doc/tutorials/manage_user/_index.md
{{< details >}}
{{< /details >}}
<!-- vale gitlab_base.FutureTense = NO -->This tutorial will teach you how to set up and manage your company's GitLab organization by:
In this tutorial, you are the IT administrator of a small software company. This company uses GitLab and is divided into marketing, sales, and development divisions.
You have already set up the marketing and sales organizations. In this tutorial, you will set up the software development organization. This organization has the following permanent employees:
You're going to create:
First, you'll create a group called Development. The Development group will serve as the parent group for the whole software development organization.
To create the Development group:
Development.development-group. You'll see a message
saying "Group path is available". The group URL is used for the namespace.
A namespace provides a place to organize your related projects.You have created the parent group for your organization. Next, you will create subgroups.
For this tutorial, we assume that Development is organized into the following working areas:
Now, you will create subgroups to reflect this organization structure.
Subgroups and projects must have visibility settings that are at least as restrictive as the visibility setting of their parent group. For example, you cannot have a private parent group and a public subgroup.
To create your organization subgroups:
Product Management.EngineeringUser ExperienceNext, create UX Design and Technical Writing subgroups. These subgroups will be nested under the User Experience subgroup:
UX Design.You have now created the subgroups for your organization. Next, you will create users for the organization.
You will now manually create the users for your organization. These users are test users. To create the first test user, Alex Smith:
Alex Smithalexsmith[email protected]For real users, a reset link is sent to the user's email, and that user is forced to set their password on first sign in. However, as this user is a test user with a fake email, you must set the user's password without using the email confirmation.
After you create the user, you will be directed to the user's overview page. Alternatively, in the left sidebar, you can select Users and search for the user.
After you select the user:
You have created the first test user. Now, repeat these steps for the other users:
| Name | Username | |
|---|---|---|
Blake Wang | blakewang | [email protected] |
Charlie Devi | charliedevi | [email protected] |
Devon Ivanov | devonivanov | [email protected] |
Evan Kim | evankim | [email protected] |
Frankie Ali | frankieali | [email protected] |
Grayson Garcia | graysongarcia | [email protected] |
Hunter Silva | huntersilva | [email protected] |
You have created the users for your organization. Next, you will add these users to the different groups and subgroups.
You can give users access to all projects in a group by adding them to that group.
First, you will add all the users to the parent group, Development.
In the top bar, select Search or go to and find the Development group.
Select Manage > Members.
Select Invite members.
In the Username, name or email address dropdown list, select Alex Smith.
In the Select maximum role dropdown list, select Owner.
Leave Access expiration date blank.
Select Invite.
Repeat this process for the following users:
| User | Role | Access expiration date |
|---|---|---|
| Blake Wang | Maintainer | Leave blank |
| Charlie Devi | Developer | Leave blank |
| Devon Ivanov | Developer | Leave blank |
| Evan Kim | Developer | Leave blank |
| Frankie Ali | Reporter | Leave blank |
| Grayson Garcia | Reporter | Leave blank |
| Hunter Silva | Guest | 2025-12-31 |
You can invite multiple users at the same time if they have the same role and access expiration date.
On the Group Members page of the Development group and all subgroups, check the membership of these groups.
All the users you have added as parent group members are also members of all the subgroups with the same role.
You can filter a subgroup to show which users are direct members of that subgroup, and which members have inherited membership of that subgroup from the parent group.
You now only see the User Experience subgroup members that have inherited membership
of that subgroup. You can verify inherited members by looking at the Source column
of each member. It should say: Inherited from Development.
You want each user to only be a member of the subgroup that is associated with their role in your organization. You decide to remove the users from the groups and subgroups.
You cannot remove the members from the subgroups directly. You can only remove them from the parent group.
Go back to the parent group and remove everyone except Alex Smith:
You now have one member only in the parent group and subgroups, and that member has the Owner role.
Next, you will add users directly to the subgroups.
You will now add users directly to the different subgroups.
Excluding you, Alex is the only member of this subgroup and is a direct member, which is correct. However, you believe they should have the Maintainer role instead of the Owner role.
You cannot change their role directly on the members page. To change their role in the subgroup, invite them to the subgroup as a Maintainer.
You will see the following message:
The following member couldn't be invited
Review the invite errors and try again:
- Alex Smith: Access level should be greater than or equal to Owner inherited membership from group Development
[!note] You cannot give Alex a subgroup role with an access level less than their role for the subgroup's parent group, as they have an inherited membership from the parent group.
You decide to keep Alex as an Owner in this subgroup as it is appropriate given their role for the organization. Select Cancel to cancel this invite.
The Product Management subgroup has the correct members and roles. Next, you will add users to the Engineering subgroup.
You are now going to invite some users to the Engineering subgroup.
In the top bar, select Search or go to and find the Development group.
Select the Engineering subgroup.
In the left sidebar, select Manage > Members. The only members are you and Alex. Both members have the Owner role, which are inherited roles.
Select Invite members.
Complete the fields for the following members:
| User | Role | Access expiration date |
|---|---|---|
| Blake Wang | Maintainer | Leave blank |
| Charlie Devi | Developer | Leave blank |
| Devon Ivanov | Developer | Leave blank |
| Evan Kim | Developer | Leave blank |
Select Invite.
Blake Wang has the Maintainer role in this subgroup, in line with their responsibilities as engineering manager. The three developers all have the Developer role, which are direct roles.
You can change their roles directly on this subgroup's member page. Under Role, select Maintainer to change Blake Wang's role
to an Owner for this subgroup.
Go back to the Development group's member page. You see that the members of the Engineering subgroup are not members of the parent group.
By adding users directly to the groups and subgroups they need to be members of, you avoid the issue of users being members of groups unnecessarily. You can control access to different groups and projects in a more precise way.
The User Experience subgroup has two further nested subgroups:
In terms of users, UX Design should only include Frankie Ali and Hunter Silva, and Technical Writing should only include Grayson Garcia.
If you add all three users to the User Experience subgroup, they will all be included in both nested subgroups due to inherited permissions.
Therefore, you will add these users to the appropriate nested subgroup directly rather than to the User Experience subgroup.
In the top bar, select Search or go to and find the Development group.
Select the User Experience subgroup, and then the UX Design subgroup.
In the left sidebar, select Manage > Members. You and Alex Smith are the only members. These are inherited roles.
Select Invite members.
Complete the fields and select Invite for the following members:
| User | Role | Access expiration date |
|---|---|---|
| Frankie Ali | Maintainer | Leave blank |
| Hunter Silva | Guest | 2025-12-31 |
Repeat for the Technical Writing subgroup:
| User | Role | Access expiration date |
|---|---|---|
| Grayson Garcia | Maintainer | Leave blank |
You have added the users to their appropriate nested subgroups. You decide that Grayson Garcia should be in the User Experience subgroup as well.
You can add Grayson to the User Experience subgroup as a specific role, while keeping their role for the Technical Writing subgroup the same.
Giving Grayson the Developer role means that they do not have an unnecessarily high level of permissions in the User Experience subgroup.
However, due to inherited permissions, adding Grayson Garcia to the User Experience subgroup also adds them to the UX Design nested subgroup as a Developer.
[!note] Be mindful of inherited permissions for groups and subgroups. Add users to a minimum number of groups and subgroups. This approach minimizes the chance of inadvertently adding a user to a group they do not need to be a member of.
Frankie Ali and Hunter Silva are now members of the Technical Writing subgroup due to inherited permissions.
You have successfully set up your organization with groups, subgroups, and members.
Next, you will create a project in one of the groups for members to work on.
Now, let's assume that you have a piece of work that certain members of your organization need to work on. That piece of work is for the whole organization. To organize that work, you are going to create a project in the Development parent group, and add different users to that project.
Release 2.0 as the name of your project.README file so that the Git repository is initialized, has a
default branch, and can be cloned, select the Initialize repository with a README
checkbox.You have now created a project in the parent group.
In this project, go to Manage > Members.
The existing members of the parent group (you and Alex) are already members of this project. When your project belongs to a group, project members inherit their role from the group.
Other users need to be part of this project. You will now add users directly to the project.
In the top bar, select Search or go to and find the Release 2.0 project.
In the left sidebar, select Manage > Members.
Select Invite members. Invite the following users:
| User | Role | Access expiration date |
|---|---|---|
| Charlie Devi | Maintainer | Leave blank |
| Frankie Ali | Maintainer | Leave blank |
| Grayson Garcia | Maintainer | Leave blank |
Select Invite.
Because you added these users directly to the project, you can change their roles on the project members page if needed. Change Grayson Garcia's role to Developer to test this out.
Go to the Development parent group members page. The users you just added to the project are not there despite the project being in the parent group.
Add the same users directly to the parent group with Guest roles. You can change their role directly on this page. Change Frankie's role to Reporter.
Go back to the Release 2.0 project members page. The members' project roles are still 2 Maintainers and 1 Developer.
You have successfully added three users who are members of subgroups to a project in the parent group, and you gave those users specific roles in the project and parent group.