
# Add users to your network

Whether you have a network for personal use or manage your company's corporate network, you'd probably want to invite
people to your account and join your NetBird network.

There are three ways of adding users to a NetBird account - indirect, direct, and via IdP (Identity Provider) sync.

## Indirect user invites
This way of adding users is managed by the NetBird system and doesn't require administrator input.
It works only for organizations with private domains.

Whenever a new user signs up with a private domain (e.g., @netbird.io),
NetBird creates a new account and associates it with the netbird.io organization (domain) automatically.
Every consequent user signup with the same @netbird.io domain in their email address will end up under the same organization.

<Note>
    This feature isn't available in the self-hosted setup. By default, all users are joining the same network instead.
</Note>

How does it work? Every time a previously unknown user registers at [app.netbird.io](https://app.netbird.io/),
the system classifies the domain part of the email.
The domain can fall into one of the following categories - `public`, `private`, or `unclassified`.
The domains of the private category are the ones that are automatically grouped under the same account.
Public domains are the ones of the public email providers like Gmail.

<Note>
    It might happen (unlikely) that the domain classification system didn't classify your company's domain as private.
    Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side.
    Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](https://join.slack.com/t/netbirdio/shared_invite/zt-31rofwmxc-27akKd0Le0vyRpBcwXkP0g) to fix this.
</Note>

## Direct user invites
As the name stands, this way of inviting users is straightforward and works through the web UI.
To invite a new user, proceed to `Team` then select the `Users` tab and click the <button name="button" className="button-6">Invite User</button> button.
A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated.

The invited users will receive an email invitation that they have to confirm.
After logging in to the system, they will join your network automatically.

<p>
    <img src="/docs-static/img/how-to-guides/user-invites.png" alt="high-level-dia" className="imagewrapper"/>
</p>

<Note>
    If a user already has a NetBird account, you can't invite them.
    This is a limitation that is likely to be removed in future versions.
</Note>

## Identity Provider (IdP) Sync

NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically
provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync`
button.

<p>
    <img src="/docs-static/img/how-to-guides/idp-sync-reference.png" alt="idp-sync-reference" className="imagewrapper"/>
</p>

See the [Provision Users and Groups From Your Identity Provider](/how-to/idp-sync) section for more details.

## Manage user roles
NetBird has five user roles - `Owner`, `Admin`, `Network Admin`, `Auditor` and `User`. The roles allow you to control the level of access to the management API of your account. 

- `Owner` role - has full access to the account and can manage all aspects of the account. There can be only one account owner in NetBird. Users with the owner role can delete their organization account. See the [Delete NetBird account](/how-to/delete-account) section for more.
- `Admin` role - has full access to the account except that administrators can't delete or update the role of the Owner user and delete the organization account.
- `Network Admin` role - has access to manage network configurations, including access policies, DNS settings, networks, and network routes, but they can only view user and device information and general settings.
- `Auditor` role - can read all configurations but not modify any of them.
- `User` role - has limited access to the account, allowing users to view peers they own and others they can connect to. Users can create personal access tokens for programmatic access.

|  | Owner | Admin | Network Admin | User | Auditor |
| --: | :--: | :--: | :--: | :--: | :--: |
| Peers | ✅ | ✅ | 📖 | 📖 | 📖 |
| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 |
| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 |
| Networks | ✅ | ✅ | ✅ | ❌ | 📖 |
| Network Routes | ✅ | ✅ | ✅ | ❌ | 📖 |
| DNS | ✅ | ✅ | ✅ | ❌ | 📖 |
| Team | ✅ | ✅ | 📖 | ❌ | 📖 |
| Activity | ✅ | ✅ | 📖 | ❌ | 📖 |
| Settings | ✅ | ✅ | 📖 | ❌ | 📖 |

| |
|-:|
|✅ = Full access \| 📖 = Read only \| ❌ = No access|


To manage user roles, proceed to the `Users` tab and click on the user you want to update:
<p>
  <img src="/docs-static/img/how-to-guides/user-tab-list.png" alt="high-level-dia" className="imagewrapper-big"/>
</p>
After that, select the desired role from the dropdown:
<p>
  <img src="/docs-static/img/how-to-guides/user-update-role.png" alt="high-level-dia" className="imagewrapper-big"/>
</p>
Click the `Save` button to save the changes.
<Note>
    Only users with the `Owner` role can assign another user as `Owner`; this action will transfer the `Owner` role to another user, making the current user `Admin`.
</Note>

## Get started
<p float="center" >
    <Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
</p>

- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-31rofwmxc-27akKd0Le0vyRpBcwXkP0g)
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
