--- title: Custom User Management in ASP.NET Core Web API (.NET 10) description: A comprehensive guide to building custom user management on top of ASP.NET Core Identity in .NET 10 Minimal API. Covers extending IdentityUser with custom... canonical: https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Custom User Management in ASP.NET Core Web API (.NET 10) | daily.dev og:description: A comprehensive guide to building custom user management on top of ASP.NET Core Identity in .NET 10 Minimal API. Covers extending IdentityUser with custom... og:url: https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj og:image: https://api.daily.dev/og/posts/niTSnavKJ.png og:image:alt: Custom User Management in ASP.NET Core Web API (.NET 10) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Custom User Management in ASP.NET Core Web API (.NET 10) **[Code with Mukesh](https://daily.dev/sources/codewithmukesh)** · [@iammukeshm](https://daily.dev/iammukeshm) · 14 min read · 7 upvotes · 0 comments ## Summary A comprehensive guide to building custom user management on top of ASP.NET Core Identity in .NET 10 Minimal API. Covers extending IdentityUser with custom fields, admin endpoints for listing/searching/paging users with roles, role assignment and removal, two distinct user-blocking mechanisms (Identity lockout vs. custom IsActive flag), self-service profile and password-change endpoints, email confirmation and password reset flows, and a comparison between MapIdentityApi, custom endpoints, and external providers like Auth0 or Keycloak. Includes troubleshooting tips and a full GitHub sample. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between locking and disabling a user in ASP.NET Core Identity? Locking is Identity's built-in lockout feature, a temporary block usually triggered by too many failed logins and set with SetLockoutEndDateAsync. Disabling is a custom flag you add yourself, such as an IsActive property, that stays off until an admin turns it back on. Lockout defends against brute-force attacks, while disable is for suspending or offboarding an account, and must be enforced manually in the login endpoint. _Comparing lockout versus disable logic before wiring up admin controls is easier with sources tracked on daily.dev._ ### How do I add custom fields like FirstName to a user during registration in ASP.NET Core Identity? Create a class that inherits from IdentityUser, add the extra properties, and point IdentityDbContext at that class instead of the base type. MapIdentityApi's fixed register endpoint cannot capture those fields, so a custom registration endpoint is needed that accepts them and calls UserManager.CreateAsync. The extra columns land in the AspNetUsers table through an EF Core migration. _Developers extending Identity models beyond the defaults can follow patterns like this on daily.dev._ ### Should I use MapIdentityApi or build custom user-management endpoints in ASP.NET Core? Use MapIdentityApi for a first-party SPA or mobile MVP where the default email-and-password user is sufficient and only register, login, and refresh are needed quickly. Build custom endpoints when custom user fields, an admin surface to list and manage users, role management, or full control over the auth flow are required. ASP.NET Core Identity remains underneath either approach. _Weighing MapIdentityApi against a custom identity layer gets easier with comparisons like this on daily.dev._ ## Similar posts on daily.dev - [Identity API Endpoints in ASP.NET Core: When to Use Them \(.NET 10\)](https://daily.dev/posts/identity-api-endpoints-in-asp-net-core-when-to-use-them-net-10--ipinr7bfu) · Code with Mukesh · 10 upvotes · 0 comments - [Role-Based Authorization in ASP.NET Core](https://daily.dev/posts/role-based-authorization-in-asp-net-core-qirbihaku) · C\# Corner · 7 upvotes · 0 comments - [ASP.NET Core Security Explained: Modern Authentication, Authorization, and JWT](https://daily.dev/posts/asp-net-core-security-explained-modern-authentication-authorization-and-jwt-bgq4u3gn4) · Syncfusion · 4 upvotes · 0 comments - [.NET 10: What’s New for Authentication and Authorization](https://daily.dev/posts/net-10-what-s-new-for-authentication-and-authorization-0mnjaiuqi) · Auth0 · 82 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#.net](https://daily.dev/tags/.net), [#aspnetcore](https://daily.dev/tags/aspnetcore) [View this post on daily.dev](https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Custom User Management in ASP.NET Core Web API (.NET 10)","url":"https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj"},"datePublished":"2026-07-16T17:36:55.723Z","dateModified":"2026-09-14T10:00:17.774Z","description":"A comprehensive guide to building custom user management on top of ASP.NET Core Identity in .NET 10 Minimal API. Covers extending IdentityUser with custom...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/102ec097438af108f90f517ba52f81f8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/102ec097438af108f90f517ba52f81f8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Code with Mukesh","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Person","name":"Mukesh Murugan","url":"https://daily.dev/iammukeshm","image":"https://lh3.googleusercontent.com/a-/AFdZucr2UBIpOeVTWohK8XKuXPOutNG6hgyQMz7CYj7LEA=s100","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":790}},"commentCount":0,"discussionUrl":"https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,.net,aspnetcore","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Code with Mukesh","item":"https://daily.dev/sources/codewithmukesh"},{"@type":"ListItem","position":3,"name":"Custom User Management in ASP.NET Core Web API (.NET 10)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/custom-user-management-in-asp-net-core-web-api-net-10--nitsnavkj#faq","mainEntity":[{"@type":"Question","name":"What is the difference between locking and disabling a user in ASP.NET Core Identity?","acceptedAnswer":{"@type":"Answer","text":"Locking is Identity's built-in lockout feature, a temporary block usually triggered by too many failed logins and set with SetLockoutEndDateAsync. Disabling is a custom flag you add yourself, such as an IsActive property, that stays off until an admin turns it back on. Lockout defends against brute-force attacks, while disable is for suspending or offboarding an account, and must be enforced manually in the login endpoint. Comparing lockout versus disable logic before wiring up admin controls is easier with sources tracked on daily.dev."}},{"@type":"Question","name":"How do I add custom fields like FirstName to a user during registration in ASP.NET Core Identity?","acceptedAnswer":{"@type":"Answer","text":"Create a class that inherits from IdentityUser, add the extra properties, and point IdentityDbContext at that class instead of the base type. MapIdentityApi's fixed register endpoint cannot capture those fields, so a custom registration endpoint is needed that accepts them and calls UserManager.CreateAsync. The extra columns land in the AspNetUsers table through an EF Core migration. Developers extending Identity models beyond the defaults can follow patterns like this on daily.dev."}},{"@type":"Question","name":"Should I use MapIdentityApi or build custom user-management endpoints in ASP.NET Core?","acceptedAnswer":{"@type":"Answer","text":"Use MapIdentityApi for a first-party SPA or mobile MVP where the default email-and-password user is sufficient and only register, login, and refresh are needed quickly. Build custom endpoints when custom user fields, an admin surface to list and manage users, role management, or full control over the auth flow are required. ASP.NET Core Identity remains underneath either approach. Weighing MapIdentityApi against a custom identity layer gets easier with comparisons like this on daily.dev."}}]} ```