolo Application Portal. Multiple supervisors can be selected. This is an optional field. Note: Selecting a supervisor(s) here replaces the MFA option configured on the Configuration > Global Settings page. For detailed information on supervision, refer to the section: Supervision and Auditing Roles.

• Condition Profile (optional) - Select the condition profile to evaluate during login. If the user does not meet the profile’s conditions, access will be denied.

• Groups (optional) -- From the drop-down menu, select a user group to add the user to the group.

• Identity Provider -- Select the IdP from the drop-down list. The default is set to local. External identity providers must be configured on the Integrations > Identity Providers page for them to be listed here. Select the IdP where the account of this user is created.

• Valid from - Set the date from which the user will be able to start logging into the system. This field is optional.

• Valid until - Set the date from which the user will not be able to log into the system anymore. This field is optional.

• Password - Enter the password for the user. The password must meet the constraints set in the password policy selected on the Integrations > Identity Providers > local page. The tooltip that appears when the admin clicks on this field displays the minimum password requirements as defined in the policy. For more information on password policy, refer to the section: How to Create a Password Policy. The Password option is available only if local is selected in the Identity Provider field.
• Send email invitation - When the password option is set to “End-user defined,” enabling this option sends the user an email invitation with a secure link. The link is valid for 7 days and allows the user to create their own password.

• Send email invitation -- This option sends an email to the configured email address informing the user of the account creation and inviting them to log in. The option is enabled by default and can be disabled. This option is available only if local is selected in the Identity Provider field.

• Force changing password -- This option forces the user to set a new password when logging in to the Application Portal for the first time. The option is enabled by default and can be disabled. This option is available only if local is selected in the Identity Provider field.

• Click the Save button in the top right corner of the page to create the user.

Importing Users from CSV

You can add up to 10 users at once by uploading a CSV file, instead of creating each user one by one. Each row in the file creates one user.

1. On the Users page, click the down arrow icon next to the Add user button, then select Import from CSV.

2. On the Import Users page, click Download CSV template to download a template file. (This button is also available directly in the dropdown from step 1, so you don't have to open the Import Users page first.)

3. Open the file in a text editor or spreadsheet application and add one row per user.

4. Click the upload area — labeled .CSV — to browse for your file, or drag it in directly.

5. Once your file passes validation, click the Save button in the top right corner of the page.

Note: If you need to add more than 10 users, split them across multiple files. If any row in the file fails validation, Cyolo rejects the entire import and creates no users. Cyolo stops checking at the first row that fails, so fixing that row and re-uploading may reveal further errors in later rows.

CSV Format for Importing Users

The first line of your file must be this exact header row, with the columns in this order:

name,first_name,last_name,email,password,phone_number,personal_desktop,supervisor,idp,enabled,must_change_password,send_email,group,valid_from,valid_until,condition_profile

Example rows — you can copy these into your file and replace the values with your own:

jdoe,John,Doe,[email protected],,+972501234567,10.0.0.5,,local,TRUE,FALSE,FALSE,Engineering,2026-01-01,2026-12-31,Standard Access
asmith,Alice,Smith,[email protected],TempPass123!,+972502345678,,,local,TRUE,TRUE,TRUE,,,,

The first row leaves password blank, so Cyolo emails that user an invitation to set their own password on first login.

The columns are:

Note: Cyolo matches supervisor, idp, group, and condition_profile values against your existing configuration by exact name.

Troubleshooting a Failed Import

Cyolo checks your file in three stages:

• As soon as you select the file, Cyolo checks it in your browser: the header row must match the template, the file must have 10 rows or fewer, and every row must have a name and an idp. If any of these checks fail, Cyolo shows you the specific problem — for example, which row is missing which field — before you can click Save.

• When you click Save, Cyolo also matches every group, idp, supervisor, and condition_profile value against your existing configuration, by exact name. If one of these values doesn't match, you see only a generic failure message. Check the values against your existing groups, identity providers, users, and condition profiles.

• If the file passes those checks, Cyolo sends it to the server, which validates the format of each value — for example, the phone_number format, the valid_from and valid_until dates, whether name is unique, and whether password meets your password policy. If a row fails here, go to Monitoring > System and check the Result Description column for the row number and the reason.