# Set User Privileges

Users need appropriate privileges to access and manage Identity and Access Management (IAM) resources. IAM has a group privilege called **Access and manage Identity and Access Management resources**, which must be enabled for a group so that the members of this group inherit it through group privilege settings and can access and manage the IAM resources.

{% hint style="info" %}
**Prerequisite:** Make sure you have one or more **Groups** in the **User Manager**. To create one, see [<mark style="color:blue;">Create a group</mark>](../../../user-management#create-a-group).
{% endhint %}

To set user privileges, follow these steps:

1\. In the **DCD**, go to **Menu** > **Management** > **Users & Groups**.

2\. Select the **Groups** tab in the **User Manager** window.

3\. Select the appropriate group to which you want to assign privileges from the list of groups.

4\. In the **Privileges** tab, select **Access and manage Identity and Access Management resources**.

![Set user privileges](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-f2ce1c5e0d37a1967eeb10531e4887d1aa8b4ed8%2Fiam-federation-user-privileges.png?alt=media)

{% hint style="success" %}
**Result:** The privilege to manage IAM resources is granted to all the members in the selected group.
{% endhint %}

## Revoke user privileges

To revoke user privileges, follow these steps:

1\. In the **DCD**, go to **Menu** > **Management** > **Users & Groups**.

2\. Choose one of the following options:

<details>

<summary><strong>Option 1: Remove the User from all the Groups in which the Privilege is Enabled</strong></summary>

1\. Select the user from the **Users** tab in the **User Manager** window.

2\. Go to the **Groups** tab, select the group name enabling the privilege, and click **Remove from Group**.

3\. Repeat **step 2** for all the groups where the privilege to be revoked is applied.

![Remove the user from the Group](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-1057d7c4432d7c9bb4c3fe4b430ef1773443e42b%2Frevoke-user-privilege-remove-from-group.png?alt=media)

</details>

<details>

<summary><strong>Option 2: Remove the Privilege from all the Groups the User Belongs To</strong></summary>

1\. Select the **Groups** tab in the **User Manager** window.

2\. Select the **Group Name** in which the privilege to be revoked is applied and the user belongs to this group.

3\. Clear the checkbox against the privilege name.

4\. Repeat steps **2** and **3** for all the groups where the privilege to be revoked is applied.

![Remove the privilege from all Groups user belongs to](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-604fc85e33988f09166b6454db1c865327e10516%2Frevoke-user-privilege-from-all-groups.png?alt=media)

{% hint style="warning" %}
**Warning:** This option removes the privilege for all the members in the groups from which the privilege is revoked.
{% endhint %}

</details>

{% hint style="info" %}
**Note:** To revoke this privilege from a contract administrator, turn off the administrator option on the user account. After performing this action, the contract administrator will become a contract user, and the privileges set up for the user before becoming an administrator will be in effect.
{% endhint %}

{% hint style="success" %}
**Result:** The privilege is successfully revoked.
{% endhint %}
