Skip to main content

​
Overview

The User Management API enables you to create, modify, and manage users within your CrowdStrike Falcon environment. You can assign roles, manage permissions, perform user actions, and control access to your organization’s security resources.
All user management operations require User management: Read or User management: Write permissions.

​
User Operations

​
Create a User

Create new users in your Falcon environment. If no password is provided, users receive an email with a link to set their password.
New-FalconUser
​
string
required
Email address for the user account. Must be a valid email format.
​
string
User’s first name
​
string
User’s last name
​
string
Password for the user. Must contain at least 12 characters with uppercase, lowercase, numbers, and special characters (#?!@$ %^&*-). If omitted, user receives email to set password.
​
string
Customer identifier for MSSP child CID user creation. Must match pattern [a-fA-F0-9]{32}(-\w{2})?
​
boolean
Validate if user can be created without actually creating them
Password requirements: minimum 12 characters, at least one uppercase letter, one lowercase letter, one number, and one special character.

​
Get Users

Search for and retrieve user information.
Search by Filter
By Username
By User ID
​
string[]
User identifier(s) in UUID format
​
string
Falcon Query Language expression to filter results (e.g., last_name:'Doe', uid:*'@example.com')
​
string
Sort results by field and direction: first_name|asc, first_name|desc, last_name|asc, last_name|desc, name|asc, name|desc, uid|asc, uid|desc
​
integer
Maximum number of results per request (1-500)
​
integer
Position to begin retrieving results
​
string[]
One or more email addresses to search for
​
string[]
Include additional properties. Available: roles
​
switch
Retrieve detailed user information
​
switch
Repeat requests until all available results are retrieved
​
switch
Display total result count instead of results

​
Modify User

Update user information such as first name or last name.
Update Name
​
string
New first name for the user
​
string
New last name for the user
​
string
required
User identifier (UUID format)

​
Remove User

Delete a user from your Falcon environment.
Delete User
​
string
required
User identifier to remove (UUID format)
Removing a user is permanent and cannot be undone. Ensure you have proper authorization before deleting users.

​
Role Management

​
Assign Roles

Grant roles to users to control their permissions within Falcon.
Assign Role
Assign Multiple Roles
Assign with Expiration
​
string
required
User identifier (UUID format)
​
string
required
Customer identifier (32-character hexadecimal, optionally with 2-character suffix)
​
string[]
required
One or more role identifiers to assign
​
string
Role expiration date and time in RFC3339 format (UTC): YYYY-MM-DDTHH:mm:ssZ

​
Get Roles

Retrieve available roles and user role assignments.
Get All Roles
Get User's Roles
Get Specific Role
​
string[]
Role identifier(s) to retrieve
​
string
User identifier to retrieve role assignments for
​
string
Customer identifier to filter results
​
boolean
Display only direct user role grants (excludes inherited roles)
​
string
Falcon Query Language expression to filter results
​
string
Sort by: cid|asc, cid|desc, role_name|asc, role_name|desc, type|asc, type|desc
​
integer
Maximum results per request (1-500)
​
string
Position to begin retrieving results
​
switch
Retrieve detailed role information
​
switch
Repeat requests until all results are retrieved
​
switch
Display total result count

​
Remove Roles

Revoke roles from users.
Remove Role
​
string
required
User identifier (UUID format)
​
string
required
Customer identifier
​
string[]
required
Role identifier(s) to revoke

​
User Actions

Perform administrative actions on user accounts.
Reset Password
Reset Two-Factor Authentication
​
string
required
Action to perform: reset_password or reset_2fa
​
string[]
required
User identifier(s) to perform action on
reset_password sends a password reset email to the user. reset_2fa clears the user’s two-factor authentication settings, requiring re-enrollment.

​
User Provisioning Workflow

Here’s a complete example of provisioning a new user with roles:
Complete User Provisioning
Temporary Access Grant

​
Common Roles

falcon_administrator

Full administrative access to all Falcon features

detection_responder

View and respond to detections and incidents

event_viewer

Read-only access to events and detections

real_time_responder

Execute Real Time Response sessions

​
Best Practices

1

Use Strong Authentication

Always enforce strong passwords and enable two-factor authentication for all users.
2

Principle of Least Privilege

Assign only the minimum roles required for users to perform their job functions.
3

Regular Audits

Periodically review user accounts and role assignments using Get-FalconUser -Include roles -Detailed.
4

Temporary Access

Use the ExpiresAt parameter when granting temporary elevated privileges.
5

Offboarding Process

Remove users promptly when they leave the organization using Remove-FalconUser.

MSSP Management

Manage multi-tenant environments with Flight Control

Identity Protection

Configure identity-based threat detection rules