coder · ethanndickson · Aug 16, 2026 · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026
diff --git a/coderd/coderdtest/users.go b/coderd/coderdtest/users.go
@@ -425,6 +425,24 @@ func UsersFilter(
 				return u.Username == "before1"
 			},
 		},
+		{
+			Name: "ExactUsername",
+			Filter: codersdk.UsersRequest{
+				SearchQuery: "username:" + strings.ToUpper(users[0].Username),
+			},
+			FilterF: func(_ codersdk.UsersRequest, u codersdk.User) bool {
+				return strings.EqualFold(u.Username, users[0].Username)
+			},
+		},
+		{
+			Name: "ExactEmail",
+			Filter: codersdk.UsersRequest{
+				SearchQuery: "email:" + strings.ToUpper(users[0].Email),
+			},
+			FilterF: func(_ codersdk.UsersRequest, u codersdk.User) bool {
+				return strings.EqualFold(u.Email, users[0].Email)
+			},
+		},
 		{
 			Name: "NameNoMatch",
 			Filter: codersdk.UsersRequest{

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/groupmembers.sql b/coderd/database/queries/groupmembers.sql
@@ -60,6 +60,18 @@ WHERE
 			user_name ILIKE concat('%', @name, '%')
 		ELSE true
 	END
+	-- Filter by exact username
+	AND CASE
+		WHEN @exact_username :: text != '' THEN
+			lower(user_username) = lower(@exact_username)
+		ELSE true
+	END
+	-- Filter by exact email
+	AND CASE
+		WHEN @exact_email :: text != '' THEN
+			lower(user_email) = lower(@exact_email)
+		ELSE true
+	END
 	-- Filter by status
 	AND CASE
 		-- @status needs to be a text because it can be empty, If it was

diff --git a/coderd/database/queries/organizationmembers.sql b/coderd/database/queries/organizationmembers.sql
@@ -136,6 +136,18 @@ WHERE
 			users.name ILIKE concat('%', @name, '%')
 		ELSE true
 	END
+	-- Filter by exact username
+	AND CASE
+		WHEN @exact_username :: text != '' THEN
+			lower(users.username) = lower(@exact_username)
+		ELSE true
+	END
+	-- Filter by exact email
+	AND CASE
+		WHEN @exact_email :: text != '' THEN
+			lower(users.email) = lower(@exact_email)
+		ELSE true
+	END
 	-- Filter by status
 	AND CASE
 		-- @status needs to be a text because it can be empty, If it was

diff --git a/coderd/members.go b/coderd/members.go
@@ -300,6 +300,8 @@ func (api *API) paginatedMembers(rw http.ResponseWriter, r *http.Request) {
 		IncludeSystem:    false,
 		Search:           userFilterParams.Search,
 		Name:             userFilterParams.Name,
+		ExactUsername:    userFilterParams.ExactUsername,
+		ExactEmail:       userFilterParams.ExactEmail,
 		Status:           userFilterParams.Status,
 		IsServiceAccount: userFilterParams.IsServiceAccount,
 		RbacRole:         userFilterParams.RbacRole,

diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go
@@ -160,6 +160,8 @@ func Users(query string) (database.GetUsersParams, []codersdk.ValidationError) {
 	filter := database.GetUsersParams{
 		Search:           parser.String(values, "", "search"),
 		Name:             parser.String(values, "", "name"),
+		ExactUsername:    parser.String(values, "", "username"),
+		ExactEmail:       parser.String(values, "", "email"),
 		Status:           httpapi.ParseCustomList(parser, values, []database.UserStatus{}, "status", httpapi.ParseEnum[database.UserStatus]),
 		IsServiceAccount: parser.NullableBoolean(values, sql.NullBool{}, "service_account"),
 		RbacRole:         parser.Strings(values, []string{}, "role"),

diff --git a/coderd/searchquery/search_test.go b/coderd/searchquery/search_test.go
@@ -864,6 +864,26 @@ func TestSearchUsers(t *testing.T) {
 				LoginType: []database.LoginType{},
 			},
 		},
+		{
+			Name:  "UsernameFilter",
+			Query: "username:Alice",
+			Expected: database.GetUsersParams{
+				ExactUsername: "alice",
+				Status:        []database.UserStatus{},
+				RbacRole:      []string{},
+				LoginType:     []database.LoginType{},
+			},
+		},
+		{
+			Name:  "EmailFilter",
+			Query: "email:[email protected]",
+			Expected: database.GetUsersParams{
+				ExactEmail: "[email protected]",
+				Status:     []database.UserStatus{},
+				RbacRole:   []string{},
+				LoginType:  []database.LoginType{},
+			},
+		},
 		{
 			Name:  "NameFilterWithOtherParams",
 			Query: "name:John status:active role:owner",

diff --git a/coderd/users.go b/coderd/users.go
@@ -390,6 +390,8 @@ func (api *API) GetUsers(rw http.ResponseWriter, r *http.Request) ([]database.Us
 		AfterID:          paginationParams.AfterID,
 		Search:           params.Search,
 		Name:             params.Name,
+		ExactUsername:    params.ExactUsername,
+		ExactEmail:       params.ExactEmail,
 		Status:           params.Status,
 		IsServiceAccount: params.IsServiceAccount,
 		RbacRole:         params.RbacRole,

diff --git a/docs/admin/users/index.md b/docs/admin/users/index.md
@@ -5,7 +5,7 @@
 authentication (MFA). It is your responsibility to ensure the auth provider
 enforces MFA correctly.

 ## Configuring SSO

 - [OpenID Connect](./oidc-auth/index.md) (e.g. Okta, KeyCloak, PingFederate, Azure AD)
 - [GitHub](./github-auth.md) (or GitHub Enterprise)
@@ -170,7 +170,7 @@
 > Resetting a user's password, e.g., the initial `owner` role-based user, only
 > works when run on the host running the Coder control plane.

 ### Resetting a password on Kubernetes

 ```sh
 kubectl exec -it deployment/coder -n coder -- /bin/bash
@@ -201,6 +201,12 @@
 
 The following filters are supported:
 
+- `username` - Matches the exact username of the user. The match ignores
+  letter case.
+- `email` - Matches the exact email address of the user. The match ignores
+  letter case.
+- `name` - Matches part of the display name of the user. The match ignores
+  letter case.
 - `status` - Indicates the status of the user. It can be either `active`,
   `dormant` or `suspended`.
 - `role` - Represents the role of the user. You can refer to the

diff --git a/enterprise/coderd/groups.go b/enterprise/coderd/groups.go
@@ -500,6 +500,8 @@ func (api *API) groupMembers(rw http.ResponseWriter, r *http.Request) {
 		IncludeSystem:    false,
 		Search:           userFilterParams.Search,
 		Name:             userFilterParams.Name,
+		ExactUsername:    userFilterParams.ExactUsername,
+		ExactEmail:       userFilterParams.ExactEmail,
 		Status:           userFilterParams.Status,
 		IsServiceAccount: userFilterParams.IsServiceAccount,
 		RbacRole:         userFilterParams.RbacRole,