> For the complete documentation index, see [llms.txt](https://docs.kc7cyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kc7cyber.com/manage-your-tenant/managing-users.md).

# Manage users

This page covers adding people to your tenant or classrooms, assigning them a role, changing roles later, and removing access. The full permission breakdown is in [Roles and permissions](#roles-and-permissions) below.

This page is for tenant managers and classroom managers.

## Before you start

* You need Tenant Manager access to assign Tenant Manager or Classroom Manager roles tenant-wide.
* Classroom Managers can manage users only in their assigned classrooms.
* Student limits apply per classroom and depend on your tier (Free 50, Starter 100, Professional 500). Email <code class="expression">space.vars.support\_email</code> to upgrade.

## Where to manage users

In a classroom, open the **Students** tab. For tenant-wide changes, use the tenant **Users** tab.

## Add participants to a classroom

Three methods, each suited to a different scale.

{% tabs %}
{% tab title="By username search" %}
Use this for selective programs, small groups, or anywhere you want explicit control over who joins.

1. Open the classroom's **Students** tab.
2. Type the participant's KC7 username in the search field.
3. Select the matching user.
4. Click **Add**.

Participants must already have KC7 accounts.
{% endtab %}

{% tab title="By classroom join link" %}
Use this for large cohorts, open enrollment, or anywhere self-service makes sense.

1. In classroom settings, generate a join link and password.
2. Share the URL and password with participants.
3. Participants click the link, create or sign in to a KC7 account, and enter the password.

Anyone with the link and password can join. If the credentials get over-shared, regenerate them. The old combination stops working immediately.
{% endtab %}

{% tab title="By CSV import" %}
Use this for enterprise rosters, migrations, or any deployment with 100+ users.

1. Prepare a CSV with usernames, emails, or other identifiers.
2. Open the classroom's user management import.
3. Upload the file.
4. Review the report. It lists successful enrollments and any errors.

Clean, consistent data matters. Partial failures from formatting issues need manual cleanup.
{% endtab %}
{% endtabs %}

{% hint style="info" %}
Student limits are per classroom: Free 50, Starter 100, Professional 500, Enterprise unlimited. Email <code class="expression">space.vars.support\_email</code> to upgrade.
{% endhint %}

## Assign a role

To promote someone to Classroom Manager, open the classroom's **Users** tab, select the user (they must already be in the tenant or classroom), set their role to **Classroom Manager**, pick the classrooms they manage, and confirm.

To assign Tenant Manager, open the tenant **Users** tab, select the user, and set their role to **Tenant Manager**.

## Change a role

Open the **Users** tab where the user lives (tenant or classroom), click the user, pick the new role, and save. Changes take effect immediately, though some users need to log out and back in for new permissions to surface. Historical data and analytics are preserved across role changes.

## Remove access

{% hint style="warning" %}
Removing a user is reversible (you can re-add them) but they lose access immediately and any in-progress activity stops. Export anything you need first.
{% endhint %}

Open the relevant **Users** tab, select the user, click remove, and confirm. The effect depends on the scope:

| Scope     | Result                                                       |
| --------- | ------------------------------------------------------------ |
| Tenant    | User loses access to every classroom and game in the tenant. |
| Classroom | User loses access to that classroom only.                    |
| Game      | User loses access to that game only.                         |

Historical data and analytics are preserved.

## Routine reviews

Audit roles at term boundaries or at least once a year, and remove access promptly when someone changes roles or leaves. When offboarding, check all of a user's role assignments first, export anything you need to keep, remove classroom memberships, then revoke manager roles.

Default new users to Participant. Promote to Classroom Manager only when they need to configure games or manage participants, and reserve Tenant Manager for full platform admins. Most organizations only need 2 to 5 Tenant Managers.

## Roles and permissions

KC7 has three roles, each with a different scope.

* **Tenant Manager.** Entire tenant. Automatic for the user whose tenant is created; existing Tenant Managers can promote others. Full access: create and delete classrooms, manage every user and role, see all analytics, configure tenant settings and branding, and export any data.
* **Classroom Manager.** One or more assigned classrooms. Granted per classroom by a Tenant Manager. Can create, configure, and delete games in assigned classrooms, add and remove participants, view analytics, and edit classroom settings. Can't touch other classrooms, create classrooms, change tenant settings, assign roles, or manage billing.
* **Participant.** Enrolled games. Automatic when someone joins a classroom or game. Can play, submit answers, earn badges, track their own progress, and see leaderboards when enabled. No access to others' answers or any management features.

### Permission matrix

| Action                           | Tenant Manager | Classroom Manager     | Participant |
| -------------------------------- | -------------- | --------------------- | ----------- |
| Create / delete classroom        | Yes            | No                    | No          |
| View / edit classroom            | All            | Assigned              | No          |
| Create / configure / delete game | Yes            | In assigned classroom | No          |
| Play game                        | Yes            | Yes                   | If enrolled |
| Add / remove participants        | Yes            | In assigned classroom | No          |
| Assign roles                     | Yes            | No                    | No          |
| View analytics                   | All            | Assigned              | Own only    |
| Export data and reports          | All            | Assigned classroom    | No          |
| Tenant settings and branding     | Yes            | No                    | No          |

## Troubleshooting

**User can't access a classroom.** Confirm they have a KC7 account, are enrolled, have the right join link and password if self-enrolling, and have a role that includes classroom access.

**User has wrong permissions.** Review their role and classroom assignments, check whether they're at the tenant or classroom level, and have them log out and back in.

**Bulk import failed.** Verify the CSV format matches the template, check for typos, and read the import error report. Add problem rows manually.

## Next steps

* [Organize classrooms](/manage-your-tenant/classrooms.md)
* [Track analytics](/manage-your-tenant/analytics.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.kc7cyber.com/manage-your-tenant/managing-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.