--- title: "Managing Users" description: "To access your profile, click \"Manage My User\" from the account menu at the bottom of the primary navigation." url: "https://www.contentstack.com/docs/lytics/account-users" product: "Contentstack" doc_type: "guide" audience: - developers - admins version: "current" last_updated: "2026-11-05" --- # Managing Users ## Managing Your User Profile To open your profile, open the account menu at the bottom of the primary navigation and click your email address at the top of the menu. The profile page shows your personal information and usage statistics. It doubles as an ID card and a stats card. ![](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/am0908cc273b32c40a/df194db730b6278cc2a78ea8/7096729-Screenshot_2023-07-12_at_3.27.43_PM.png) You can edit your name and email address. Both fields are required. A phone number is required only for 2FA. Click **Change Password** to change your password. ## Resetting Passwords Users must reset their own passwords. **Passwords cannot be reset on behalf of others.** To reset your password, open your profile from the account menu and click **Change Password**. A modal opens and prompts you to enter a new password. ![change password](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/am700ec535b9ef0ff5/5cdb4a608aa44aafd09d4806/e955613-Screenshot_2023-07-13_at_8.50.07_AM.png) ![](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/am3a63a6256d20c01e/b4713bb833d26828e20596eb/3f448b8-Screenshot_2023-07-13_at_8.50.07_AM.png) Changing a password immediately invalidates all of the user's current sessions on all machines. ## Managing Account Users To manage account users, click **Manage Users** in the account menu. ![manage users menu](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/am81b4255777956d34/b27ebb74d8fe43a1d4b53376/e6b8e2cfa191418becd3f4b184e46b977436137b0e61cd008b01deb34c03c0d0-account_users_manageusers.png) ### Modifying User Permissions User roles define the access and permissions a Lytics user has when logged in and through the [Lytics APIs](/docs/developers/apis/lytics-api). ![](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/am35f8bced19b95dbf/3f37c5fc643455bf35ae6f6c/81db063-Screenshot_2023-07-13_at_8.55.58_AM.png) A user may have any number of these roles, and the permissions for multiple roles are additive. For example, a user with the Campaign Manager and Content Manager roles has access to all permissions granted by both roles. Users with the Admin role can control other users' roles within your organization through **Manage Users** in the account menu. ### Predefined Roles and Granular Permissions When you assign roles to a user, the Manage Users interface presents two tabs: * **Predefined Roles** are the original set of broad, job-function roles, for example Admin, Audience Manager, or Data Manager. Each role bundles permissions across several feature areas. The matrices further down this page describe what each predefined role grants. * **Granular Permissions** is a catalog of narrower roles, each one paired as a view (read-only) and manage (read and write) for a single feature area. Granular permissions are designed for least-privilege assignments where a user should have access only to the features they actually use. Roles from both tabs can be assigned to the same user. Permissions remain additive across all assigned roles regardless of which tab they come from. For the full granular catalog, common assembly patterns, and notes on custom roles, see [Predefined Roles and Granular Permissions](/docs/lytics/granular-permissions). **The matrices below describe predefined roles** The "What does a user of each role have access to?" and "What tasks can a user of each role perform?" sections cover the predefined roles only. Granular permissions are documented on their dedicated page so the matrices stay focused. ### Notifications & Preferences A user's summary page includes a **Notifications & Preferences** card, located between the **User Details** and **User Roles** sections. This card holds opt-in email notification preferences, such as **Job Alerts** and **Metrics Rule Alerts**. These preferences are not permissions — they do not grant access to any feature area; they only control which emails the user receives. The card appears only when notification preferences are available for the account. **Users can manage their own notification preferences** Unlike the predefined roles and granular permissions, which an admin must set and which stay locked when you edit your own profile, the Notifications & Preferences card is editable on your own profile. This lets any user opt in or out of their own alert emails without an admin's help. Changing another user's role assignments still requires the Admin predefined role. ### Managing Personally Identifiable Information You can mark any user fields in your account that contain Personally Identifiable Information (PII) through the private fields account setting. These fields are hidden from anyone who does not have the Admin, Data Manager, or User Search role. To make sure these fields are also hidden in the segment scan, verify with [Lytics Support](https://support.lytics.com/hc/en-us) that field hiding in the segment scan is enabled for your account. ### Predefined Role Reference Each predefined role has a stable slug used in API calls and SSO group assertions, a display name shown in the Manage Users interface, and a purpose. The matrices further down this page show exactly which features each role can access. Slug Display Name Purpose admin Admin Grants read/write access to all features and management functions, including inviting users and assigning roles. auth\_alerts Auth Alerts Receives the access token expiration emails (see [Access Tokens](/docs/lytics/access-tokens)). Grants no access on its own, so pair it with another role. segment\_manager Audience Manager Grants read/write access to audiences. campaign\_manager Campaign Manager Grants read/write access to campaigns and audiences without PII, including exporting audiences without PII and publishing campaigns. content\_manager Content Manager Grants read/write access to content classification, collections, and topics. data\_manager Data Manager Grants read/write access to schemas, queries, users, content, and integrations. Includes PII user fields access. report\_viewer Discovery Insights Grants access to explore Discovery insights. experience\_manager Experience Manager Grants read/write access to Experiences. flow\_read\_write Flow Read/Write Grants read/write access to Flows. orchestrate Goal Manager Grants read/write access to Goals and Experiences features. marketer Marketer Grants read/write access to audiences and campaigns, but cannot publish campaigns or export audiences. observer Observer Grants read access to audiences and campaigns. report\_manager Report Manager Can view, create, and delete audience insight reports. user\_search User Search Grants the ability to search for users and view their profiles. Required, alongside the private fields setting, to view PII fields. ### What does a user of each role have access to? A user's role determines which parts of the Lytics app they can access. Here is a breakdown of what is shown in the navigation for each role. Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search **Dashboard** Dashboard x x x x x x x x x x x **Goals** Goals x x **Experiences** Experiences x x x **Audiences** Audiences x x x x x x x x Discovery x x User Search x x x User Profiles x x x GDPR Profile Delete x x **Content** Overview x x x x Topics x x x x Collections x x x x **Data** Jobs / Auths x x x x x Data Streams x x User Fields x x Queries x x Schema Audit x x Personalize x x x x Look-a-like Models x > To access lookalike models, you need the account admin role or a combination of Discovery Insights and a role that gives access to Jobs / Auths. ### What tasks can a user of each role perform? Roles define a set of permissions the user has, which also dictates what actions they can take in the app and through the APIs. Here is a breakdown of the permissions for each role by feature. #### Personally Identifiable Information (PII) To shield PII from users who should not have access, use the private fields account setting to mark the profile fields you want to hide from anyone who does not have the Admin, Data Manager, or User Search role. Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x #### Audiences (without PII) Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x x x x x Create x x x x x x Edit x x x x x x Duplicate x x x x x x Delete x x x x x #### Content Topics Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search Blocklist x x #### Content Collections Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x x Create x x x Edit x x x Duplicate x x x Delete x x #### Authorizations (for imports & exports) Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x x x Create x x x x x Edit x x x x x Delete x x x x x #### Jobs (imports & exports) The former **Integrations** tab has been replaced by **Data Pipeline** > **Jobs** and **Account** > **Security** > **Authorizations**, where you manage your imports and exports. Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x x x Create x x x x x Pause x x x x x Update x x x x x Delete x x x x x #### Accounts & Users Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search Invite User x Manage User Roles x Create Account x Edit Account x View Account Usage x #### Personalize Campaigns Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search View x x x x Create x x x Edit x x x Duplicate x x x Delete x x #### Additional API-Only Features All roles have API read access to topic rollups, segment collections, and SegmentML. Marked below are the roles with full CRUD access to these features. Admin Audience Manager Campaign Manager Content Manager Data Manager Discovery Insights Experience Manager Goal Manager Marketer Observer User Search Content Topic Rollups x x x x Content Classification x x x x Queries API x x Segment Collections x x x x x x x x Lookalike Models x x Subscription x x x ### Inviting Users To invite a new user to the account, click **Create New** in the user list. ![](https://images.contentstack.io/v3/assets/blt2d43f51baca745a8/amac58113726977af2/988a14b6bc6cdeaf285fa2bb/e05a4c8-vault-invite.png) When you invite a new user, you're prompted for an email address and the roles that set the user's level of access within your Lytics account. After you complete this form, the new user gets an email with a link to the Lytics account login screen. ### Removing Users From the user list, select the user you want to delete. On their profile page, click **Delete User** to remove them from Lytics.