Users overview · BreezeAuth Docs

A user is a person who belongs to your organization: an employee, a contractor, a partner. Each user can sign in with BreezeAuth and open the applications your organization gives them access to.

Users are managed under Users › Human Users in the admin console. Integrations and automations don’t use people’s accounts: they have their own identities, listed on the Service Users tab next to them. See Service users.

What BreezeAuth keeps about each user

Information	Examples
Basic information	First name, last name and e-mail address. The e-mail is how the person signs in.
Professional information	Job title, department, employee ID, cost center, organizational unit, office location.
Contact	Phone and work phone.
Documents and address	CPF (Brazilian taxpayer number) and postal address.
Administrative role	What the person can do in the admin console, if anything. See Administrative roles.
Status	Whether the person can currently use BreezeAuth in your organization. See Statuses.
Account type	Managed or Guest, set from the e-mail domain. See Account types.

Only the name and e-mail are required. The other profile fields are optional, and many of them can be sent to your applications when people sign in, so filling them in pays off.

Key concepts

User: A person's place in your organization: their profile, administrative role and status. Each organization keeps its own record of the person, so the same person can belong to several organizations, with a different role and profile in each.
Account: The person's BreezeAuth sign-in: their e-mail address, password, passkeys and multi-factor authentication (MFA). One account can be linked to users in several organizations.
Account type: Whether the account is Managed by your organization or belongs to a Guest. It decides how much control your organization has over the account.
Administrative role: What the user can do in the admin console, such as Administrator or Auditor. Most people have no administrative role: they only sign in to their applications.
Status: Whether the user is currently allowed in: Active, Inactive, waiting for an invitation, or waiting for your review.

Account types

Every user’s account type is set automatically from their e-mail domain. You don’t choose it.

Account type	Who	How they join	Your organization controls
Managed	People whose e-mail is on one of your verified domains	Created directly, with an initial password, and can sign in at once	The account itself: policies, MFA, sessions, e-mail, deletion
Guest	Everyone else, such as partners, vendors or people using a personal e-mail	Receive an invitation and must accept it	Only their place in your organization: profile, role, status

This difference matters most when you edit, deactivate or delete someone. Each page of this section points it out where it applies. The full comparison is in Managed and guest users.

Tip: if your company hasn’t verified its domain yet, every user you add will be a guest. Verify your domain first to manage your colleagues’ accounts. See Domain verification.

Statuses

Status	What it means	Can sign in to your applications
Active	The user is part of the organization.	Yes, to the ones assigned to them
Inactive	An administrator deactivated the user. Their profile, groups and assignments are kept, so you can reactivate them later.	No
Pending	A guest was invited and hasn’t accepted the invitation yet.	No
Invite declined	The guest declined the invitation.	No
Pending review	The person’s e-mail domain was verified after their account was created, and an administrator must confirm them. See Review pending accounts.	No

Only active users with an administrative role can use the admin console.

The life of a user

AddedAn administrator creates a managed user, or invites a guest, under Users › New user.
ActiveManaged users are active right away. Guests become active when they accept the invitation.
Given accessThe user is added to groups and assigned applications, directly or through groups.
Deactivated or deletedWhen the person leaves, deactivate them to keep their record, or delete them.

Step-by-step instructions are in Add and manage users.

For developers: in the BreezeAuth API, users are called memberships: the link between a person’s account and an organization. For example, users are read and changed under /organizations/{organizationsUuid}/memberships, their identifier is membershipsUuid, and webhook events about them are named membership.created, membership.updated and membership.deleted. In the admin console and in the rest of this documentation, they are simply users.

Next steps

Understand the differences between managed and guest users.
Add and manage users in the admin console.
Learn how invitations work for guests.
Choose the right administrative role for people who help manage BreezeAuth.
Protect your managed users with account security tools.