Modify global user settings

Tier: Free, Premium, Ultimate
Offering: GitLab Self-Managed

You can modify settings for every user in your GitLab instance.

Prerequisites

You must be an administrator for the instance.

Prevent users from creating top-level groups

Administrators can prevent users from creating top-level groups.

These users:

Cannot create top-level groups.
Can create subgroups in groups where they have at least the Maintainer role, depending on the subgroup creation permissions for the group.

This ability can be removed from all new users or only for specific existing users:

For new users

You can prevent all new users added to the instance from creating new top-level groups. This does not impact existing users.

To prevent new users from creating top-level groups:

In GitLab 15.5 and later, use either:
- The GitLab UI.
- The Application settings API.
In GitLab 15.4 and earlier, modify a configuration file:

Edit /etc/gitlab/gitlab.rb and add the following line:

gitlab_rails['gitlab_default_can_create_group'] = false

Reconfigure and restart GitLab.

Edit config/gitlab.yml and uncomment the following line:
```
# default_can_create_group: false  # default: true
```
Restart GitLab.

For existing users

To prevent existing users from creating top-level groups while still allowing them to create subgroups, use either:

The GitLab UI.
The User API to modify the can_create_group setting.

Prevent users from changing their usernames

By default, users can change their usernames. To prevent users from changing their usernames:

Edit /etc/gitlab/gitlab.rb and add the following line:

gitlab_rails['gitlab_username_changing_enabled'] = false

Reconfigure and restart GitLab.

Edit config/gitlab.yml and uncomment the following line:

# username_changing_enabled: false # default: true - User can change their username/namespace

Restart GitLab.

Prevent Guest users from promoting to a higher role

On GitLab Ultimate, Guest users do not count toward paid seats. However, when a Guest user creates projects and namespaces, they are automatically promoted to a higher role than Guest and occupy a paid seat.

To prevent Guest users from being promoted to a higher role and occupying a paid seat, set the user as external.

External users cannot create personal projects or namespaces. If a user with the Guest role is promoted into a higher role by another user, the external user setting must be removed before they can create personal projects or namespaces. For a complete list of restrictions for external users, see External users.