Account Management Statements An account when first created has no privileges and a default role of  NONE . To assign privileges or roles, use the  GRANT  statement. Each account name uses the format described in Section 6.2.4, “Specifying Account Names” . For example: CREATE USER ’jeffrey’@’localhost’ IDENTIFIED BY ’ password ’; The host name part of the account name, if omitted, defaults to  ’%’ . Each  user  value naming an account may be followed by an optional  auth_option  value that indicates how the account authenticates. These values enable account authentication plugins and credentials (for example, a password) to be specified. Each  auth_option  value applies  only  to the account named immediately preceding it. Following the  user  specifications, the statement may include options for SSL/TLS, resource-limit, password-management, and locking properties. All such options are  global  to the statement and apply to all  accounts named in the statement. Example: Create an account that uses the default authentication plugin and the given password. Mark the password expired so that the user must choose a new one at the first connection to the server: Example: Create an account that uses the  caching_sha2_password  authentication plugin and the given password. Require that a new password be chosen every 180 days, and enable failed-login tracking, such that three consecutive incorrect passwords cause temporary account locking for two days: Example: Create multiple accounts, specifying some per-account properties and some global properties: Each  auth_option  value ( IDENTIFIED WITH ... BY  in this case) applies only to the account named immediately preceding it, so each account uses the immediately following authentication plugin and password. The remaining properties apply globally to all accounts named in the statement, so for both accounts: Beginning with MySQL 8.0.21, you can optionally create a user with a user comment or a user attribute, as described here: •Connections must be made using a valid X.509 certificate. •Up to 60 queries per hour are permitted. •Password changes cannot reuse any of the five most recent passwords. •The account is locked initially, so effectively it is a placeholder and cannot be used until an administrator unlocks it. 2852 CREATE USER ’jeffrey’@’localhost’ IDENTIFIED BY ’ new_password ’ PASSWORD EXPIRE; CREATE USER ’jeffrey’@’localhost’ IDENTIFIED WITH caching_sha2_password BY ’ new_password ’ PASSWORD EXPIRE INTERVAL 180 DAY FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 2; CREATE USER ’jeffrey’@’localhost’ IDENTIFIED WITH mysql_native_password BY ’ new_password1 ’, ’jeanne’@’localhost’ IDENTIFIED WITH caching_sha2_password BY ’ new_password2 ’ REQUIRE X509 WITH MAX_QUERIES_PER_HOUR 60 PASSWORD HISTORY 5 ACCOUNT LOCK;