# User Management

DefectDojo’s user management surface is different in each edition. Pick the section that matches your installation.

## DefectDojo Open-Source

Open-source DefectDojo uses the **Authorized Users** model: a user is given access to a Product or a Product Type by being added to that record’s Authorized Users list. Superusers and staff can see everything.

- [Authorized Users](https://docs.defectdojo.com/admin/user_management/os__authorized_users/) — how to grant access to Products and Product Types

Authentication on open-source DefectDojo is local username/password plus the password-reset flow.

## DefectDojo Pro

DefectDojo Pro uses a role-based system with Members, Groups, and Global Roles. Users can also be granted SSO access through SAML or one of the supported OAuth providers.

- [Permissions in DefectDojo](https://docs.defectdojo.com/admin/user_management/about_perms_and_roles/) — overview of Roles, Memberships, Global Roles, and Configuration Permissions
- [Set a User’s Permissions](https://docs.defectdojo.com/admin/user_management/set_user_permissions/) — assigning Roles, Global Roles, and Configuration Permissions
- [Share permissions: User Groups](https://docs.defectdojo.com/admin/user_management/create_user_group/) — assigning permissions to many users at once
- [Set Permissions in Pro](https://docs.defectdojo.com/admin/user_management/pro_permissions_overhaul/) — Pro-specific UI for managing Members and Permissions
- [Action permission charts](https://docs.defectdojo.com/admin/user_management/user_permission_chart/) — full reference of every permission for every Role
- [Single Sign-On](https://docs.defectdojo.com/admin/sso/) — SAML and OAuth setup for Pro

## Migrating between editions

If you’re moving from open-source’s Authorized Users to Pro’s RBAC, or upgrading from a pre-3.0 open-source release that used RBAC into the current Authorized Users model, see the [3.0 upgrade notes](https://docs.defectdojo.com/releases/os_upgrading/3.0/#authorized-users-panel-replaces-membersgroups-under-legacy-authorization). Existing access is preserved automatically.

All DefectDojo Pro user permissions in detail

- [Audit Logs →](https://docs.defectdojo.com/admin/user_management/audit_logging/) Access audit logs for DefectDojo objects
- [Creating a New User →](https://docs.defectdojo.com/admin/user_management/os__creating_new_users/) How to onboard a new user onto your DefectDojo instance
- [Creating a New User →](https://docs.defectdojo.com/admin/user_management/pro__creating_new_users/) How to onboard a new user onto your DefectDojo instance
- [Open-Source Permissions →](https://docs.defectdojo.com/admin/user_management/os__authorized_users/) How access to Products and Product Types is granted in open-source DefectDojo
- [Permissions in DefectDojo →](https://docs.defectdojo.com/admin/user_management/about_perms_and_roles/) Summary of all DefectDojo Pro permission options, in detail
- [Re-Enabling Login for SSO Users (Open Source) →](https://docs.defectdojo.com/admin/user_management/os__sso_user_local_login_fallback/) Give SSO-provisioned users a local password after moving to Open Source, where SSO is a Pro-only feature
- [Set a User's Permissions →](https://docs.defectdojo.com/admin/user_management/set_user_permissions/) How to grant Roles & Permissions to a user, as well as superuser status
- [Set Permissions in Pro →](https://docs.defectdojo.com/admin/user_management/pro_permissions_overhaul/) Overhaul, pro feature
- [Share Permissions: User Groups →](https://docs.defectdojo.com/admin/user_management/create_user_group/) Share and maintain permissions for many users in DefectDojo Pro