User Management Platform

TIP: To follow the steps as you work, open the User Management Platform guide in its own browser window next to the platform.

The User Management Platform (UMP) allows its administrators to manage their own access and permissions, get detailed user insights, and oversee access and permissions for their team members.

Here's what you need to know about the UMP:

As an administrator, you're granted either view-only or full editing permissions.
You can quickly configure permissions through bulk editing or assigning users to access groups.
For more granular control, you can nest access groups so that each group inherits permission settings from its parent group.
Each sub-admin must belong to a single access group, and cannot be directly assigned to specific partners or advertisers.

NOTE: Legacy and non-standard roles and permissions are not accessible in the UMP.

The following sections offer more details and tips for using the UMP.

Get started

This guide is for users with administrative permissions who manage access in the UMP for brands and agencies. Before you start, make sure you meet the following requirements:

You belong to an enrolled organization.
You have user-management permissions.
You are assigned to at least one access group.
(Optional) You are invited to brand-agency shared access.

If you are unsure you meet the requirements, contact your Technical Account Manager.

Group relationships

A key part to managing users is understanding the groups they are associated with, such as access groups, root access groups, and organizations. The following diagram shows how groups and roles are related in the UMP from the organization to the user level. For example, the one-to-many arrow indicates how a root access group can own multiple access groups.

The following table describes them in detail.

Group Type	Description
Organization	A primary ownership boundary for user management, such as a brand or agency. To learn about the relationship between a brand and agency access, see Brand vs. agency access.
Root access group	A special system-defined access group that every organization has exactly one of, and that all other access groups are based on.
Access group	A unit of access control for permissions and scope is assigned to users within an organization. Each user is assigned one or more roles.

Brand vs. agency access

In a brand‑owned, agency‑operated setup, the brand and agency maintain separate organizations while collaborating through shared access. The brand retains full ownership and control, while granting the agency the ability to manage access for day‑to‑day operations. This model explains why some users appear visible to the brand user manager but not editable, and why certain access is shared instead of owned.

NOTE: The UMP does not directly label users as part of a brand or agency. Instead, the UMP infers (and then "remembers") which organization they belong to. That organization itself is what represents a brand or an agency.

The following diagram shows the relationships between some groups for a brand and an agency in the UMP. For example, a dotted line indicates that a brand user manager has limited visibility into the profiles and assignments of related agency users.

Area	Brand User Manager	Agency User Manager
Organization	Owns and manages brand organization and brand-managed access groups.	Owns and manages agency organization and agency-managed access groups.
User management	Full view and editing access to all brand users.	Full view and editing access to all agency users.
Visibility	Limited visibility into invited agency users (profiles and limited assignments).	No direct management of brand users.
Ownership	Retains full ownership and final control.	Operates within permissions granted by the brand.

Initial setup

As an admin, use the UMP to sign in and access user management features. Your available setup and access options depend on your assigned roles.

Roles

The following table describes the available roles in the UMP. You can mix and match roles to customize access according to your needs.

Role	Description
`Campaign Manager (View-Only)`	View partner, advertiser, and campaign details.
`Campaign Manager (View/Edit)`	View and update partner, advertiser, and campaign details.
`Reporting Manager (View-Only)`	View and download user-defined reports (also known as My Reports).
`Reporting Manager (View/Edit)`	Create, view, and download user-defined reports.
`PMP Manager (View-Only)`	View first-party deals and commitments.
`PMP Manager (View/Edit)`	Create and manage first-party deals and commitments.
`DMP Manager`	Create and manage audiences under Data Marketplace.
`User Manager (View-Only)`	View user details, roles, and access groups.
`User Manager (View/Edit)`	Add and update user details, roles, and access groups. Can also make bulk edits.

Access

To log in to the UMP, complete the following steps:

In OpenTTD, click the login button.
On the login page, enter your username and password, then do either of the following:
- In the OpenTTD homepage, select App Management, then select User Management.
- Navigate directly to the User Management Platform.

NOTE: To get proper access permissions, see Getting started for audience data providers. For details on activating your API login, resetting the password, and other details, see FAQs.

If you have a User Manager (View-Only) role, you can log in to access the UMP dashboard. Those who also have the User Manager (View/Edit) role can also assign permissions to users and make bulk edits here for team permissions. For details on editing users, see Manage users.

When logged in, the UMP appears with the Manage Users tab open by default. The tab shows a table with the names of users you have access to. Depending on your role, there are also controls for searching, filtering, managing users and access groups, creating reports, and adding users.

Dashboard ui overview

The UMP dashboard displays any user with access to at least one partner or advertiser. However, it does not display the following:

API-related accounts
Partner seats owned by a brand but operated by an agency
User accounts from The Trade Desk

The following image of the dashboard labels commonly used controls in the Manage Users tab:

The following table describes the functions of the controls labeled with alphabetical letters in the preceding screenshot.

Key	Control	Description
A	Admin tools	Use the tabs to navigate to different screens for managing users and access groups, and creating reports. The blue underline indicates the current tab.
B	Search	Enter any of the following: User name (or ID) Email address Partner ID Access group name You can use partial IDs, and case doesn't matter.
C	Results filter	Choose to see all the users you have access to, or only the active or disabled ones.
D	Add user	Submit a form to add a user with appropriate access to the platform.
E	Select users	If you have the `User Manager (View/Edit)` role, selecting a user opens a blue banner with the following editing options: Disable Users Enable Users Edit If you select multiple users, the same banner displays the following options for bulk editing: Add Groups Remove Groups Add Roles Remove Roles For details on available roles, see Roles.
F	User details	Click a user name to open a popup with user details, including associated system settings, group information, and roles and permissions.
G	Search results	The dashboard displays up to 25 users per page. Click the arrows to navigate to the next or previous set of search results.

TIP: In the UI, you can only sort the users on the page by the Name, Email, and Last Active columns. For more sorting and other options, export your users to a CSV file.

Manage users

If you have the User Manager (View/Edit) role, you can do the following:

View user details.
Add a user.
Update user roles and permissions, either individually or in bulk.
Disable a user.

For instructions on managing access groups, see Manage access groups.

View user details

To view user details, in the Manage Users tab, click a user. A User Details popup opens, displaying user information such as associated system settings, group information, and roles and permissions.

TIP: To find out what UMP administrative privileges you have, go to User Details for your own user account. Your permission is listed as either User Manager (View-Only) or User Manager (View/Edit).

Your view and editing privileges in the UMP depend on the type of access you have, as described in the following table.

Access Type	Description
Organization access	Granted if you have access to partners or advertisers within the scope of an admin, and the root access group those partners roll up to.
Root access group	Granted if you have access to the first access group created for an organization. It includes all the partner IDs that belong to the organization.
Shared access	Granted if you have any partners or advertisers outside the scope of an admin. In this case, a filtered list of partners and advertisers is displayed. If the checkbox next to a user is not selectable (grayed out) and the Edit and Disable User buttons are not clickable in the user's User Details page, that means you have shared access only for this user.

Add a user

Here's what you need to know about adding users:

Adding users is restricted by email domain. To add a new email domain, contact your Technical Account Manager.
When adding an identity provider for a user, validate it with the user's login email address. If the provider isn't listed, in the Identity Provider dropdown menu, click Refresh to update available options.

To add a user, do the following:

In the Manage Users tab, at the top-right, click Add User.
In the Add User panel, follow the instructional text to enter user information correctly.

TIP: As an option, use the Ticket Reference field to record the ticket number associated with the request to add or update a user. This can come from your internal company ticketing system or from The Trade Desk.
Click Submit.

The user appears as a new row in the Manage Users tab.

Update a user

You can update user details either individually or in bulk. This includes system settings (like their login password and multi-factor authentication), as well as group information, roles, and permissions.

TIP: You can also update multiple users at once by managing them in access groups. For details, see Manage access groups.

Update a single user

To update a user individually, do the following:

In the Manage Users tab, click the name of a user to go to their User Details page.
Click the Edit button for the section you want to update.
In the popup for that section, follow the instructional text to update information correctly.
Click Save.

The user is updated in the UMP.

TIP: To disable or enable a user quickly, select a checkbox by the user name to display a blue banner with these options.

Update multiple users at once

To bulk edit more than a user at a time, do the following:

In the Manage Users tab, select the checkboxes next to the users whose details you want to update.
In the blue banner, select one of the following options:
- Disable Users
- Enable Users
- Add Groups
- Remove Groups
- Add Roles
- Remove Roles
The following is a screenshot of the blue banner for bulk editing:
In the bulk-edit popup, follow the instructional text to update information correctly.
Click Submit.

The selected users are updated in the UMP.

Disable a user

To suspend a user's access in the system, do the following:

In the Manage Users tab, click the name of a user to go to their User Details page.
At the top-right, click Disable User.

The user's access to the system is disabled.

Manage access groups

Another way to manage users is by using access groups. If you have the User Manager (View/Edit) role, you can assign individuals to access groups rather than to individual partners and advertisers.

Access groups can be nested hierarchically (for example, by using parent and sub-access groups). This approach allows for more granular and scalable permission management. For example, you can configure it so that Partner A, Partner B, and Advertiser X are in a single access group. This collection can then be assigned to one or many users.

NOTE: When a partner is onboarded to UMP, a parent group is created automatically and at least one administrator is added.

The following screenshot shows the Manage Access Group tab for managing access groups:

The following table describes the functions of the controls labeled with alphabetical letters in the preceding screenshot.

Key	Control	Description
A	Parent group search	Search parent groups by name.
B	Edit	Update the access group name and description.
C	Disable	Click the menu button to disable the access group and revoke access for all users in that group.
D	Access group settings	Use the tabs to manage the settings of the selected access group, such as sub-access groups, partners, advertisers, and users.
E	Selected group setting search	Search the results within the selected access group setting tab.
F	Add (the actual name of the button changes depending on the tab you are on)	Click the Add button to add more items to the group setting. For example, if you are on the Access Group tab, the button is Add Access Group. NOTE: The Users tab does not have an Add Users button. To add a user, see Add user.
G	Select item	Select one or more items in the access group setting tab. A blue banner appears with options for disabling or deleting them from the access group.
H	Search results	The tab displays up to 10 group setting items. Click the arrows to navigate through search results.

If you have the User Manager (View/Edit) role, you can do the following:

Add an access group
Update the access group settings
Disable an access group

Add an access group

To add an access group, do the following:

At the lower left, click Add Access Group.
In the Add Access Group panel, follow the instructional text to enter the access group information correctly.
Click Submit.

The access group is added to the UMP.

Update an access group

Here's what you need to know about adding and updating settings in an access group:

The Users tab does not have an Add Users button. To add a user, see Add user.
When adding an access group, the Ignore Duplicate Groups checkbox allows you to create groups with identical sets of partners and advertisers (using different group names as an option).
Clicking an access group name in the Access Groups tab opens a panel for editing the group information, similar to creating a new access group.
Selecting a checkbox for an item opens a blue banner with options to disable or delete it, depending on the tab.

To update an access group, do the following:

Select an access group in the left navigation panel. It can be either a parent or sub-access group.
In the main panel, select a group setting tab, such as Access Groups or Partners.
To add an item to a tab, do the following:

Click the Add button.
Follow the instructional text to add the item correctly.
Click Submit.

The access group is updated in the UMP.

Disable an access group

To disable an access group, near the Edit button at the top-right corner, click the menu button then select Disable.

If it is a sub-access group, you can also select its checkbox in the Access Groups tab, then click Disable Group in the blue banner. Additionally, you have the option to select multiple access group checkboxes and perform this action as a bulk edit.

Create a report

To create a report, go to the Report Creation tab, then do the following:

In the Run a Report on dropdown menu, select one of the following options:
- User Details
- User Change Log (last 90 days)
Select your filters, as needed.

NOTE: If you selected the User Details report type, select the desired time range for the report. This range is based on the timestamps shown in the Last Active column in the UMP.
Click Generate My Report. A report preview appears.
To download the report as a CSV file, click Download.

The report is downloaded to your device.

Troubleshooting

The following table describes common problems that lead to errors and prevent admins from completing their workflows.

Problem	Resolution
Adding a user from another organization.	Admins only manage users within their own organizations. For support, contact your Technical Account Manager.
Assigning an admin with the `User Management` role directly to an organization.	These admins must belong to an access group and cannot be assigned directly to organizations. Remove any admin access to partners and advertisers, and instead assign an access group. NOTE: Roles and permissions cannot be changed during the invitation process.
Assigning a user to an access group when they are one of the following: An API user. Not an admin (user manager). A user with NPI/CRM restricted permissions. A user who is using a The Trade Desk employee account.	Determine if a different, eligible external admin can be used instead. For support, contact your Technical Account Manager.

FAQs

The following is a list of frequently asked questions about the UMP.

How do I activate my API login?

After receiving the "Welcome to The Trade Desk!" email from platformnoreply@thetradedesk.com, click the Activate Account button in the message and follow the instructions to set up your API login password and access the UMP.

NOTE: The activation email expires in seven days. If you need the email resent, contact your Technical Account Manager.

Why do I get "Access Denied" error when trying to log in to the Platform UI?

Logins are typically restricted to OpenTTD and the API. If you try to access the Platform UI with this login type, you will receive an "Access Denied" message.

Can I sort users by role, access group, or identity provider in the UMP?

No. However, you can export a CSV file of the users and then sort by any criteria.

Can I delete a user or access group?

No. You can only disable users and access groups, not delete them.

In the user details, what is the difference between a primary access partner and an identity provider?

A primary access partner is the primary access point you designate for all partners and advertisers a user has access to. It is used for user group assignments and reporting.

An identity provider is a service used to authenticate users and manage their login credentials.

What if the brand is not enrolled in UMP?

If a brand owns the partner seat but isn’t enrolled in UMP yet, an access group is still created to represent that ownership. However, it remains inactive without brand admins or user managers. During this time, the agency can manage day‑to‑day access through its own access groups but brand user management is paused.

After the brand enrolls in UMP, admins can be assigned, and full ownership and user management are activated. Shared access with the agency continues without needing to change partner ownership.

Is there another way to access the UMP besides using the OpenTTD login?

Yes. As an alternative, you can access the UMP through the Desk UI toolbar.