# Create a user in Keycloak

> Manually create users if you work in local-only mode or without SSO-only configuration

After you have [set up single sign-on (SSO)](../single-sign-on/_index) for the realm, Keycloak automatically provisions an account for each user on their first sign-in via the enterprise identity provider (IdP). On subsequent sign-ins, Keycloak updates the user properties based on the information from the IdP. Nevertheless, you might need to create user accounts in Keycloak in these cases:

* You use Keycloak in local-only mode, that is, with only local users.
* You haven't applied SSO-only configuration. Read more about [configuring the user experience](../single-sign-on/configure-user-experience).

To create users in Keycloak, complete these steps:

1. In the [Keycloak admin console](../keycloak-admin-console), switch to the **unity** realm.
2. Go to **Manage** > **Users**.
3. Select **Add user**.
4. Provide these settings:

| Field      | Description                                                                |
| ---------- | -------------------------------------------------------------------------- |
| User name  | A unique name for the user. The recommended practice is the email address. |
| E-mail     | The user's email address.                                                  |
| First name | The user's first name.                                                     |
| Last name  | The user's last name.                                                      |

> **Note:**
>
> If you only have the user's full name, you can enter it in either field (First name or Last name) and leave the other empty. Unity Identity only requires the full name, which is constructed from these two fields.

After you have created the user, change the configuration as follows:

1. On the **Credentials** tab, set a password so that the user can sign in.
2. Instruct the user to sign in for the first time. Refer the note hereinafter.
3. [Grant access](./manage-access-for-user.md) to an organization and to a project.

> **Note:**
>
> The system doesn't add new users to the Asset Manager organization when creating them in Keycloak, but only during their first sign-in, with the User user type. In other words, before new users can appear as organization members in Unity Asset Manager, they must sign in first.
>
> * This process happens seamlessly for SSO users within the same first sign-in flow via the enterprise IdP: they are automatically provisioned in Keycloak and then added to the organization right after that.
> * Local users need to sign in first to be added to the organization members. Only then administrators can assign additional user types and roles to them.