Drupal User Management — Registration, Profiles, Fields and Administration

In this tutorial, you'll learn how to manage users in Drupal: configuring registration settings, adding custom account fields, managing profiles, performing bulk user operations, and setting up email notifications.

What You'll Learn

• User registration settings at Configuration > People > Account settings
• Registration modes: Administrators only, Visitors with approval, Visitors
• Email verification and password reset workflows
• Adding custom fields to user accounts
• User picture (avatar) upload configuration
• Editing users via People > Edit
• Bulk user operations: roles, block, cancel
• User cancel methods: Disable, Disable + unpublish content, Delete
• Account settings emails: Welcome, Approval pending, Blocked, Cancel
• User roles assignment and management
• User search and filtering
• Spam prevention: CAPTCHA, email verification, honeypot
• User timestamp fields: created, access, login

Why It Matters

User management is the gateway to your Drupal site. How users register, what information they provide, how they recover passwords, and how you manage them at scale affects security, user experience, and administrative overhead. A poorly configured user system leads to spam accounts, frustrated users who cannot reset passwords, and administrative chaos when managing thousands of accounts. Mastering Drupal's user management tools keeps your site secure and your users happy.

Real-World Use

A membership organization with 50,000 users needs a registration system: new members sign up and must verify their email, upload a profile photo, and provide their organization name. Administrators need to search for users by role, block inactive accounts in bulk, and send welcome emails. Drupal's user management handles all of this — custom fields for profiles, configurable registration workflows, bulk operations for administrators, and automated email notifications at every step.

Learning Path

flowchart LR
  A[Roles and Permissions] --> B[User Management]
  B --> C[Account Settings]
  C --> D[Registration Workflow]
  D --> E[Profile Fields]
  E --> F[Bulk Operations]
  F --> G[Email Notifications]
  G --> H[Security Hardening]

User Registration Settings

To configure how users register, go to Configuration > People > Account settings (/admin/config/people/accounts).

Registration Modes

Drupal offers three registration modes:

1. Administrators only — no public registration. You create all accounts manually. Use this for intranets or private sites.

2. Visitors, but administrator approval is required — users can register, but an administrator must approve the account before they can log in. A "Pending approval" email goes to the admin.

3. Visitors — anyone can create an account and immediately log in. Useful for community sites.

# Example configuration storage
user.settings:
  register: visitors_admin_approval  # or visitors or admin_only
  password_reset_timeout: 86400      # 24 hours
  notify.status_activated: true
  notify.status_blocked: true
  notify.status_canceled: true
  signature_format: basic_html

Email Verification Workflow

When a Visitor registers, Drupal sends a verification email with a one-time login link. The user clicks the link to confirm their email and set their password. This prevents automated bot registrations with fake email addresses.

The workflow:

1. User fills in registration form (username, email)
2. Drupal sends an email with a verification link
3. User clicks the link and is redirected to set a password
4. User logs in with their chosen password
5. If admin approval is required, the account stays blocked until approved

Password Reset Process

When a user forgets their password:

1. User clicks "Request new password" on the login form
2. User enters their email address or username
3. Drupal sends a one-time login link to the email
4. User clicks the link and is redirected to set a new password
5. The one-time link expires after the configured timeout (default 24 hours)

<?php
// Programmatically trigger password reset
$uid = 123;
$timestamp = \Drupal::time()->getRequestTime();
$token = user_pass_rehash(\Drupal::service('password'), $uid, $timestamp);
$url = \Drupal\Core\Url::fromRoute('user.reset', [
  'uid' => $uid,
  'timestamp' => $timestamp,
  'hash' => $token,
], ['absolute' => true])->toString();
// Send $url to user via custom email

User Account Fields

User accounts in Drupal are entities, just like nodes. This means you can add custom fields to them.

Adding Fields to User Accounts

Go to Configuration > People > Account settings > Manage fields (/admin/config/people/accounts/fields).

You can add any field type:

• Text fields (single line, plain text, formatted)
• File fields (for attachments)
• Image fields (for avatars)
• Entity reference fields (link to nodes, taxonomy terms)
• Date fields (birthdate, membership expiry)
• Telephone fields
• Address fields (with Address module)

# Example: user fields configuration
field.field.user.user.field_full_name:
  label: 'Full Name'
  field_type: string
  required: true

field.field.user.user.field_organization:
  label: 'Organization'
  field_type: string
  required: false

field.field.user.user.field_bio:
  label: 'Biography'
  field_type: text_long
  widget: text_textarea

User Picture Configuration

User pictures are built into Drupal. Configure them at Configuration > People > Account settings > Manage display (/admin/config/people/accounts/display).

Settings include:

• Enable or disable user pictures
• Upload destination (default: public://pictures/)
• Maximum image dimensions
• Maximum file size
• Default picture (shown when user has no avatar)

<?php
// Access user picture in code
$user = \Drupal\user\Entity\User::load($uid);
if ($user->hasField('user_picture') && !$user->get('user_picture')->isEmpty()) {
  $image_uri = $user->get('user_picture')->entity->getFileUri();
  $image_url = \Drupal\Core\Url::fromUri(file_create_url($image_uri))->toString();
}

Editing Users

To edit a user, go to People (/admin/people) and click Edit next to any username.

From the edit page you can:

• Change username, email, and password
• Assign or remove roles
• Block or unblock the account
• Edit custom field values (profile fields)
• Set user status (active, blocked)

<?php
// Programmatically update a user
$user = \Drupal\user\Entity\User::load(123);
$user->set('field_full_name', 'Jane Smith');
$user->addRole('content_editor');
$user->activate(); // Unblock the user
$user->save();

Bulk User Operations

The People page (/admin/people) supports bulk operations. Select multiple users and apply an action:

• Add a role to the selected users — assign a role to many users at once
• Remove a role from the selected users — revoke a role
• Block the selected users — prevent them from logging in
• Unblock the selected users — restore access
• Cancel the selected user accounts — disable or delete accounts
• Send email to the selected users — send a custom email

# Bulk operations are powered by the Views Bulk Operations module
# which is integrated into the core People view.

User Search and Filters

The People page has powerful search and filtering:

• Search by username, email, or role
• Filter by role (show only users with a specific role)
• Filter by permission status (blocked, active)
• Sort by created date, last access, or username

This is essential for managing large user bases.

User Cancel Methods

When a user cancels their account (or an admin cancels it), you control what happens:

# Cancel methods in Drupal
user_cancel_methods:
  user_cancel_block:
    name: 'Disable the account and keep its content'
    description: 'User is blocked. All content remains published.'
  user_cancel_block_unpublish:
    name: 'Disable the account and unpublish its content'
    description: 'User is blocked. All their content is unpublished.'
  user_cancel_reassign:
    name: 'Delete the account and make its content belong to the Anonymous user'
    description: 'User is deleted. Content is reassigned to Anonymous.'
  user_cancel_delete:
    name: 'Delete the account and its content'
    description: 'Both user and their content are permanently deleted.'

Choose carefully. Deleting a user removes their content too, which might break your site if other content references it. The safest option is "Disable and keep content."

Account Settings Emails

Drupal sends automated emails for user account events. Configure them at Configuration > People > Account settings (/admin/config/people/accounts).

Email Types

1. Welcome (new user created by administrator) — sent when admin creates an account
2. Welcome (awaiting approval) — sent when visitor registers and approval is required
3. Welcome (no approval required) — sent when visitor registers and can log in immediately
4. Password recovery — sent when user requests a password reset
5. Account activation — sent when admin activates a previously blocked account
6. Account blocked — sent when admin blocks a user
7. Account canceled — sent when account is canceled

Each email uses tokens for dynamic content:

# Example: Welcome email template
# Available tokens:
# [user:display-name], [user:account-name], [user:mail]
# [site:name], [site:url], [site:login-url]
# [user:one-time-login-url], [user:cancel-url]

subject: 'Welcome to [site:name]'
body: |
  Dear [user:display-name],
  
  Thank you for registering at [site:name]. You may now log in at
  [site:login-url] using the following username: [user:account-name]
  
  Your password has been set during registration.
  
  The [site:name] team

Spam Prevention

User registration attracts spam bots. Drupal provides tools to prevent automated registrations:

Email Verification

By default, Drupal sends a verification email. Users cannot log in until they click the verification link. This blocks bots that use fake emails.

CAPTCHA Module

The core CAPTCHA module adds a challenge to the registration form:

<?php
// CAPTCHA is configured at:
// /admin/config/people/captcha
// You can set CAPTCHA for:
// - User registration form
// - User login form
// - Password reset form
// - Contact forms

Honeypot Module

The Honeypot module adds a hidden field to forms that bots fill in but humans cannot see. If the field has a value, Drupal rejects the submission.

Manual Approval

Setting registration to "Visitors, but administrator approval is required" gives you a manual review step before any account becomes active.

User Timestamp Fields

Drupal tracks three timestamps for each user:

<?php
$user = \Drupal\user\Entity\User::load($uid);

// When the account was created
$created = $user->getCreatedTime();
// Output: 1719500000 (Unix timestamp)

// When the user last accessed the site
$last_access = $user->getLastAccessedTime();

// When the user last logged in
$last_login = $user->getLastLoginTime();

// Format them
$formatted = \Drupal::service('date.formatter')
  ->format($created, 'medium');

These timestamps help with user auditing and cleaning up inactive accounts.

Common Mistakes

1. Allowing open registration without email verification: Bots will flood your site with fake accounts. Always enable email verification or require admin approval for public registration.

2. Not customizing account emails: Default emails are generic. Customize them with your site name, branding, and clear instructions. Users who receive confusing emails are more likely to abandon registration.

3. Adding too many required profile fields: Each required field is a barrier to registration. Require only what you absolutely need. Collect additional information after registration.

4. Forgetting to configure user cancel methods: The default cancel method might delete user content that you need. Test what happens when you cancel a test account before going live.

5. Not using bulk operations for large user bases: Editing 500 users one at a time is tedious and error-prone. Use bulk operations to assign roles, block users, or send emails in batches.

Practice Questions

1. How would you configure registration so new users must be approved by an administrator, and what email is sent during this process?
2. You need to collect "Phone Number" and "Department" from every user during registration. How do you add these fields?
3. What happens to a user's content when you delete their account using the "Delete the account and its content" method?
4. Challenge: Build a user management workflow for a training platform. Users sign up, must verify their email, complete their profile (name, organization, role), and are assigned the "Student" role automatically. Administrators can bulk-move students to "Alumni" status and send a graduation email. Write the step-by-step configuration and any custom code needed.

FAQ

Mini Project

Goal: Set up a complete user registration and management system for a community site.

1. Configure registration to require admin approval
2. Add custom fields: Full Name (text), Organization (text), and Profile Picture (image)
3. Customize the Welcome email to include the user's display name and a link to update their profile
4. Create a "Member" role and configure it so new users are automatically assigned this role (use the Auto Assign Role module or hook_user_insert)
5. Create an "Alumni" role for former members
6. Test the entire flow: register a new user, approve them, log in, update the profile, then bulk-move five test users to Alumni
7. Write a Drush command that reports all users who have not logged in for 90 days

What's Next

Now that you understand user management, proceed to security hardening to learn how to protect your Drupal site from attacks. Then explore custom module development to extend Drupal with your own functionality.