# Manage User Identities on Confluent Cloud

<a id="user-accounts"></a>

<a id="user-account-types"></a>

## User account types

Confluent Cloud provides two user account types (local and SSO) and four authentication
methods (username/password, Google, GitHub, and SSO), as summarized in
the following table. Click on the account type to go directly to the relevant
section below.

| User account type                                                   | Authentication method              | Description                                                                                                      |
|---------------------------------------------------------------------|------------------------------------|------------------------------------------------------------------------------------------------------------------|
| [Local](manage-local-user-accounts.md#local-user-accounts)          | Username/password                  | A local user that authenticates using a username and password.                                                   |
| [Local](manage-local-user-accounts.md#sign-in-with-google-accounts) | Google (using Sign in with Google) | A local user account that authenticates using a user’s Google account.                                           |
| [Local](manage-local-user-accounts.md#sign-in-with-github-accounts) | GitHub (using Sign in with GitHub) | A local user account that authenticates using a user’s GitHub account.                                           |
| [SSO](manage-sso-user-accounts.md#single-sign-on-accounts)          | SSO                                | A user account that authenticates using single sign-on (SSO) with<br/>an organization’s identity provider (IdP). |

Note that Confluent Cloud user accounts have the following conditions and limitations:

- Each user account represents one user and allows management of their access to Confluent Cloud.
- User accounts are [organization-level](../../../access-control/hierarchy/cloud-environments.md#cloud-environments) resources and
  there is a [limit on the number of user accounts in an organization](../../../../quotas/service-quotas.md#ccloud-resource-limits-organization). An organization can have only one
  identity provider (IdP).
- You can sign in to a user account using the Confluent Cloud Console or Confluent CLI.
  User accounts may own all types of [API keys](../../workload-identities/service-accounts/api-keys/overview.md#cloud-api-key-ownership).
- You can bind [role-based access control (RBAC)](../../../access-control/rbac/overview.md#cloud-rbac) roles to
  user accounts.
- Principals (user and service accounts) can be granted ACLs, RBAC role bindings,
  or a combination of the two. For details, see [Use ACLs with RBAC on Confluent Cloud](../../../access-control/rbac/use-acls-with-rbac.md#using-acls-with-rbac).
- You can create and manage user accounts using the [Confluent Cloud Console](manage-local-user-accounts.md#local-user-username-password),
  the Confluent CLI command [confluent iam user invitation create](https://docs.confluent.io/confluent-cli/current/command-reference/iam/user/invitation/confluent_iam_user_invitation_create.html), and [Invitation API object](https://docs.confluent.io/cloud/current/ccloud/invitations-iam-v-2/).
- A user account can be a member of one or more organizations. When a user is a
  member of multiple organizations, their authentication type is the same across
  all organizations. For details, see [Manage Multiple Organizations on Confluent Cloud](../../../access-control/hierarchy/organizations/multiple-organizations.md#multiple-organizations).
- If your email provider supports creating multiple accounts or aliases
  by adding a plus sign (`+`) and a tag or word before the `@` sign in an email address,
  you can use this feature to create multiple user accounts on Confluent Cloud.

<a id="multi-factor-authentication"></a>

## Use multi-factor authentication with user accounts

Multi-factor authentication (MFA), including two-factor authentication (2FA),
is supported for Confluent Cloud accounts using the following authentication methods:

- For [local user accounts](manage-local-user-accounts.md#manage-local-user-accounts), see
  [Manage Multi-Factor Authentication with FIDO2 for Local User Accounts in Confluent Cloud](multi-factor-auth.md#multi-factor-auth).
- For [single sign-on (SSO) user accounts](manage-sso-user-accounts.md#manage-sso-user-accounts), use
  the MFA option provided by your SSO identity provider.

For information on security protections used by Confluent to prevent unauthorized
access to user accounts and Confluent Cloud resources, see [Security Protections for Authentication on Confluent Cloud](authentication-protections.md#authentication-protections).

## Related content

- [Manage Local User Accounts](manage-local-user-accounts.md#manage-local-user-accounts)
- [Manage SSO User Accounts](manage-sso-user-accounts.md#manage-sso-user-accounts)