​

User Management

This guide covers how administrators manage users and control access to the CGIAR Risk Intelligence Tool. All user management features require Admin role privileges.

​

Overview

The platform uses AWS Cognito for user authentication and access control. Administrators can:

• Create new user accounts
• Assign roles and permissions
• Enable or disable accounts
• Reset user passwords
• View user activity
• Delete accounts

​

Accessing User Management

​

Creating New Users

​

Welcome Email

When enabled, new users receive an automated email with:

• Platform welcome message
• Login URL: https://[your-domain]/login
• Their username (email address)
• Temporary password
• Instructions to change password on first login

​

Editing User Details

​

Resetting User Passwords

Administrators can set new temporary passwords for users:

​

Enabling and Disabling Users

​

Disable a User Account

To temporarily revoke access without deleting:

1. Click Edit (✏️) on the user
2. Click “Disable User” button
3. Confirm the action
4. User status changes to Inactive (gray badge)

Effects of disabling:

• User cannot log in
• Active sessions are terminated
• All data and assessments are preserved
• Account can be re-enabled at any time

​

Re-enable a User Account

1. Click Edit (✏️) on the disabled user
2. Click “Enable User” button
3. Confirm the action
4. User status changes to Active (green badge)
5. User can immediately log in again

Use Cases for Disabling:

• Employee on extended leave
• Suspected security issues requiring investigation
• Temporary suspension pending review
• Account cleanup before final deletion

​

Deleting Users

​

Searching and Filtering

​

Search Users

Use the search bar at the top of the table:

1. Type user name or email (partial matches work)
2. Results filter in real-time
3. Search is case-insensitive
4. Clear search to see all users

​

Filter by Role

Use the Role dropdown:

• All Roles: Show everyone (default)
• Admin: Show only administrators
• User: Show only regular users

Filtering resets to page 1.

​

Filter by Status

Use the Status dropdown:

• All Statuses: Show everyone (default)
• Active: Show only enabled users
• Inactive: Show only disabled users

Combine with role filter for precise queries (e.g., “Show inactive admins”).

​

Combined Filtering

All filters work together:

• Search: “smith”
• Role: “Admin”
• Status: “Active”

Result: Active administrators with “smith” in name or email.

​

Pagination

The user table supports cursor-based pagination: Navigation:

• Previous button (◀): Go back one page
• Page indicator: Shows current page number
• Next button (▶): Advance to next page

Limits:

• Maximum 60 users per page (Cognito limit)
• Default: 60 users per page
• Filters reset pagination to page 1

​

User Activity Tracking

Each user row displays activity information: Last Login: Timestamp of most recent successful login

• Shown below user name in the table
• Format: “Last login: Mar 4, 2026”
• Updates after each successful authentication

Account Created: Available in the Edit User modal

• Shows original account creation date
• Useful for auditing user tenure

​

Best Practices

Password Management

Creating Secure Temporary Passwords:

• Use random, complex passwords
• Don’t use patterns (e.g., “Welcome123!”)
• Never reuse passwords across users
• Share passwords securely (encrypted channels)
• Document that user must change on first login

Password Reset Policy:

• Only reset when user forgets password
• Verify user identity before resetting
• Log all password reset actions
• Consider MFA for sensitive accounts

Role Assignment

Admin Role Guidelines:

• Limit admin access to essential personnel only
• Review admin list quarterly
• Remove admin privileges when no longer needed
• Use separate admin accounts for automation

When to Grant Admin:

• Platform administrators
• Technical leads managing prompts
• User onboarding coordinators
• Senior analysts needing system oversight

When NOT to Grant Admin:

• Standard risk analysts
• Temporary contractors
• External consultants
• Users who only create assessments

Account Lifecycle

New User Onboarding:

1. Create account with role appropriate to duties
2. Send welcome email with instructions
3. Verify first login within 48 hours
4. Provide platform training
5. Assign initial test assessment

Offboarding Users:

1. Disable account immediately upon departure
2. Review and reassign their assessments
3. Export any user-specific reports needed
4. Delete account after 30-day retention period
5. Document deletion in admin log

Regular Maintenance

Monthly Tasks:

• Review inactive users (no login in 90+ days)
• Disable or delete unused accounts
• Audit admin user list
• Check for anomalous login patterns

Quarterly Tasks:

• Export full user list for records
• Review role assignments
• Update user onboarding documentation
• Verify contact information is current

​

Troubleshooting

​

Security Considerations

Access Control Best Practices:

• Follow principle of least privilege
• Regularly review and remove unnecessary permissions
• Disable accounts immediately when users leave
• Monitor for suspicious login patterns
• Enforce password expiration policies

Compliance and Auditing:

• Export user lists quarterly for compliance
• Maintain logs of all user management actions
• Document role assignment rationale
• Review access controls during security audits

​

Next Steps

• Configure authentication settings →
• Set up multi-factor authentication →
• View audit logs →
• Manage user groups and permissions →