> For the complete documentation index, see [llms.txt](https://docs.primeur.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.primeur.com/panorama-2.0.1/setup-and-configuration/users-and-roles-setup.md).

# Users and roles setup

Panorama manages user **access and permissions** through roles.

User authentication can be handled either **locally within Panorama** or by using existing **Primeur Data One or** **Data Watcher credentials**.

This section describes the supported user types, their behavior, and how user data is synchronized.

### User types in Panorama

Panorama supports two types of users:

* **Local users**: they are created directly in Panorama by a **Panorama Administrator** and exist **only in Panorama**. They cannot authenticate to Data One or Data Watcher. 
* **Primeur users (Data One /** **Data Watcher)**: they authenticate to Panorama using their existing **Data One or Data Watcher credentials**. They appear in Panorama **after their first successful login** and are automatically assigned the **Guest** role. Only a Panorama Administrator can modify this role and grant additional permissions.

See the [Manage users](/panorama-2.0.1/setup-and-configuration/users-and-roles-setup/manage-users.md) page and subpages for a detailed description of the features available. 

### Roles and permissions

In Panorama, **roles define what users can do** and are assigned to users by an Administrator.

The **Administrator** account is a local user automatically created during the installation process.\
For more information, see the [Panorama Installation](broken://spaces/foEoE9wUeqRuZEPjYoFD/pages/5bDu0jk7kpWzMXUdTNgm) documentation. 

Users must have at least one role assigned in order to access Panorama features beyond the default **Guest** permissions.

For details on role creation and management, see the [Set roles](/panorama-2.0.1/setup-and-configuration/users-and-roles-setup/set-roles.md) page.

#### User accounts behavior and synchronization

Panorama does not synchronize credentials back to Data Watcher or Data One.

The following behaviors apply:

* If the **password of a Data Watcher or Data One user is modified in Panorama**, the original password configured in **Data Watcher or Data One remains unchanged**. Panorama does not propagate password changes back to Data Watcher or Data One.
* If a user account is **removed from Data Watcher or Data One**, the user will **no longer be able to log in to Panorama**, even if the user is still listed in the Panorama Users tab.
* If a user account is **created directly in Panorama** (local user), that user **does not appear in Data Watcher** **or Data One** and **cannot log in to Data Watcher or Data One**. Local users are valid only within Panorama.