Overview
The User Management API enables you to create, modify, and manage users within your CrowdStrike Falcon environment. You can assign roles, manage permissions, perform user actions, and control access to your organization’s security resources.All user management operations require User management: Read or User management: Write permissions.
User Operations
Create a User
Create new users in your Falcon environment. If no password is provided, users receive an email with a link to set their password.New-FalconUser
Email address for the user account. Must be a valid email format.
User’s first name
User’s last name
Password for the user. Must contain at least 12 characters with uppercase, lowercase, numbers, and special characters (#?!@$ %^&*-). If omitted, user receives email to set password.
Customer identifier for MSSP child CID user creation. Must match pattern
[a-fA-F0-9]{32}(-\w{2})?Validate if user can be created without actually creating them
Password requirements: minimum 12 characters, at least one uppercase letter, one lowercase letter, one number, and one special character.
Get Users
Search for and retrieve user information.Search by Filter
By Username
By User ID
User identifier(s) in UUID format
Falcon Query Language expression to filter results (e.g.,
last_name:'Doe', uid:*'@example.com')Sort results by field and direction:
first_name|asc, first_name|desc, last_name|asc, last_name|desc, name|asc, name|desc, uid|asc, uid|descMaximum number of results per request (1-500)
Position to begin retrieving results
One or more email addresses to search for
Include additional properties. Available:
rolesRetrieve detailed user information
Repeat requests until all available results are retrieved
Display total result count instead of results
Modify User
Update user information such as first name or last name.Update Name
New first name for the user
New last name for the user
User identifier (UUID format)
Remove User
Delete a user from your Falcon environment.Delete User
User identifier to remove (UUID format)
Role Management
Assign Roles
Grant roles to users to control their permissions within Falcon.Assign Role
Assign Multiple Roles
Assign with Expiration
User identifier (UUID format)
Customer identifier (32-character hexadecimal, optionally with 2-character suffix)
One or more role identifiers to assign
Role expiration date and time in RFC3339 format (UTC):
YYYY-MM-DDTHH:mm:ssZGet Roles
Retrieve available roles and user role assignments.Get All Roles
Get User's Roles
Get Specific Role
Role identifier(s) to retrieve
User identifier to retrieve role assignments for
Customer identifier to filter results
Display only direct user role grants (excludes inherited roles)
Falcon Query Language expression to filter results
Sort by:
cid|asc, cid|desc, role_name|asc, role_name|desc, type|asc, type|descMaximum results per request (1-500)
Position to begin retrieving results
Retrieve detailed role information
Repeat requests until all results are retrieved
Display total result count
Remove Roles
Revoke roles from users.Remove Role
User identifier (UUID format)
Customer identifier
Role identifier(s) to revoke
User Actions
Perform administrative actions on user accounts.Reset Password
Reset Two-Factor Authentication
Action to perform:
reset_password or reset_2faUser identifier(s) to perform action on
reset_password sends a password reset email to the user. reset_2fa clears the user’s two-factor authentication settings, requiring re-enrollment.User Provisioning Workflow
Here’s a complete example of provisioning a new user with roles:Complete User Provisioning
Temporary Access Grant
Common Roles
falcon_administrator
Full administrative access to all Falcon features
detection_responder
View and respond to detections and incidents
event_viewer
Read-only access to events and detections
real_time_responder
Execute Real Time Response sessions
Best Practices
Use Strong Authentication
Always enforce strong passwords and enable two-factor authentication for all users.
Principle of Least Privilege
Assign only the minimum roles required for users to perform their job functions.
Regular Audits
Periodically review user accounts and role assignments using
Get-FalconUser -Include roles -Detailed.Related Resources
MSSP Management
Manage multi-tenant environments with Flight Control
Identity Protection
Configure identity-based threat detection rules