The users on the IAG are classified into three types: local users, AD domain users, and temporary users.

Local users: Users can be managed and configured on Access Mgt > User Management > Local Users.

Local users can be added in the following ways:

1. Manually created by the console administrator.

2. Set on the Authentication Policy page and automatically add after authentication (including users who do not require authentication, users authenticated on a third-party server, and SSO users).
3. Users imported by using the import function.
4. Users synchronized to the IAG using the automatic synchronization function on the user management page.

AD domain users: If there is an AD domain on the intranet and the IAG needs to work with the AD domain server for third-party authentication and SSO authentication, the IAG will obtain users of the AD domain and the organization structure in real time. The organization structure of the IAG is the same as in the AD domain. AD domain users can be managed on the page displayed after choosing User Management[A30][31] > Local Users > Domain User[LCH32][33]. AD domain users are not synchronized to the IAG. Therefore, they cannot be deleted or moved to the IAG. Instead, you can associate Internet access policies and traffic control policies with this type of user.

Temporary users:  users authenticated by the IAG but not included in the organization structure on the IAG. This type of user will not be displayed on the page after choosing Access Mgt > User Management > Local Users.