User management is the set of capabilities an identity system uses to create, organize, update, and deactivate user accounts and control their access over time. It’s the operational backbone of identity: the directory and lifecycle services that keep every account accurate, current, and appropriately permissioned.

It’s not the flashiest part of an identity platform, but it’s the foundation everything else stands on. Authentication, authorization, and fraud decisioning all read from the user record, so the quality of that record sets the ceiling on everything built above it.

What user management includes

• Account lifecycle: creating accounts at registration, maintaining them through changes, and deactivating or closing them cleanly. Account states (active, locked, dormant, closed) are tracked and enforced.
• The profile directory: the store of identity data: identifiers, attributes, verified information, preferences, and consent.
• Groups and roles: structures that organize users and connect to authorization decisions (who belongs to what, and therefore what they can access).
• Self-service: letting customers update their own details, manage preferences, and handle routine account tasks without a support ticket.

Why data quality is the whole game

An identity is only as trustworthy as the record behind it. Duplicate, stale, or fragmented user records create real problems: a single customer splintered across mismatched profiles, inconsistent security applied to the "same" person, and fraud signals that can’t be correlated because the system doesn’t realize two records are one human. Clean, unified, current user management is what makes higher-order capabilities (personalization, risk scoring, cross-channel recognition) actually work.

User management in a customer context

Customer user management differs from workforce directory management in the usual CIAM ways: enormous scale, heavy self-service, and consent as a core attribute. It has to keep a consistent record as customers move across web, mobile, and call center, so one person doesn’t fracture into several. In Mosaic, user management and authorization form a shared directory layer that the rest of the platform (authentication, orchestration, fraud detection) draws on, so decisions everywhere are made against one accurate view of the customer.

Self-service and the security balance

A defining feature of customer user management is self-service: customers expect to update their own email, phone, password, and preferences without calling support. Self-service is essential at consumer scale (no support team can manually service millions of routine changes) but it’s also a security-sensitive surface. The very actions customers perform themselves (changing an email or phone, resetting access) are exactly the actions an attacker performs to cement an account takeover. An attacker who swaps the recovery email has effectively seized the account.

The resolution is to treat sensitive self-service actions as risk-based moments, not free operations. Viewing a profile is low-stakes; changing the recovery email or phone should trigger step-up verification and often a notification to the existing contact, so the legitimate owner is alerted to unexpected changes. Good user management makes routine updates effortless while wrapping the dangerous ones in proportionate friction, which is only possible when the user directory and the risk engine are part of the same system rather than disconnected tools.

Frequently asked questions

What does user management include?

Account creation and deactivation, the profile/directory store, roles and groups, and self-service account updates.

How does user management relate to authorization?

User management maintains the accounts and attributes; authorization uses them to decide what each user can access.

Why does user data quality matter?

Authentication, authorization, and fraud detection all read from the user record, so inaccurate or fragmented data weakens every decision built on it.

What’s different about customer user management?

It operates at consumer scale, emphasizes self-service, and treats consent as a core attribute of the record.

Related: CIAM · Authorization · Identity Lifecycle · Role-Based Access Control (RBAC) · Customer Identity