Manage users within Looker (Google Cloud core)

Within a Looker (Google Cloud core) instance, several settings are available for managing users.

Required permission

In order to manage users within a Looker (Google Cloud core) instance, you must have theAdmin role within Looker.

The Users page

TheAdmin > Users page within Looker displays active users within Looker (Google Cloud core) and lets you make certain edits to their accounts within Looker, such as editing the following account settings:

Users' names and email addresses must be edited within the identity provider that is used for authentication.

Unlike within Looker (original) instances, the following isn't available in the Looker (Google Cloud core)Users page:

Adding users to a Looker (Google Cloud core) instance

To add individual Looker (Google Cloud core) users, add users within youridentity provider. Their Looker accounts will be created upon first login. Individual users cannot be added on theUsers page; however, API-only service accounts can be added on theUsers page.

Note: Looker doesn't notify users that they have been added to the Looker (Google Cloud core) instance. You must notify users they have been added and provide login information, such as URL.

Creating an API-only service account

Service accounts are the only accounts that can be created within a Looker (Google Cloud core) instance.

You can createAPI-only accounts (often calledservice accounts) from theUsers page within a Looker (Google Cloud core) instance. These accounts can be granted Admin Looker roles and Looker API credentials. However, these accounts can't log in to Looker (Google Cloud core) through the UI. To add a service account, follow these steps:

  1. Click theAdd Service Accounts button to open theAdding a new Service Account page.
  2. In theService Account Name field, enter a name for the service account.
  3. TheCreate default set of API credentials switch is enabled by default. If you don't want API credentials created for the account, click the switch to disable this option.
  4. Select theGroups andRoles to assign to the service account.
  5. Click theSave button.
Note: Service accounts within Looker (Google Cloud core) aren't the same asGoogle service accounts and aren't governed by IAM.

You can view and edit existing service accounts in theService Accounts tab on theUsers page. To edit a service account, click the service account row to display theEdit User page. From theEdit User page you can do the following:

  • Enable or disable the service account
  • Edit the service account name
  • Manage the service accountAPI keys
  • Assign differentgroups andRoles
  • Edit theuser attributes that are associated with the service account

Removing access to Looker (Google Cloud core)

Important: We recommend that you remove access to a Looker (Google Cloud core) instance by using the identity provider that was used for authentication rather than by disabling or deleting the user from theUsers page.

Remove access to a Looker (Google Cloud core) instance by updating the identity provider that was used for authentication. Although the user can no longer log in to the instance, the user account will still appear active on theUsers page. To remove the user account from theUsers page,delete the user within the Looker (Google Cloud core) instance.

Deleting users from a Looker (Google Cloud core) instance that isassociated with a Looker Studio Pro subscription reduces the number of complimentary Looker Studio Pro licenses that are allocated to your instance. If the number of complimentary Pro licenses that are allocated to your instance becomes less than the number of licenses that are in use, the difference will be converted immediately to paid licenses, subject to Looker Studio Propricing.

Selecting an authentication method for Looker (Google Cloud core) users

An OAuth client must be set up as part of instance creation, and OAuth authentication is the backup authentication method for Looker (Google Cloud core). However, you can choose between several different primary authentication methods. TheUser authentication methods for Looker (Google Cloud core) documentation page lists the available authentication methods.

Setting a default Looker role within the Looker (Google Cloud core) instance

Before you add any users, you can set the defaultLooker role that will be granted to user accounts with the Looker Instance User IAM role upon their first login to a Looker (Google Cloud core) instance. To set a default role, follow the steps provided in the documentation for your identity provider:OAuth,SAML, orOpenID Connect.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.