---
title: ASP.NET Identity
slug: cms-13/docs/asp-net-identity
docTags: 
createdAt: 2026-07-30T20:22:07.220Z
---

ASP.NET Identity is a flexible authentication module for managing users and roles in CMS 13. Control who accesses the CMS editing and admin UIs, and integrate with custom user stores or third-party identity providers.

:::hint{type="info"}
**Note**
EPiServer.CMS.UI.AspNetIdentity is supported in CMS 13 and can run alongside Opti ID. Opti ID authenticates editors and administrators in the CMS shell; ASP.NET Identity can continue to authenticate site visitors in the same application. Enabling Opti ID does not require you to remove this package or migrate existing accounts.
:::

Add the `EPiServer.CMS.UI.AspNetIdentity` NuGet package and call `AddCmsAspNetIdentity` in the `Startup` class:

```csharp
public void ConfigureServices(IServiceCollection services) {
  ...
  services.AddCmsAspNetIdentity<ApplicationUser>();
  ...
}
```

The `EPiServer.CMS.UI.AspNetIdentity` NuGet package implements the following services needed by the Optimizely UI: `UIUserManager`, `UIRoleProvider`, `SecurityEntityProvider`, `IQueryableNotificationUsers`, and `SignInManager`. Manage users, roles, and access rights from the admin view. `EPiServer.Cms.Shell.UI` includes login and logout views by default.

## Custom user model

Define a custom user model to extend the default identity with additional properties. Two approaches are available:

- Inherit from `EPiServer.Cms.UI.AspNetIdentity.ApplicationUser`:

```csharp
public class CustomUser : ApplicationUser
{
// Your custom properties
}
```

- Inherit from `Microsoft.AspNetCore.Identity.IdentityUser` and the `EPiServer.Shell.Security.IUIUser` interface:

```csharp
public class CustomUser: IdentityUser, IUIUser {
  public string Comment {
    get;
    set;
  }
  public bool IsApproved {
    get;
    set;
  }
  public bool IsLockedOut {
    get;
    set;
  }

  [Column(TypeName = "datetime2")]
  public DateTime CreationDate {
    get;
    set;
  }

  [Column(TypeName = "datetime2")]
  public DateTime ? LastLockoutDate {
    get;
    set;
  }

  [Column(TypeName = "datetime2")]
  public DateTime ? LastLoginDate {
    get;
    set;
  }

  public string PasswordQuestion {
    get;
  }

  public string ProviderName {
    get {
      return "MyProviderName";
    }
  }

  [NotMapped]
  public string Username {
    get {
      return base.UserName;
    }
    set {
      base.UserName = value;
    }
  }
}
```

After defining a custom user model, configure it in the `Startup` class:

```csharp
public void ConfigureServices(IServiceCollection services) {
  ...
  services.AddCmsAspNetIdentity<CustomUser>();
  ...
}
```

## Migration

Entity Framework (EF) Core migrations version-control the identity database schema as a custom user model evolves.

By default, `EPiServer.CMS.UI.AspNetIdentity` provides a built-in `ApplicationDbContext` class to work with identity entities like users and roles. Configure the migration assembly when calling `AddCmsAspNetIdentity()`:

```csharp
services.AddCmsAspNetIdentity<ApplicationUser>(configureSqlServerOptions: o => o.MigrationsAssembly("Your.Assembly"));
```

Create a migration for `ApplicationDbContext` with [EF Core Tools](https://docs.microsoft.com/en-us/ef/core/cli/dotnet):

```powershell
dotnet ef migrations add InitialCreate
```

See the [EF Core Migration guide](https://docs.microsoft.com/en-us/ef/core/managing-schemas/migrations/?tabs=dotnet-core-cli).

- For the `AddOptimizelyIdentity` and `AddCmsAspNetIdentity` side by side pattern, see [Configure Opti ID for CMS 13](https://support.optimizely.com/hc/en-us/articles/44424935212941).
- For information on the `SecurityEntityProvider` interceptor, see [Mixed-mode authentication](https://docs.developers.optimizely.com/content-management-system/docs/mixed-mode-authentication).