Background
There are a number of situations where you might need to migrate users into a site, most commonly when rebuilding your site or migrating to CiviPlus.
This guide will help you choose the right approach for your scenario and complete the process safely. It outlines the main user import options, when to use each, the required prerequisites, data mapping considerations, and the communication steps to minimise disruption for your users and team.
Note:
When migrating users generally it is not best practice to migrate users passwords. As such any approach taken will normally include users needing to set a new password as part of the process. You may wish to inform your users in advance of this change so it doesn't come as a suprise.
Option 1- Create new users from existing contacts
Manually trigger the account creation process by adding the “create drupal account” tag to contacts
Overview
This method creates user accounts directly from existing CiviPlus contacts by applying a special tag: Create Drupal Account.
Tagging a contact triggers the creation of a linked user account. You can run this in bulk from either Advanced Search → Add Tags action, or SearchKit → Tag – add/remove tags. but recommend the latter. Whilst you can use the standard CiviPlus contact search action, that method doesn’t use a queue mechanism and may encounter issues with large batches (e.g. 1,000+ users). Using SearchKit ensures the Queue Runner processes the batch efficiently and can scale to larger datasets.
Note:
You can choose to perform this process with or without sending a one-time login link to each new user.
Without sending emails: Disable outgoing mail before running the process. This silently creates the accounts, which can be useful if you plan to notify users or reset passwords later.
With one-time login links: Leave emailing enabled so users receive an automated message with their activation link. If you use the email option, review or customise the message at: Admin → Config → People → Accounts → Emails
Steps to follow:
1 - Go to Administer → Search → SearchKit, or visit:
civicrm/admin/search#/list?tab=custom
2 - Click New Search
In your search kit, choose Contacts
3 - In the left-hand Filters panel:
Set Contact Type = Individual (you typically don’t invite organisations to have logins)
4 - Select the contacts you want to include:
Use the top-left checkbox to select all, or
Tick individual rows to select specific contacts
5 - Click Action → Tag – add/remove tags
6 - Choose Add tag
In the tags box, type drupal and select Create Drupal Account
7 - Click Add Tags
The Queue Runner will display and process the batch, adding the tag to all selected contacts.
After the process
If emailing was disabled, users will not receive any notifications.
You will need to notify users that they will need to reset their passwords via the reset their password link in order to validate their account and set a password once the site is live.
If emailing was enabled, each user will receive a one-time login link.
If a one-time login link expires, users can request a new one via the Reset Password screen, or you can manually resend it by disabling and re-enabling their account. You can also edit the email content at: Admin → Config → People → Accounts → Emails
Option 2: Invite users to register on new site
Send users a link to the user registration page, which will allow them to self-serve a new user account
In this approach, instead of automatically creating user accounts from existing contacts, we send selected users a secure link inviting them to create a new account themselves. This is done by sending users a link with a CiviCRM checksum token to a webform configured for registration (by having the “create user” CiviCRM tag applied as a hidden field.
This approach is often preferred when clients want users to confirm or update their details at the point of account creation, or where it is important that users actively set a password and consent to terms during the process. It also avoids the risk of creating dormant or incorrect accounts from outdated contact data.
It requires the site to have a working registration form with CiviCRM integration (e.g., via Webform CiviCRM), and may require adjustments to message templates or confirmation screens.
Overview
In this approach, instead of automatically creating user accounts from existing contacts, you invite selected contacts to create their own accounts on the new site.
This is achieved by sending each user a personalised registration link (containing a CiviCRM checksum token) that opens a CiviCRM-integrated Webform. The webform is configured to:
Recognise the checksum link and pre-fill the user’s contact details.
Apply the Create Drupal Account tag to the contact when the form is submitted.
That tag then triggers CiviPlus’s background queue to create a corresponding Drupal user account.
This method is ideal when:
You want users to confirm or update their personal details at account creation.
Users should explicitly set their own password.
You require users to consent to terms or privacy policies during registration.
You wish to avoid creating dormant or incorrect accounts from outdated records.
It requires:
A Webform CiviCRM form configured as described below.
Outgoing mail enabled to send invitations and one-time login links.
A CiviCRM checksum link to identify each user securely.
Steps to follow:
1 – Create a new Webform
In Drupal’s admin menu, go to Structure → Webforms → Add Webform.
Give the form a clear title such as User Registration – Account Creation.
Click Save.
Open the CiviCRM tab and tick Enable CiviCRM Processing for this form, then click Save Settings.
2 – Configure the CiviCRM components
Inside the CiviCRM tab of your new form:
Enable Contact 1 (Individual) — this will be the CiviCRM contact linked to the user account.
Under Contact 1 Settings:
Tick Existing Contact to match existing records.
Set Matching Rule = Email only so submissions are linked by email.
Under Contact Fields:
Tick Checksum — this enables the webform to recognise personalised links containing checksum tokens (e.g. ?cid=123&cs=abcd1234).
This ensures contacts are pre-filled correctly when users arrive via their invitation link.
Under Email Fields:
Tick Main email for Contact 1.
Mark it as Required.
Confirm the Location Type is Main, which is used for login and checksum matching.
Do not select “Work” or “Home” email for this purpose.
Under Tags and Groups:
In the Tags list, add Create Drupal Account.
When the form is submitted, this tag is added to the contact record and triggers CiviPlus to create the Drupal user.
Click Save Settings.
3 – Add optional form fields and configure display
Go to the Webform tab.
Add any additional fields you’d like users to confirm or update, such as:
First Name / Last Name
Organisation
Consent checkbox
Address or phone fields
To add these, click Add Field → CiviCRM Contact 1 → [Select desired field].
Disable the progress bar for a cleaner layout:
Go to Webform → Form Settings → Advanced.
Untick Show progress bar and Save.
4 – Secure the form (optional but recommended)
Access control for this process relies on the checksum validation you enabled:
Go to Webform → Form Settings → Submission access.
Leave Anonymous user checked so recipients can open the form from their invitation email.
If unchecked, only logged-in users could view the form, preventing invited users from registering.
The form’s security is enforced by the Checksum configuration:
Only users accessing the form through a valid checksum link (e.g. ?cid=123&cs=abc123) will have their details pre-filled and saved.
A visitor without a valid checksum simply sees a blank form, and any submission won’t link to an existing contact.
5 – Generate checksum links
In CiviCRM, open SearchKit or Advanced Search to find the contacts you want to invite.
From the Actions menu, choose Send Email.
In the message body, include a link to the webform with checksum tokens:
https://yourdomain.org/webform/user-registration?cid={contact.contact_id}&cs={contact.checksum}Replace /webform/user-registration with your actual webform path.
The tokens {contact.contact_id} and {contact.checksum} automatically generate unique, secure links for each user.
6 – Send the invitation email
Draft an email explaining that users can now register on the new site.
Insert the personalised checksum link in the message.
Ensure outgoing mail is enabled so invitations are delivered.
You can use CiviMail or Send Email (from search results) to send the links in bulk.
After the process
When users click their invitation link:
They arrive at their personalised registration form, already matched to their CiviCRM contact.
They review or update their details and submit the form.
Upon submission:
The Create Drupal Account tag is applied to their contact record.
CiviPlus automatically creates a linked Drupal user account.
A one-time login email is sent to the user (if notifications are enabled).
Users follow that one-time login link to set their password and access the site.
If a link expires, users can request a new one from the Reset Password page.
Notes and best practices
Always test the full workflow with a few dummy contacts before bulk invitations.
Keep the form concise — only include necessary fields.
If you add extra profile or consent fields, ensure they’re mapped correctly in the CiviCRM tab.
To identify users who haven’t registered yet, use SearchKit to find contacts tagged Create Drupal Account without a linked Drupal user.