# Managing Users

## What a user is

Anyone who signs into the CRM has a **user** record. Each person should have **their own account** — never a shared login. Individual accounts keep the activity history accurate (who logged which session, who changed what) and let you remove someone's access cleanly when they leave.

## Types of user

| Type | Who it's for |
|---|---|
| **Regular user** | Staff and mentors who sign in and do everyday work. |
| **Administrator** | Can reach the Administration panel and change system settings. Grant this to as few people as possible. |
| **API user** | Non-human accounts used by integrations (e.g. the website or documentation tooling). You'll rarely create these. |
| **Portal user** | External people using a limited portal, if CBM uses one. |

## Adding a user

1. Administration → **Users** → **Create User**.
2. Enter their name, **User Name**, and **Email Address**.
3. Set the **Teams** and **Roles** that match their job — this is what controls what they can see and do (see [Roles, Teams & Permissions](https://docs.clevelandbusinessmentors.org/link/44)).
4. Decide whether they're an administrator (usually **no**).
5. Save — then either set a password or have the CRM email them a setup link (recommended if email is configured).

> **Get teams and roles right at creation time.** They govern the user's access; skip them and the person may see far too much or too little.

## Resetting a password

- Open the user → **Actions / ⋮ menu** → **Change Password**, or
- Have the person use **"Forgot password?"** on the login screen (requires outbound email — see [Chapter 5 — Integrations](https://docs.clevelandbusinessmentors.org/books/espocrm-system-guide/chapter/integrations)).

## When someone leaves: deactivate, don't delete

- Open the user and turn **Is Active** off. This blocks sign-in but **keeps all their history** intact and correctly attributed.
- **Avoid deleting users** — deletion can orphan or reassign the records they created. Deactivating is almost always the right move.

> Deactivate first. You can always reactivate; undoing a delete is far harder.