Summary and recommendation
Docebo user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Docebo is an enterprise LMS with four platform roles: Superadmin, Admin, Power User, and Learner. Admins and Power Users support granular permission toggles and can be scoped to specific branches or user groups, giving IT teams meaningful control over every app and resource a learner or admin can reach.
Custom admin profiles are available on both Elevate and Enterprise plans, though advanced configurations may require Enterprise.
Quick facts
| Admin console path | Admin Menu (gear icon, top-right) → Users & Groups → Users |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Enterprise |
| SSO prerequisite | No |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Superadmin | Full platform access: manage all settings, users, courses, reports, integrations, and billing. Cannot be restricted by branch or group scope. | Cannot be scoped to a subset of users or branches; always has global access. | All plans (one Superadmin account per platform by default) | Counts as an active user seat if they log in within the billing period. | Only one Superadmin role exists by default; additional platform-wide admins must be granted Admin role with broad permissions. |
| Admin | Manage users, groups, branches, courses, and reports within assigned scope. Can be restricted to specific branches or groups via Power User-style scoping depending on configuration. | Cannot access billing or platform-level configuration unless explicitly granted; cannot exceed their assigned branch/group scope. | All plans | Counts as an active user seat if they log in within the billing period. | Admin permissions are highly configurable; misconfigured admins may inadvertently have broader access than intended. |
| Power User | Scoped administrative role. Can manage users, enroll learners in courses, run reports, and manage content within assigned branches or groups only. | Cannot access platform-wide settings, billing, or users outside their assigned scope. | All plans | Counts as an active user seat if they log in within the billing period. | Power User permissions must be explicitly configured per user; the scope (branches/groups) must be assigned at creation or editing time. |
| Learner (User) | Access assigned courses, view own transcript, complete learning activities, participate in social learning features if enabled. | Cannot access admin console, manage other users, or view other learners' data. | All plans | Billed as an active user if they log in at least once during the annual billing period (yearly active user model). | A learner who logs in even once in a contract year counts as a billable active user for that year. Deactivated users do not count toward active user totals going forward. |
Permission model
- Model type: hybrid
- Description: Docebo uses a combination of predefined roles (Superadmin, Admin, Power User, Learner) and configurable permission sets. Admins and Power Users can have granular permissions toggled on or off and their scope restricted to specific branches or user groups. Custom admin profiles can be created to define specific permission combinations.
- Custom roles: Yes
- Custom roles plan: Available on Elevate and Enterprise plans; advanced custom role configurations may require Enterprise.
- Granularity: Permission toggles cover user management, course management, reporting, catalog management, and integrations. Scope can be restricted to specific organizational branches or user groups.
How to add users
- Log in as Superadmin or Admin with user-management permissions.
- Navigate to Admin Menu (gear icon) → Users & Groups → Users.
- Click the '+ New User' button (or 'Add User' depending on platform version).
- Enter required fields: First Name, Last Name, Username, Email, Password (or select SSO-only authentication).
- Optionally assign the user to a Branch, Group, and set their Role (Learner, Power User, Admin).
- Configure additional profile fields as needed (e.g., Manager, custom fields).
- Click 'Save' to create the user. The user receives a welcome email if email notifications are enabled.
Required fields: First Name, Last Name, Username, Email Address, Password (unless SSO-only is configured)
Watch out for:
- Username must be unique across the platform; duplicate usernames will cause an error.
- Email address must be unique; a second account cannot share an existing email.
- If SSO is the primary authentication method, a password may still be required at account creation unless the platform is configured for SSO-only login.
- The 'Direct Manager' field cannot be provisioned via SCIM or SAML attribute mapping; it must be set manually or via CSV import.
- New users are not automatically enrolled in any courses; enrollment must be done separately after account creation.
- Custom user profile fields must be pre-configured in platform settings before they appear during user creation.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | Yes | Admin Menu → Users & Groups → Users → Import Users (CSV icon or 'Import' button) |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | SAML SSO with JIT (Just-in-Time) provisioning is available on all plans that include SSO. SCIM provisioning is documented as available on Enterprise plan. |
How to remove or deactivate users
- Can delete users: Yes
- Delete/deactivate behavior: Docebo supports both deactivation and permanent deletion. Deactivation suspends the user's access while preserving all learning records, transcript data, and history. Permanent deletion removes the user account and associated data; this action is irreversible. Docebo recommends deactivation over deletion to preserve compliance and audit records. Deleted users' historical data (e.g., course completions) may be removed from reports depending on platform version and configuration.
- Navigate to Admin Menu → Users & Groups → Users.
- Search for and select the target user.
- Open the user's profile by clicking their name.
- Click the 'Actions' dropdown or the status toggle.
- Select 'Deactivate User' (or toggle the Active/Inactive status switch).
- Confirm the deactivation in the dialog prompt.
- The user is immediately prevented from logging in; their data and records are retained.
| Data impact | Behavior |
|---|---|
| Owned records | Learning records, course completions, certifications, and transcript data are retained after deactivation. Permanent deletion removes these records. |
| Shared content | Content created by the user (e.g., social learning posts, shared materials) remains on the platform after deactivation; behavior upon deletion depends on platform configuration. |
| Integrations | Deactivated users are excluded from active user counts in integrations. SSO sessions are invalidated upon deactivation. |
| License freed | Deactivating a user prevents them from being counted as an active user in future billing periods. If the user has already logged in during the current annual billing period, they have already consumed a billable seat for that year. |
Watch out for:
- A user who logged in even once during the current annual contract period is already counted as a billable active user for that year; deactivating them mid-year does not reduce the current year's bill.
- Permanent deletion is irreversible and removes learning history, which may create compliance issues for organizations subject to training record retention requirements.
- Deactivated users still appear in the user list and can be reactivated; they do not count toward active user totals while inactive.
- Bulk deactivation is possible via CSV import by setting the user status field to 'inactive' in the import file.
- Admins with limited scope (Power Users) can only deactivate users within their assigned branch or group.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Yearly Active User | Any user (Learner, Power User, Admin, Superadmin) who logs into the platform at least once during the annual contract period. This is the primary billing unit. | Approximately $7–$10 per user per month (~$84–$120/user/year) based on contract volume; exact pricing is custom and negotiated. |
| Inactive User | Users with accounts who do not log in during the annual contract period. These accounts exist in the system but do not consume a billable seat. | No charge for users who do not log in during the contract year. |
- Where to check usage: Admin Menu → Reports → New Report → Users Report (filter by Last Login date to identify active vs. inactive users); or Admin Menu → Users & Groups → Users (filter by status and last login).
- How to identify unused seats: Run a Users Report filtered by 'Last Login' date range to identify accounts that have not logged in during the current contract period. Deactivate or delete these accounts to prevent them from becoming billable if they log in.
- Billing notes: Docebo bills on a yearly active user model: the contract specifies a maximum number of active users per year. Users who exceed the contracted limit may trigger overage charges or require a contract amendment. Minimum annual contract is typically ~$25,000. Multi-year commitments may reduce per-user cost. Pricing is negotiated directly with Docebo sales; no self-serve pricing is published.
The cost of manual management
Docebo bills on a yearly active user model - any account that logs in even once during the contract year consumes a full billable seat for that year. Deactivating a user mid-year does not reduce the current year's cost.
Minimum contracts typically start around $25,000/year; per-user pricing is negotiated directly with Docebo sales and is not published self-serve.
To control spend, run a Users Report filtered by Last Login date to identify accounts that have never logged in during the current contract period. Deactivate those accounts before they trigger a billable event. Bulk deactivation is possible via CSV import by setting the status field to inactive.
What IT admins are saying
Practitioners managing Docebo at scale consistently flag the same friction points across every app lifecycle stage:
- The Direct Manager field cannot be set via SCIM or SAML attribute mapping - it requires manual entry or a CSV import, creating recurring maintenance overhead as org charts change.
- The yearly active user billing model catches teams off guard: a single login locks in a full year's seat cost, making it expensive to grant occasional or one-time platform access.
- Admin and Power User permission configuration is highly flexible but not intuitive; misconfigured scopes can leave Power Users with broader or narrower access than intended.
- There is no native dashboard showing current active user count versus contracted limit; tracking utilization requires building a custom Users Report.
Common complaints:
- Direct Manager field cannot be provisioned via SCIM or SAML; must be set manually or via CSV, which creates ongoing maintenance overhead.
- Yearly active user billing model means a user who logs in once counts as a full billable seat for the entire year, making it costly to allow occasional or one-time access.
- Admin permission configuration is complex and not always intuitive; misconfigured Power Users can inadvertently have broader or narrower access than intended.
- Bulk user management via CSV import is functional but error-prone; the CSV format requirements are strict and import errors can be difficult to diagnose.
- Reporting on user activity and license utilization requires building custom reports; there is no simple dashboard showing current active user count vs. contracted limit.
- Deactivating users does not retroactively reduce the current year's billable user count, which surprises administrators expecting immediate cost relief.
- SCIM provisioning is not well-documented publicly and is reported by users to have limited attribute support compared to other enterprise LMS platforms.
- The platform UI for user management is reported by some users as slow when managing large user bases (tens of thousands of users).
The decision
Docebo fits organizations that need a structured, branch-scoped LMS with configurable admin delegation across every app and training resource in the platform. The permission model is genuinely flexible - Power Users can be tightly scoped to specific branches or groups - but that flexibility requires deliberate configuration at setup and ongoing audits to stay accurate.
The yearly active user billing model is the sharpest operational constraint. Teams that need to provision accounts for contractors, seasonal staff, or one-time training events should model seat consumption carefully before granting access. Deactivation preserves learning records and is strongly preferred over deletion for compliance purposes.
Bottom line
Docebo delivers a capable, role-scoped LMS for enterprise training programs, but the yearly active user billing model means every app provisioning decision carries a direct cost implication - a single login commits a full annual seat.
The absence of a native license utilization dashboard and the inability to provision the Direct Manager field automatically add ongoing administrative overhead.
Teams that invest in clean branch structures, deliberate Power User scoping, and proactive deactivation workflows will get the most predictable cost and access control outcomes from the platform.
Automate Docebo workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.