From what I understand, There are 3 base roles which can do this:

  1. Sitecore Local Administrators
  2. Sitecore Client Securing
  3. Sitecore Client Account Managing

So I suppose if I want to get the roles which inherit from these base roles I'll do a query to my database consisting partly of this: enter image description here

After to find out which users have this I'll do another query on the Users Database to find out which users have these rights.

ANYWAYS, I suppose the question is really then which base roles have permissions to add/remove other users from sitecore?

  • 1
    As a note, do not forget that users with the admin checkbox can also manipulate user accounts. You may want to include those too! Commented Sep 21, 2021 at 10:18

3 Answers 3


Sitecore Client Account Managing is the right role to add/remove users.

From Sitecore Documentation :

Gives the user access to maintain users, roles, and domains in the Access Manager, the Domain Manager, the Role Manager, and the User Manager.


To view the members of this Role open Sitecore Client Account Managing role in user manager and click Members:

enter image description here


There is no OOTB functionality to get users that can remove other users, but you can use some workarounds.

I suggest using an API call below to check if you have enough permissions to call the User Manager application for the current user:

SecurityHelper.CanRunApplication("Security/User Manager");

Then you can go through all users and you can use a similar code to check if the specified user can open the application:

List<Sitecore.Security.Accounts.User> powerUsers = Sitecore.Security.Accounts.UserManager.GetUsers()
    .Where(user => CanRunApplication("Security/User Manager", user))

public static bool CanRunApplication([CanBeNull] string applicationName, [CanBeNull] Sitecore.Security.Accounts.User user)
    if (user == null 
        || applicationName.IsNullOrWhiteSpace())
        return false;

    if (!applicationName.StartsWith("/", StringComparison.InvariantCulture))
        applicationName = "/sitecore/content/Applications/" + applicationName;

    using (new UserSwitcher(user))
        Sitecore.Data.Items.Item item;
        using (new Sitecore.SecurityModel.SecurityDisabler())
            item = Sitecore.Client.CoreDatabase.GetItem(applicationName);

        return item != null && item.Access.CanRead();

Few points to highlight there:

  1. Actually, if you have read permissions to "/sitecore/content/Applications/Security/User Manager" item, then you can call this application.
  2. "New" and "Delete" buttons are always enabled.

So, if you have permission to open this application then you can create/delete users.


Sitecore OOTB Role to maintain user is Sitecore Client Account Managing. So to check who all can manage user, we should be checking which all users are associated with this role.

Role: Sitecore Client Account Managing
Gives the user access to maintain users, roles, and domains in the Access Viewer, the Domain Manager, the Role Manager, and the User Manager applications.

Steps to check list of user having part of this role

  • Click on Role Manager on Launchpad
  • Select sitecore\Sitecore Client Account Managing
  • Click on Members from the Menu

enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.