Manage RAM user login settings-阿里云帮助中心

Overview

The console logon settings for a RAM user determine how the user accesses the Alibaba Cloud console and the security measures that apply. These settings only affect the RAM user's console logon behavior and do not affect programmatic access through an AccessKey.

The following table summarizes the supported logon settings and their functions.

Parameter	Description
Console Access	Controls whether a RAM user can log on to the Alibaba Cloud console.
Set Logon Password	Sets or resets the console logon password for a RAM user.
Password Reset	Forces the user to change their password at the next logon.
Enable MFA	Requires the user to complete multi-factor authentication at logon.

Note

If SSO logon is enabled for a RAM user, the logon settings described above, such as console access and MFA requirements, do not take effect.

Enable console logon

To allow a RAM user to log on to the Alibaba Cloud console with a password, you must enable console logon and set a password. You can do this through the console or by using OpenAPI.

Console

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the user list, click the name of the target RAM user.
On the Authentication tab, in the Login Profile section, click Enable Console Logon.
In the Enable Console Logon dialog box, configure the following parameters:
- Console Access: Click Enabled to enable console logon for the RAM user.
- Set Logon Password: Select Automatically Regenerate Default Password or Reset Custom Password.
- Password Reset: Specify whether to require the user to reset their password at the next logon. When you set an initial password, we recommend selecting Required at Next Logon to prevent password sharing between the administrator and the user.
- Enable MFA: Specify whether to require the RAM user to enable MFA. If you select Required, the user is prompted to set up MFA at their next logon. We recommend keeping the default selection to require MFA.
Click OK.

API

Permissions required: You must have the ram:CreateLoginProfile permission.

Call the CreateLoginProfile operation to enable console logon for the specified RAM user and set an initial password for the user.

View console logon settings

An administrator can view the current logon configuration of a RAM user, including whether console access is enabled, the password status, and MFA settings.

Console

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the user list, click the name of the target RAM user.
On the Authentication tab, in the Login Profile section, view the status of the following logon settings:
- Console Access: Indicates whether console access is enabled. The possible states are:
  - Unset: Console access has not been enabled.
  - Inactive: Console access has been disabled by an administrator.
  - Active: Console access has been enabled by an administrator.
- Last Logined Time: Records the last time the user successfully logged on to the console. You can use this information to audit an inactive account.
- MFA Required: Indicates whether the user is required to complete multi-factor authentication to log on to the console.
  Note
  Whether a user is prompted for MFA during logon depends on several factors. The following conditions are checked in descending order of priority. If any condition is met, the user is required to use MFA:
  - The RAM global MFA policy is set to Force all users to use MFA at logon (this is the default setting). For more information, see MFA settings.
  - The logon settings for the individual RAM user require MFA.
  - The user has already bound an MFA device, such as a security key or a virtual MFA device.
  If none of these conditions are met, Alibaba Cloud still prompts the user to bind an MFA device at each logon, but the user can choose to skip this step.
- Reset Password On Next Sign-in: Indicates whether the user is required to reset their password at the next logon.
- Password Status: Displays the user's current password status. For more information, see What are an initial password and its validity period?.
  - Initial Password Available: The user's current password is an initial password and has not expired. In this state, the user can log on to the console with the initial password.
  - Initial Password Expired: The user's current password is an initial password and has expired. In this state, the user cannot log on to the console with the initial password.
  - Not Initial Password: The user's current password is not an initial password. Its expiration is determined only by the regular password expiration policy, not the initial password validity period.
- Console Sign-in: After you enable console access, you can copy the dedicated logon link for this RAM user.
- DingTalk Account: If the RAM user has bound a DingTalk account, you can view the binding status.

API

Permissions required: You must have the ram:GetLoginProfile permission.

Call the GetLoginProfile operation to view the console logon settings of a RAM user.

Modify console logon settings

After you enable console logon, a RAM administrator can modify the logon settings as needed, such as disabling console logon or resetting the logon password.

Console

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the user list, click the name of the target RAM user.
On the Authentication tab, in the Login Profile section, click Modify Logon Settings.
In the Modify Logon Settings dialog box, modify the console logon parameters.
- Console Access: Click Disabled to disable console logon for the RAM user.
  Important
  
  Disabling console access forces the RAM user and any RAM roles they are assuming to log off.
  
  Disabling console logon also prevents the user from logging on to the console with a passkey.
- For information about the other settings, see Enable console logon.
Click OK.

API

Permissions required: You must have the ram:UpdateLoginProfile permission.

Call the UpdateLoginProfile operation to modify the user's console logon settings.

Clear console logon settings

This operation permanently deletes all console logon information for the RAM user, including the password. This action cannot be undone.

Warning

Once cleared, a RAM user's console logon information cannot be restored. Proceed with caution.
After a RAM user's console logon settings are cleared, the RAM user and any RAM roles they are assuming are forced to log off.

Console

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > > > Users.
On the user list, click the name of the target RAM user.
On the Authentication tab, in the Login Profile section, click Remove Logon Settings.
In the Remove Logon Settings confirmation dialog box, click OK.

API

Permissions required: You must have the ram:DeleteLoginProfile permission.

Call the DeleteLoginProfile operation to clear the user's console logon settings.

Note

Clearing console logon settings does not clear the user's passkeys, MFA binding information, or AccessKey.

Security best practices

Enforce MFA: Enforce MFA for all users who require console access. This is one of the most effective ways to protect account security.
Require initial password reset: When you set an initial password, make sure to select Require Password Reset to prevent password sharing between the administrator and the user.
Separate console and API identities: For identities that require only programmatic access, such as CI/CD or application identities, disable console logon to reduce the attack surface.
Periodically audit and clean up accounts: Periodically check the Last logon time and disable or delete inactive accounts.

FAQ

Disabling access vs. clearing settings

Disabling access is reversible and retains the password and other logon settings. Clearing settings is irreversible and deletes all logon information.

Impact on AccessKey access

No. Console logon and programmatic access are independent. To prevent a user from using an AccessKey, you must disable the AccessKey.

Impact on active sessions

This action immediately terminates the user's current console sessions and any sessions for RAM roles they are assuming. The user must log on again. This may interrupt ongoing operations.

Resetting a forgotten password

RAM users cannot reset their own console logon passwords; an administrator must do it for them. For more information, see Reset a password for a RAM user.

Retrieving last logon time

Console: On the user details page, on the Authentication tab, view the user's Last logon time in the Login Profile section.
API: Call the GetLoginProfile operation. The response includes the LastLoginTime field.

Initial passwords and validity

To reduce the security risks of long-term inactive accounts—such as resource threats, unexpected charges, or malicious attacks due to compromised passwords—RAM will introduce an "initial password" mechanism starting from January 26, 2026. A console logon password that meets specific criteria is marked as an "initial password" and has a default validity period of 14 days. If the user does not log on successfully within this period, the password automatically expires and must be reset by an administrator. For more information, see the announcement.

A password is considered an initial password if it meets any of the following conditions:

First-time creation: The first console logon password set for a RAM user, regardless of whether it is auto-generated or custom.
Re-enabling: The password set for a RAM user after their console logon settings have been cleared and then re-enabled.
Reset before first logon: If an initial password is reset by an administrator before the user has successfully logged on with it, the new password is still considered an "initial password." The validity period is recalculated from the time of the reset.

Both the initial password validity period and the regular password validity period (defined in the account password policy) are in effect. The system enforces the shorter of the two. Administrators can modify the default initial password validity period in the RAM global password policy. However, to avoid increasing management complexity, we recommend that the initial password validity period not be longer than the regular password validity period.

Viewing initial password status

On the user details page, on the Authentication tab, view the Password status in the Login Profile section. If the status is Initial password has expired, the user cannot log on with the current password, and an administrator must reset it.