# Creating & Updating Legacy Users Using Vault Loader

<a href="/en/gr/26597/">Vault Loader</a>
 allows you to perform bulk actions on users in your Vault. It is recommended to use Vault Loader to create and update users by creating, updating, and deleting _User_ object records. To learn about creating and updating _User_ object records, see <a href="/en/gr/26607/">Creating, Updating & Deleting Object Records Using Vault Loader</a>
. To learn about managing users with the _User_ object, see <a href="/en/gr/46534/">About the User & Person Objects</a>
. 

If you are creating cross-domain or VeevaID users, or creating users without assigning Vault membership, it is recommended to create or update the Legacy User account rather than the _User_ object.

<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: Only users with standard <em>Vault Owner</em> and <em>System Administrator</em> security profiles are allowed to perform updates to Legacy User accounts. Users with custom <em>Vault Owner</em> and <em>System Administrator</em> security profiles are prohibited from performing these updates.</p>
    </div>
  </div>
</div>



## How to Load Users

Before loading users, [prepare the CSV input file][1] containing user field names and values.

To create, update, or upsert users:

  1. In the left panel of the **Loader** tab, click **Load**.
  2. For the **CSV File**, click **Choose** and select the CSV input file.
  3. In the **Entity Type** drop-down, scroll to the **Users & Groups** section and select **Users**.
  4. In the **Action Type** drop-down, select **Create**, **Update**, or **Upsert**.
  5. Click **Start Load**.

Before processing the request, Vault [validates the selected CSV file][2]. If the file is valid, Vault begins processing the request. When finished, you'll receive a <a href="/en/gr/26597/#loader-notifications-outputs">Vault notification and email</a>
 with request details and CSV output files.

## Preparing CSV Input Files {#preparing-csv}

The fields you include in your CSV will depend on your action: Create, Update, or Upsert. If you aren't sure where to start, you can use the **Extract** option in Vault Loader to see what the CSV should look like.

### Create Users

When creating new users, the following fields are required in all Vaults:

  * `user_name__v`
  * `user_first_name__v`
  * `user_last_name__v`
  * `user_email__v`
  * `user_timezone__v`
  * `user_locale__v`
  * `user_language__v`
  * `security_policy_id__v`
  * `vault_membership` (sometimes required; see [details][3])
  * `app_licensing` (sometimes required; see [details][4])

See <a class="external-link " href="https://developer.veevavault.com/docs/sample-files/vault-create-users-sample-csv-input.csv" target="_blank" rel="noopener">example input<i class="fa fa-external-link" aria-hidden="true"></i></a>.


<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: You can create an inactive user with <a href="/en/gr/761685/">Record Migration Mode</a>
 enabled. To create an inactive user, ensure the <code class="language-plaintext highlighter-rouge">status__v</code> value is <code class="language-plaintext highlighter-rouge">inactive__v</code> and the <code class="language-plaintext highlighter-rouge">state__v</code> value is <code class="language-plaintext highlighter-rouge">inactive_state__sys</code>. You can set the <code class="language-plaintext highlighter-rouge">username__sys</code> value to a new or existing inactive domain user, or an existing active domain user.</p>
    </div>
  </div>
</div>



### Update Users

When updating users, you must specify the user _id_ field. Vault uses IDs to locate the existing users that you want to update. See <a class="external-link " href="https://developer.veevavault.com/docs/sample-files/vault-update-users-sample-csv-input.csv" target="_blank" rel="noopener">example input<i class="fa fa-external-link" aria-hidden="true"></i></a>.

### Upsert Users

The Upsert action is a combination of create and update. When using this action, you create one input CSV with all the fields required to create new users. For existing users, you must specify the user _id_, but you can leave other fields blank if the values should not change.

## File Validation {#file_validation}

Before beginning the Vault Loader job to create or update legacy users, Vault checks that the selected CSV file meets certain criteria:

  * Is not empty
  * Does not contain empty columns
  * Includes a valid header row (Invalid header rows are those with no columns that match to metadata for the records you're loading.)

If your file is not valid, Vault displays a notification, stops the process, and allows you to select a new CSV file. If some of the header columns do not match metadata for your Vault, the notification will allow you to stop the load or ignore those columns and proceed.

## Vault Membership Assignments {#vault_membership}

User accounts exist at the domain level. For multi-Vault domains, this means that user details for a user (Thomas Chung, for example) are shared across all Vaults he can access.

If you are using the **Update** action to assign existing users to an additional Vault, you need to include `vault_membership` in your CSV. You must be a Domain Admin and Vault Owner to use this functionality. If users already exist at the domain level, Vault Owners can <a href="/en/gr/26607/#load_users">use Vault Loader to create users</a>
 by using the _User_ object.

The `vault_membership` field accepts multiple values in a specific format:

`{Vault ID}:{User Status/active__v}:{Security Profile}:{License Type}`

The only required value is Vault ID. If you leave the other values blank, Vault creates the user with default settings. To understand default settings, consider these two examples. Each produces the same result:

`3003:true:document_user__v:full__v`
: Assigns to Vault 3003.

`3003`
: Same as above.

The next two examples also produce the same result:

`3003:true:system_admin__v:full__v`
: Assigned to Vault 3003 with `system_admin__v` security profile.

`3003::system_admin__v`
: Same as above.

When assigning existing users to new Vaults, you do not need to include membership information for Vaults to which they already belong.

New Vault users only receive welcome emails if they are assigned to a Vault via the `vault_membership` field. For example, a new domain user who does not have any assigned Vaults will not receive a welcome email.

### Assigning Users to Multiple Vaults

The next two examples add users to multiple Vaults in a domain.

`3003,4004,5005`
: Assigns to Vaults 3003, 4004, and 5005 with default settings.

`3003:false:read_only_user__v:read_only__v,4004,5005`
: Assigns to Vault 3003 as Inactive (`active:false`), with Read Only User security profile and Read Only license type. Assigns to Vaults 4004 and 5005 with default settings.

### Deactivating Users

The following example changes an existing user's Vault membership status to _Inactive_ when used with the **Update** action.

`3003:false`
: Updates membership for Vault 3003 to _Inactive_ and applies the default security profile to the user despite the user's assigned or approved profile prior to deactivation.

## Creating Users in Multi-Application Vaults {#app-licensing}

Users on a multi-application Vault must be assigned to specific applications and need a license type assignment for each application. To set these values, use the `app_licensing` field. The `app_licensing` field accepts multiple values in a specific format: **`{vault_id}|{application_name}:{active__v}:{license_type__v}`**

For example, for an _Active_ Veeva PromoMats user with a _Full_ license in Vault 3003, enter **`3003|pmPromoMats_v:true:full__v`**.

Use the following values for `{application_name}`:

**Veeva Vault Platform**
: `platformPlatform_sys`


Clinical
: * **Veeva CTMS**: `clinicalCtms_v`
* **Veeva Disclosures**: `clinicalDisclosures_v`
* **Veeva eTMF**: `clinicalEtmf_v`
* **Veeva OpenData Clinical**: `clinicalOpenData_v`
* **Veeva Payments**: `clinicalPayments_v`
* **Veeva Site Connect**: `clinicalSiteConnect_v`
* **Veeva Study Startup**: `clinicalSsu_v`
* **Veeva Study Training**: `qualityStudyTraining_v`


Commercial
: * **Vault CRM Approved Email**: `vaultCrmApprovedEmail_v`
* **Vault CRM Campaign Manager**: `vaultCrmCampaignManager_v`
* **Vault CRM Engage**: `vaultCrmEngage_v`
* **Vault CRM Events Management**: `vaultCrmEventsManagement_v`
* **Vault CRM Service Center**: `vaultCrmServiceCenter_v`
* **Vault CRM**: `vaultCrmCore_v`
* **Veeva PromoMats Multichannel**: `pmMultichannel_v`
* **Veeva PromoMats**: `pmPromoMats_v`

Medical
: * **Vault Medical Multichannel**: `medicalMultichannel_v`
* **Veeva MedComms**: `medicalMedComms_v`
* **Veeva MedInquiry**: `medicalMedInquiry_v`

Quality & QualityOne
: * **Veeva QMS**: `qualityQms_v`
* **Veeva QualityDocs**: `qualityQdocs_v`
* **Veeva QualityOne Document Contro**l: `qOneQdocs_v`
* **Veeva QualityOne QMS**: `qOneQms_v`
* **Veeva Training**: `qualityTraining_v`

Regulatory
: * **Veeva Registrations**: `rimReg_v`
* **Veeva Submissions Archive**: `rimSubsArch_v`
* **Veeva Submissions Publishing**: `rimSubsPublishing_v`
* **Veeva Submissions**: `rimSubs_v`

Safety
: * **Veeva Safety Management**: `safetyManagement_v`
* **Veeva Safety**: `safety_v`
* **Veeva SafetyDocs**: `safetyDocs_v`

### Assigning Users to Multiple Applications

To assign a user to multiple applications, separate the applications with a pipe. The following example adds a user to multiple applications within a Vault.

**`3003|rimReg_v:true:full__v|rimSubs_v:true:full__v`**

This assigns the user to the Veeva Registrations Veeva Rim Submissions applications in Vault 3003. The user is _Active_ and has the _Full_ license type for both applications.

### Assigning Users to Applications in Multiple Vaults

To assign a user to applications in multiple Vaults, separate the Vaults with a semicolon (**;**). The following example adds a user to multiple applications in multiple Vaults:

**`3003|rimReg_v:true:full__v|rimSubs_v:true:full__v;4112|rimSubs_v:true:full__v`**

This adds an _Active_ user to both Veeva Registrations and Veeva Submissions in Vault 3003, and to the Veeva Submissions application in Vault 4112, all with the _Full_ license type.


## Suppressing Welcome Emails

When creating new users via Vault Loader, you can prevent Vault from sending welcome emails to a user by setting the `user_needs_to_change_password__v` setting to `false`. This does not work for users with SSO security profiles, but you can work around this limitation by creating the users with a basic security profile and updating them to the SSO security profile with an update action through Vault Loader. This prevents Vault from sending welcome emails until you run the update action.

 [1]: #preparing-csv
 [2]: #file_validation
 [3]: #vault_membership
 [4]: #app-licensing