From 2beb9e1e8192bd18f1daadc649623ed8927160c3 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com> Date: Fri, 19 Dec 2025 00:53:44 +0000 Subject: [PATCH 1/3] Document admin ability to update custom profile attributes via System Console MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added documentation for the new capability introduced in Mattermost v11.1.1 that allows system administrators to view and update users' custom profile attribute values directly from the System Console. Changes: - Added new "Manage user attributes" section to user-management-configuration-settings.rst - Enhanced user-attributes.rst with cross-reference to System Console capability - Documented the navigation path: System Console > Users > User Configuration - Clarified role and permission requirements for this functionality - Ensured proper cross-referencing between related documentation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: Combs7th --- ...user-management-configuration-settings.rst | 29 +++++++++++++++++++ .../manage/admin/user-attributes.rst | 2 ++ 2 files changed, 31 insertions(+) diff --git a/source/administration-guide/configure/user-management-configuration-settings.rst b/source/administration-guide/configure/user-management-configuration-settings.rst index 92c3a1390e8..c7d25735260 100644 --- a/source/administration-guide/configure/user-management-configuration-settings.rst +++ b/source/administration-guide/configure/user-management-configuration-settings.rst @@ -140,6 +140,35 @@ If you deactivate a Mattermost user who has integrations tied to their user acco - **Bot accounts** won't continue to work after user deactivation when the :ref:`disable bot accounts when owner is deactivated ` is enabled. This configuration setting is enabled by default. - **OAuth apps** won't continue to work after user deactivation, and associated tokens are deleted. Manual action is needed to keep these integrations running. +Manage user attributes +~~~~~~~~~~~~~~~~~~~~~~ + +*Available from Mattermost Server v11.1* + +System administrators can view and update users' custom profile attribute values directly from the System Console. This capability provides a centralized way to manage user profile attributes without requiring users to update their own profiles or using command-line tools. + +**To edit a user's custom profile attributes:** + +1. Go to **System Console > User Management > Users** to access all user accounts. +2. Select a **User** to open their User Configuration page. +3. Scroll to the **User Attributes** section to view and edit the user's custom profile attribute values. +4. Update attribute values as needed and save your changes. + +**Permission and role considerations:** + +- This capability is available to system administrators by default +- The ability to view and edit user attributes is controlled by the same system admin permissions that govern other user management functions +- Users retain the ability to edit their own attributes if the attribute is configured as :ref:`user-editable ` + +**Related documentation:** + +- :doc:`User attributes ` - Complete guide to creating and configuring custom profile attributes +- :ref:`mmctl user attribute commands ` - Command-line tools for managing custom profile attributes + +.. tip:: + + Custom profile attributes must be created first through **System Console > Site Configuration > System Attributes > User Attributes** before they can be edited in individual user profiles. See the :doc:`User attributes ` documentation for details on creating and configuring attributes. + Delete users ~~~~~~~~~~~~~ diff --git a/source/administration-guide/manage/admin/user-attributes.rst b/source/administration-guide/manage/admin/user-attributes.rst index fd487ddcdb5..54059a61f1c 100644 --- a/source/administration-guide/manage/admin/user-attributes.rst +++ b/source/administration-guide/manage/admin/user-attributes.rst @@ -124,6 +124,8 @@ Manage attributes - **User Edit Permissions**: From Mattermost v11, all custom profile attributes are admin-managed by default for enhanced security. To allow user editing for specific attributes, administrators can enable this through the **More** |more-icon| menu and selecting **Allow user editing**. This should only be enabled for attributes that do not impact security access controls or organizational policies. Attributes used in ABAC policies should remain admin-managed unless there's a specific business need and the security implications are fully understood. +- **Edit User Attribute Values**: From Mattermost v11.1, system administrators can view and update individual users' custom profile attribute values through the System Console. Go to **System Console > User Management > Users**, select a user, and scroll to the **User Attributes** section to edit their attribute values directly. This provides a centralized way to manage user profile data without requiring command-line tools. See :doc:`User Management Configuration Settings ` for complete details. + In cases where multiple system admins manage system attributes, refresh your web browser instance to see real-time updates to system attributes made by other admins. Sync attributes with your identity provider From c2ab80447c8aa42000d54b6efbead929d683bbf7 Mon Sep 17 00:00:00 2001 From: "Carrie Warner (Mattermost)" <74422101+cwarnermm@users.noreply.github.com> Date: Fri, 19 Dec 2025 15:16:23 -0500 Subject: [PATCH 2/3] Editorial reviews --- ...user-management-configuration-settings.rst | 30 ++++--------------- .../manage/admin/user-attributes.rst | 2 +- 2 files changed, 7 insertions(+), 25 deletions(-) diff --git a/source/administration-guide/configure/user-management-configuration-settings.rst b/source/administration-guide/configure/user-management-configuration-settings.rst index c7d25735260..4fd742b9ad0 100644 --- a/source/administration-guide/configure/user-management-configuration-settings.rst +++ b/source/administration-guide/configure/user-management-configuration-settings.rst @@ -143,38 +143,22 @@ If you deactivate a Mattermost user who has integrations tied to their user acco Manage user attributes ~~~~~~~~~~~~~~~~~~~~~~ -*Available from Mattermost Server v11.1* - -System administrators can view and update users' custom profile attribute values directly from the System Console. This capability provides a centralized way to manage user profile attributes without requiring users to update their own profiles or using command-line tools. - -**To edit a user's custom profile attributes:** +From Mattermost v11.1, you can can view and update custom profile attribute values for individual users directly from the System Console. This capability provides a centralized way to manage user profile attributes without requiring users to update their own profiles or using :ref:`mmctl user attribute commands `. 1. Go to **System Console > User Management > Users** to access all user accounts. 2. Select a **User** to open their User Configuration page. 3. Scroll to the **User Attributes** section to view and edit the user's custom profile attribute values. 4. Update attribute values as needed and save your changes. -**Permission and role considerations:** - -- This capability is available to system administrators by default -- The ability to view and edit user attributes is controlled by the same system admin permissions that govern other user management functions -- Users retain the ability to edit their own attributes if the attribute is configured as :ref:`user-editable ` - -**Related documentation:** - -- :doc:`User attributes ` - Complete guide to creating and configuring custom profile attributes -- :ref:`mmctl user attribute commands ` - Command-line tools for managing custom profile attributes - -.. tip:: +.. note:: - Custom profile attributes must be created first through **System Console > Site Configuration > System Attributes > User Attributes** before they can be edited in individual user profiles. See the :doc:`User attributes ` documentation for details on creating and configuring attributes. + - Custom profile attributes must be created first through **System Console > Site Configuration > System Attributes > User Attributes** before they can be edited in individual user profiles. See the :doc:`User attributes ` documentation for details on creating and configuring attributes. + - Users can edit their own attributes if that attribute is configured as :ref:`user-editable `. Delete users ~~~~~~~~~~~~~ -*Available from Mattermost Server v10.11* - -When using email/password for authentication, you can enable users to permanently delete their own accounts, or you can delete user accounts as a system administrator. +From Mattermost v10.11, when using email/password for authentication, you can enable users to permanently delete their own accounts, or you can delete user accounts as a system administrator. .. config:setting:: delete-users :displayname: Delete users @@ -211,9 +195,7 @@ When an account is permanently deleted, the following data is permanently remove What data is retained? ^^^^^^^^^^^^^^^^^^^^^^^ -The following data remains in the system after account deletion: - -- Audit logs referencing the user's actions, channel and team membership +After account deletion, audit logs referencing the user's actions, channel and team membership are retained. Manage user's roles ~~~~~~~~~~~~~~~~~~~~ diff --git a/source/administration-guide/manage/admin/user-attributes.rst b/source/administration-guide/manage/admin/user-attributes.rst index 54059a61f1c..4f4a96022e9 100644 --- a/source/administration-guide/manage/admin/user-attributes.rst +++ b/source/administration-guide/manage/admin/user-attributes.rst @@ -124,7 +124,7 @@ Manage attributes - **User Edit Permissions**: From Mattermost v11, all custom profile attributes are admin-managed by default for enhanced security. To allow user editing for specific attributes, administrators can enable this through the **More** |more-icon| menu and selecting **Allow user editing**. This should only be enabled for attributes that do not impact security access controls or organizational policies. Attributes used in ABAC policies should remain admin-managed unless there's a specific business need and the security implications are fully understood. -- **Edit User Attribute Values**: From Mattermost v11.1, system administrators can view and update individual users' custom profile attribute values through the System Console. Go to **System Console > User Management > Users**, select a user, and scroll to the **User Attributes** section to edit their attribute values directly. This provides a centralized way to manage user profile data without requiring command-line tools. See :doc:`User Management Configuration Settings ` for complete details. +- **Edit User Attribute Values**: From Mattermost v11.1, you can view and update custom profile attribute values for individual users through the System Console. See the :ref:`Manage user attributes ` documentation for details. In cases where multiple system admins manage system attributes, refresh your web browser instance to see real-time updates to system attributes made by other admins. From 4a2c1efc4906b27440908e7cbb32a44775c8d309 Mon Sep 17 00:00:00 2001 From: "Carrie Warner (Mattermost)" <74422101+cwarnermm@users.noreply.github.com> Date: Fri, 19 Dec 2025 15:19:57 -0500 Subject: [PATCH 3/3] Incorporated reviewer feedback re: feature terminology --- .../comply/embedded-json-audit-log-schema.rst | 4 ++-- .../user-management-configuration-settings.rst | 6 +++--- .../manage/admin/user-attributes.rst | 10 +++++----- .../manage/mmctl-command-line-tool.rst | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/source/administration-guide/comply/embedded-json-audit-log-schema.rst b/source/administration-guide/comply/embedded-json-audit-log-schema.rst index 4da0a83b24e..f18d9ef424c 100644 --- a/source/administration-guide/comply/embedded-json-audit-log-schema.rst +++ b/source/administration-guide/comply/embedded-json-audit-log-schema.rst @@ -801,8 +801,8 @@ Access Control Events | ``updateActiveStatus`` | Updating active status of access control policies | +-------------------------------+-------------------------------------------------------------------+ -Custom Profile Attributes Events -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +User Attributes Events +~~~~~~~~~~~~~~~~~~~~~~~ +-------------------------------+-------------------------------------------------------------------+ | **Event Name** | **Description** | diff --git a/source/administration-guide/configure/user-management-configuration-settings.rst b/source/administration-guide/configure/user-management-configuration-settings.rst index 4fd742b9ad0..584284a1de1 100644 --- a/source/administration-guide/configure/user-management-configuration-settings.rst +++ b/source/administration-guide/configure/user-management-configuration-settings.rst @@ -143,16 +143,16 @@ If you deactivate a Mattermost user who has integrations tied to their user acco Manage user attributes ~~~~~~~~~~~~~~~~~~~~~~ -From Mattermost v11.1, you can can view and update custom profile attribute values for individual users directly from the System Console. This capability provides a centralized way to manage user profile attributes without requiring users to update their own profiles or using :ref:`mmctl user attribute commands `. +From Mattermost v11.1, you can can view and update user attribute values for individual users directly from the System Console. This capability provides a centralized way to manage user profile attributes without requiring users to update their own profiles or using :ref:`mmctl user attribute commands `. 1. Go to **System Console > User Management > Users** to access all user accounts. 2. Select a **User** to open their User Configuration page. -3. Scroll to the **User Attributes** section to view and edit the user's custom profile attribute values. +3. Scroll to the **User Attributes** section to view and edit the user's attribute values. 4. Update attribute values as needed and save your changes. .. note:: - - Custom profile attributes must be created first through **System Console > Site Configuration > System Attributes > User Attributes** before they can be edited in individual user profiles. See the :doc:`User attributes ` documentation for details on creating and configuring attributes. + - User attributes must be created first through **System Console > Site Configuration > System Attributes > User Attributes** before they can be edited in individual user profiles. See the :doc:`User attributes ` documentation for details on creating and configuring attributes. - Users can edit their own attributes if that attribute is configured as :ref:`user-editable `. Delete users diff --git a/source/administration-guide/manage/admin/user-attributes.rst b/source/administration-guide/manage/admin/user-attributes.rst index 4f4a96022e9..5fc64c02856 100644 --- a/source/administration-guide/manage/admin/user-attributes.rst +++ b/source/administration-guide/manage/admin/user-attributes.rst @@ -8,7 +8,7 @@ From Mattermost v10.8, ensure your teams always have the critical information th System attributes enable you to customize user profile attributes to match your organization's unique needs and streamline collaboration while keeping user data centralized and consistent. -From Mattermost v11, you have enhanced control over these custom profile attributes through admin-managed vs user-editable settings. By default, attributes are admin-managed for security, but you can explicitly allow user editing for specific attributes that don't impact access control or sensitive organizational data. These custom profile attributes supplement existing user details visible from the user's profile picture. +From Mattermost v11, you have enhanced control over these user attributes through admin-managed vs user-editable settings. By default, attributes are admin-managed for security, but you can explicitly allow user editing for specific attributes that don't impact access control or sensitive organizational data. These user attributes supplement existing user details visible from the user's profile picture. .. image:: ../../../images/cpa-properties.png :alt: Mobile examples of a user profile with custom user attributes added as system attributes. @@ -20,7 +20,7 @@ If you plan to synchronize system properties with your AD/LDAP or SAML identity .. tab:: Mattermost v11 or later - From Mattermost v11, custom profile attributes have enhanced admin controls with a security-first approach. All attributes are admin-managed by default, providing better security and governance. System administrators can explicitly enable user editing for specific attributes through the System Console interface. + From Mattermost v11, user attributes have enhanced admin controls with a security-first approach. All attributes are admin-managed by default, providing better security and governance. System administrators can explicitly enable user editing for specific attributes through the System Console interface. If your organization uses :doc:`attribute-based access control (ABAC) `, which requires an Enterprise Edition Advanced license, attributes used in access control policies should remain admin-managed for security reasons. You can enable user-managed attributes for ABAC by setting ``EnableUserManagedAttributes`` in ``config.json``, or via an environment variable as noted below, but this should be done with caution: @@ -51,7 +51,7 @@ If you plan to synchronize system properties with your AD/LDAP or SAML identity Admin-managed vs user-editable attributes ------------------------------------------- -From Mattermost v11, system administrators have enhanced control over custom profile attributes through admin-managed vs user-editable settings. This distinction provides better security and governance for organizational profile data. +From Mattermost v11, system administrators have enhanced control over user attributes through admin-managed vs user-editable settings. This distinction provides better security and governance for organizational profile data. **Admin-managed attributes** (default behavior): @@ -122,7 +122,7 @@ Manage attributes - **Delete**: Delete attributes you no longer need or want by selecting **More** |more-icon| and selecting **Delete property**. -- **User Edit Permissions**: From Mattermost v11, all custom profile attributes are admin-managed by default for enhanced security. To allow user editing for specific attributes, administrators can enable this through the **More** |more-icon| menu and selecting **Allow user editing**. This should only be enabled for attributes that do not impact security access controls or organizational policies. Attributes used in ABAC policies should remain admin-managed unless there's a specific business need and the security implications are fully understood. +- **User Edit Permissions**: From Mattermost v11, all user attributes are admin-managed by default for enhanced security. To allow user editing for specific attributes, administrators can enable this through the **More** |more-icon| menu and selecting **Allow user editing**. This should only be enabled for attributes that do not impact security access controls or organizational policies. Attributes used in ABAC policies should remain admin-managed unless there's a specific business need and the security implications are fully understood. - **Edit User Attribute Values**: From Mattermost v11.1, you can view and update custom profile attribute values for individual users through the System Console. See the :ref:`Manage user attributes ` documentation for details. @@ -133,7 +133,7 @@ Sync attributes with your identity provider 1. Synchronize a attribute with AD/LDAP or SAML by selecting **More** |more-icon| and selecting **Link attribute to AD/LDAP** or **Link attribute to SAML**. Mattermost takes you directly to the **AD/LDAP** or **SAML 2.0** configuration settings page in the System Console where you can map the attributes you want to synchronize. -2. Scroll to the **Custom profile attributes sync** section to specify the attribute used to populate the attribute in user profiles. +2. Scroll to the **User attributes sync** section to specify the attribute used to populate the attribute in user profiles. 3. Specify the attribute mapping for the attribute by entering the attribute name in the system attribute's **Attribute** field. The attribute name must match the attribute name in your identity provider. diff --git a/source/administration-guide/manage/mmctl-command-line-tool.rst b/source/administration-guide/manage/mmctl-command-line-tool.rst index db4cdc5287f..3ca82f917fb 100644 --- a/source/administration-guide/manage/mmctl-command-line-tool.rst +++ b/source/administration-guide/manage/mmctl-command-line-tool.rst @@ -2010,7 +2010,7 @@ mmctl cpa .. include:: ../../_static/badges/ent-adv.rst :start-after: :nosearch: -Manage Custom Profile Attributes (CPA) for extended user profile information. +Manage User Attributes for extended user profile information. Child Commands - `mmctl cpa field`_ - Manage CPA fields