You create a user from the Manager → <Admin Domain Name> → Users and Roles menu, and you can assign the user roles for a particular domain at the time the user is created, or you can assign roles at a later time. Only users who have Super User privileges can assign or modify the assignment of user roles, and then only for the domains permitted by their role(s).
Users are stored in the database with their username, a PBKDF2WithHmacSHA512 hash of their password, their role(s), and their roles in various domains. When the user logs in, the Manager makes available only those activities permitted by the user's role.
As most companies now centralize their user management and authentication, the Manager also supports RADIUS and LDAP authentication for users. For either authentication method, you configure the authentication server information, and then when creating a user, you can choose whether the user is a RADIUS, LDAP, or Manager Local user.
User accounts for the Sensor can be centrally stored and authenticated with a TACACS+ (Terminal Access Controller Access Control System plus) server.