diff --git a/src/Umbraco.Core/Models/Identity/IIdentityUser.cs b/src/Umbraco.Core/Models/Identity/IIdentityUser.cs
new file mode 100644
index 0000000000..fa7f52c710
--- /dev/null
+++ b/src/Umbraco.Core/Models/Identity/IIdentityUser.cs
@@ -0,0 +1,26 @@
+using System;
+using System.Collections.Generic;
+
+namespace Umbraco.Core.Models.Identity
+{
+    public interface IIdentityUser<TKey>
+    {
+        int AccessFailedCount { get; set; }
+        //ICollection<TClaim> Claims { get; }
+        string Email { get; set; }
+        bool EmailConfirmed { get; set; }
+        TKey Id { get; set; }
+        DateTime? LastLoginDateUtc { get; set; }
+        DateTime? LastPasswordChangeDateUtc { get; set; }
+        bool LockoutEnabled { get; set; }
+        DateTime? LockoutEndDateUtc { get; set; }
+        //ICollection<TLogin> Logins { get; }
+        string PasswordHash { get; set; }
+        string PhoneNumber { get; set; }
+        bool PhoneNumberConfirmed { get; set; }
+        //ICollection<TRole> Roles { get; }
+        string SecurityStamp { get; set; }
+        bool TwoFactorEnabled { get; set; }
+        string UserName { get; set; }
+    }
+}
diff --git a/src/Umbraco.Core/Models/Identity/IIdentityUserLogin.cs b/src/Umbraco.Core/Models/Identity/IIdentityUserLogin.cs
index cbe5b47b38..62c92de16d 100644
--- a/src/Umbraco.Core/Models/Identity/IIdentityUserLogin.cs
+++ b/src/Umbraco.Core/Models/Identity/IIdentityUserLogin.cs
@@ -1,27 +1,30 @@
-using Umbraco.Core.Models.Entities;
+using Umbraco.Core.Models.Entities;
 
 namespace Umbraco.Core.Models.Identity
 {
-
+    /// <summary>
+    /// An external login provider linked to a user
+    /// </summary>
+    /// <typeparam name="TKey">The PK type for the user</typeparam>
     public interface IIdentityUserLogin : IEntity, IRememberBeingDirty
     {
         /// <summary>
-        /// The login provider for the login (i.e. Facebook, Google)
+        /// Gets or sets the login provider for the login (i.e. Facebook, Google)
         /// </summary>
         string LoginProvider { get; set; }
 
         /// <summary>
-        /// Key representing the login for the provider
+        /// Gets or sets key representing the login for the provider
         /// </summary>
         string ProviderKey { get; set; }
 
         /// <summary>
-        /// User Id for the user who owns this login
+        /// Gets or sets user Id for the user who owns this login
         /// </summary>
         int UserId { get; set; }
 
         /// <summary>
-        /// Used to store any arbitrary data for the user and external provider - like user tokens returned from the provider
+        /// Gets or sets any arbitrary data for the user and external provider - like user tokens returned from the provider
         /// </summary>
         string UserData { get; set; }
     }
diff --git a/src/Umbraco.Core/Models/Identity/IdentityUser.cs b/src/Umbraco.Core/Models/Identity/IdentityUser.cs
index 093e42c1e7..dd3841d2c8 100644
--- a/src/Umbraco.Core/Models/Identity/IdentityUser.cs
+++ b/src/Umbraco.Core/Models/Identity/IdentityUser.cs
@@ -1,26 +1,30 @@
-using System;
+using System;
 using System.Collections.Generic;
 
 namespace Umbraco.Core.Models.Identity
 {
     /// <summary>
-    /// Default IUser implementation
+    /// Abstract class for use in Umbraco Identity
     /// </summary>
-    /// <typeparam name="TKey"/><typeparam name="TLogin"/><typeparam name="TRole"/><typeparam name="TClaim"/>
+    /// <typeparam name="TLogin">The type of user login</typeparam>
+    /// <typeparam name="TRole">The type of user role</typeparam>
+    /// <typeparam name="TClaim">The type of user claims</typeparam>
     /// <remarks>
-    /// This class normally exists inside of the EntityFramework library, not sure why MS chose to explicitly put it there but we don't want
-    /// references to that so we will create our own here
+    /// This class was originally borrowed from the EF implementation in Identity prior to netcore.
+    /// The new IdentityUser in netcore does not have properties such as Claims, Roles and Logins and those are instead
+    /// by default managed with their default user store backed by EF which utilizes EF's change tracking to track these values
+    /// to a user. We will continue using this approach since it works fine for what we need which does the change tracking of
+    /// claims, roles and logins directly on the user model.
     /// </remarks>
-    public class IdentityUser<TKey, TLogin, TRole, TClaim>
+    public abstract class IdentityUser<TLogin, TRole, TClaim>
         where TLogin : IIdentityUserLogin
-        //NOTE: Making our role id a string
-        where TRole : IdentityUserRole<string>
-        where TClaim : IdentityUserClaim<TKey>
+        where TRole : IdentityUserRole
+        where TClaim : IdentityUserClaim
     {
         /// <summary>
-        /// Initializes a new instance of the <see cref="IdentityUser{TKey, TLogin, TRole, TClaim}"/> class.
+        /// Initializes a new instance of the <see cref="IdentityUser{TLogin, TRole, TClaim}"/> class.
         /// </summary>
-        public IdentityUser()
+        protected IdentityUser()
         {
             Claims = new List<TClaim>();
             Roles = new List<TRole>();
@@ -28,87 +32,96 @@ namespace Umbraco.Core.Models.Identity
         }
 
         /// <summary>
-        /// Last login date
+        /// Gets or sets last login date
         /// </summary>
         public virtual DateTime? LastLoginDateUtc { get; set; }
 
         /// <summary>
-        /// Email
+        /// Gets or sets email
         /// </summary>
         public virtual string Email { get; set; }
 
         /// <summary>
-        /// True if the email is confirmed, default is false
+        /// Gets or sets a value indicating whether the email is confirmed, default is false
         /// </summary>
         public virtual bool EmailConfirmed { get; set; }
 
         /// <summary>
-        /// The salted/hashed form of the user password
+        /// Gets or sets the salted/hashed form of the user password
         /// </summary>
         public virtual string PasswordHash { get; set; }
 
         /// <summary>
-        /// A random value that should change whenever a users credentials have changed (password changed, login removed)
+        /// Gets or sets a random value that should change whenever a users credentials have changed (password changed, login removed)
         /// </summary>
         public virtual string SecurityStamp { get; set; }
 
         /// <summary>
-        /// PhoneNumber for the user
+        /// Gets or sets a phone Number for the user
         /// </summary>
+        /// <remarks>
+        /// This is unused until we or an end-user requires this value for 2FA
+        /// </remarks>
         public virtual string PhoneNumber { get; set; }
 
         /// <summary>
-        /// True if the phone number is confirmed, default is false
+        /// Gets or sets a value indicating whether true if the phone number is confirmed, default is false
         /// </summary>
+        /// <remarks>
+        /// This is unused until we or an end-user requires this value for 2FA
+        /// </remarks>
         public virtual bool PhoneNumberConfirmed { get; set; }
 
         /// <summary>
-        /// Is two factor enabled for the user
+        /// Gets or sets a value indicating whether is two factor enabled for the user
         /// </summary>
+        /// <remarks>
+        /// This is unused until we or an end-user requires this value for 2FA
+        /// </remarks>
         public virtual bool TwoFactorEnabled { get; set; }
 
         /// <summary>
-        /// DateTime in UTC when lockout ends, any time in the past is considered not locked out.
+        /// Gets or sets dateTime in UTC when lockout ends, any time in the past is considered not locked out.
         /// </summary>
         public virtual DateTime? LockoutEndDateUtc { get; set; }
 
         /// <summary>
-        /// DateTime in UTC when the password was last changed.
+        /// Gets or sets dateTime in UTC when the password was last changed.
         /// </summary>
         public virtual DateTime? LastPasswordChangeDateUtc { get; set; }
 
         /// <summary>
-        /// Is lockout enabled for this user
+        /// Gets or sets a value indicating whether is lockout enabled for this user
         /// </summary>
         public virtual bool LockoutEnabled { get; set; }
 
         /// <summary>
-        /// Used to record failures for the purposes of lockout
+        /// Gets or sets the value to record failures for the purposes of lockout
         /// </summary>
         public virtual int AccessFailedCount { get; set; }
 
         /// <summary>
-        /// Navigation property for user roles
+        /// Gets the user roles collection
         /// </summary>
         public virtual ICollection<TRole> Roles { get; }
 
         /// <summary>
-        /// Navigation property for user claims
+        /// Gets navigation the user claims collection
         /// </summary>
         public virtual ICollection<TClaim> Claims { get; }
 
         /// <summary>
-        /// Navigation property for user logins
+        /// Gets the user logins collection
         /// </summary>
         public virtual ICollection<TLogin> Logins { get; }
 
         /// <summary>
-        /// User ID (Primary Key)
+        /// Gets or sets user ID (Primary Key)
         /// </summary>
-        public virtual TKey Id { get; set; }
+        public virtual int Id { get; set; }
 
         /// <summary>
-        /// User name
+        /// Gets or sets user name
         /// </summary>
         public virtual string UserName { get; set; }
     }
diff --git a/src/Umbraco.Core/Models/Identity/IdentityUserClaim.cs b/src/Umbraco.Core/Models/Identity/IdentityUserClaim.cs
index e117d2fd13..2524463284 100644
--- a/src/Umbraco.Core/Models/Identity/IdentityUserClaim.cs
+++ b/src/Umbraco.Core/Models/Identity/IdentityUserClaim.cs
@@ -1,37 +1,27 @@
-namespace Umbraco.Core.Models.Identity
+namespace Umbraco.Core.Models.Identity
 {
     /// <summary>
     /// EntityType that represents one specific user claim
-    ///
     /// </summary>
-    /// <typeparam name="TKey"/>
-    /// <remarks>
-    /// This class normally exists inside of the EntityFramework library, not sure why MS chose to explicitly put it there but we don't want
-    /// references to that so we will create our own here
-    /// </remarks>
-    public class IdentityUserClaim<TKey>
+    public class IdentityUserClaim
     {
         /// <summary>
-        /// Primary key
-        ///
+        /// Gets or sets primary key
         /// </summary>
-        public virtual int Id { get; set; }
+        public virtual string Id { get; set; } // TODO: Not used
 
         /// <summary>
-        /// User Id for the user who owns this login
-        ///
+        /// Gets or sets user Id for the user who owns this login
         /// </summary>
-        public virtual TKey UserId { get; set; }
+        public virtual string UserId { get; set; }
 
         /// <summary>
-        /// Claim type
-        ///
+        /// Gets or sets claim type
         /// </summary>
         public virtual string ClaimType { get; set; }
 
         /// <summary>
-        /// Claim value
-        ///
+        /// Gets or sets claim value
         /// </summary>
         public virtual string ClaimValue { get; set; }
     }
diff --git a/src/Umbraco.Core/Models/Identity/IdentityUserLogin.cs b/src/Umbraco.Core/Models/Identity/IdentityUserLogin.cs
index c13b28461d..18e8d4694b 100644
--- a/src/Umbraco.Core/Models/Identity/IdentityUserLogin.cs
+++ b/src/Umbraco.Core/Models/Identity/IdentityUserLogin.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using Umbraco.Core.Models.Entities;
 
 namespace Umbraco.Core.Models.Identity
diff --git a/src/Umbraco.Core/Models/Identity/IdentityUserRole.cs b/src/Umbraco.Core/Models/Identity/IdentityUserRole.cs
index ba9e87e46c..39ed65112d 100644
--- a/src/Umbraco.Core/Models/Identity/IdentityUserRole.cs
+++ b/src/Umbraco.Core/Models/Identity/IdentityUserRole.cs
@@ -1,26 +1,19 @@
-namespace Umbraco.Core.Models.Identity
+namespace Umbraco.Core.Models.Identity
 {
     /// <summary>
     /// EntityType that represents a user belonging to a role
-    ///
     /// </summary>
     /// <typeparam name="TKey"/>
-    /// <remarks>
-    /// This class normally exists inside of the EntityFramework library, not sure why MS chose to explicitly put it there but we don't want
-    /// references to that so we will create our own here
-    /// </remarks>
-    public class IdentityUserRole<TKey>
+    public class IdentityUserRole
     {
         /// <summary>
-        /// UserId for the user that is in the role
-        ///
+        /// Gets or sets userId for the user that is in the role
         /// </summary>
-        public virtual TKey UserId { get; set; }
+        public virtual string UserId { get; set; }
 
         /// <summary>
-        /// RoleId for the role
-        ///
+        /// Gets or sets roleId for the role
         /// </summary>
-        public virtual TKey RoleId { get; set; }
+        public virtual string RoleId { get; set; }
     }
 }
diff --git a/src/Umbraco.Core/Security/AuthenticationExtensions.cs b/src/Umbraco.Core/Security/AuthenticationExtensions.cs
index edc11bcac2..607c4748cc 100644
--- a/src/Umbraco.Core/Security/AuthenticationExtensions.cs
+++ b/src/Umbraco.Core/Security/AuthenticationExtensions.cs
@@ -5,7 +5,6 @@ using System.Globalization;
 using System.Security.Principal;
 using System.Text;
 using System.Threading;
-using Umbraco.Core.BackOffice;
 
 namespace Umbraco.Core.Security
 {
diff --git a/src/Umbraco.Core/BackOffice/BackOfficeIdentityUser.cs b/src/Umbraco.Core/Security/BackOfficeIdentityUser.cs
similarity index 90%
rename from src/Umbraco.Core/BackOffice/BackOfficeIdentityUser.cs
rename to src/Umbraco.Core/Security/BackOfficeIdentityUser.cs
index 027e7c0904..e8e036b51b 100644
--- a/src/Umbraco.Core/BackOffice/BackOfficeIdentityUser.cs
+++ b/src/Umbraco.Core/Security/BackOfficeIdentityUser.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Collections.Specialized;
@@ -10,14 +10,13 @@ using Umbraco.Core.Models.Entities;
 using Umbraco.Core.Models.Identity;
 using Umbraco.Core.Models.Membership;
 
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
-    public class BackOfficeIdentityUser : IdentityUser<int, IIdentityUserLogin, IdentityUserRole<string>, IdentityUserClaim<int>>, IRememberBeingDirty
+    public class BackOfficeIdentityUser : IdentityUser<IIdentityUserLogin, IdentityUserRole, IdentityUserClaim>, IRememberBeingDirty
     {
         private string _email;
         private string _userName;
         private int _id;
-        private bool _hasIdentity;
         private DateTime? _lastLoginDateUtc;
         private bool _emailConfirmed;
         private string _name;
@@ -36,23 +35,32 @@ namespace Umbraco.Core.BackOffice
         /// <summary>
         ///  Used to construct a new instance without an identity
         /// </summary>
+        /// <param name="globalSettings"></param>
         /// <param name="username"></param>
         /// <param name="email">This is allowed to be null (but would need to be filled in if trying to persist this instance)</param>
         /// <param name="culture"></param>
         /// <returns></returns>
         public static BackOfficeIdentityUser CreateNew(GlobalSettings globalSettings, string username, string email, string culture, string name = null)
         {
-            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
-            if (string.IsNullOrWhiteSpace(culture)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
+            if (string.IsNullOrWhiteSpace(username))
+            {
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
+            }
+
+            if (string.IsNullOrWhiteSpace(culture))
+            {
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
+            }
 
             var user = new BackOfficeIdentityUser(globalSettings, Array.Empty<IReadOnlyUserGroup>());
             user.DisableChangeTracking();
             user._userName = username;
             user._email = email;
-            //we are setting minvalue here because the default is "0" which is the id of the admin user
-            //which we cannot allow because the admin user will always exist
+
+            // we are setting minvalue here because the default is "0" which is the id of the admin user
+            // which we cannot allow because the admin user will always exist
             user._id = int.MinValue;
-            user._hasIdentity = false;
+            user.HasIdentity = false;
             user._culture = culture;
             user._name = name;
             user.EnableChangeTracking();
@@ -67,7 +75,7 @@ namespace Umbraco.Core.BackOffice
             _culture = globalSettings.DefaultUILanguage;
 
             // must initialize before setting groups
-            _roles = new ObservableCollection<IdentityUserRole<string>>();
+            _roles = new ObservableCollection<IdentityUserRole>();
             _roles.CollectionChanged += _roles_CollectionChanged;
 
             // use the property setters - they do more than just setting a field
@@ -75,7 +83,7 @@ namespace Umbraco.Core.BackOffice
         }
 
         /// <summary>
-        /// Creates an existing user with the specified groups
+        /// Initializes a new instance of the <see cref="BackOfficeIdentityUser"/> class.
         /// </summary>
         /// <param name="globalSettings"></param>
         /// <param name="userId"></param>
@@ -90,7 +98,7 @@ namespace Umbraco.Core.BackOffice
         /// <summary>
         /// Returns true if an Id has been set on this object this will be false if the object is new and not persisted to the database
         /// </summary>
-        public bool HasIdentity => _hasIdentity;
+        public bool HasIdentity { get; private set; }
 
         public int[] CalculatedMediaStartNodeIds { get; set; }
         public int[] CalculatedContentStartNodeIds { get; set; }
@@ -101,7 +109,7 @@ namespace Umbraco.Core.BackOffice
             set
             {
                 _id = value;
-                _hasIdentity = true;
+                HasIdentity = true;
             }
         }
 
@@ -192,7 +200,8 @@ namespace Umbraco.Core.BackOffice
             get => _startContentIds;
             set
             {
-                if (value == null) value = new int[0];
+                if (value == null)
+                    value = new int[0];
                 _beingDirty.SetPropertyValueAndDetectChanges(value, ref _startContentIds, nameof(StartContentIds), StartIdsComparer);
             }
         }
@@ -205,7 +214,8 @@ namespace Umbraco.Core.BackOffice
             get => _startMediaIds;
             set
             {
-                if (value == null) value = new int[0];
+                if (value == null)
+                    value = new int[0];
                 _beingDirty.SetPropertyValueAndDetectChanges(value, ref _startMediaIds, nameof(StartMediaIds), StartIdsComparer);
             }
         }
@@ -237,7 +247,7 @@ namespace Umbraco.Core.BackOffice
                 //now clear all roles and re-add them
                 _roles.CollectionChanged -= _roles_CollectionChanged;
                 _roles.Clear();
-                foreach (var identityUserRole in _groups.Select(x => new IdentityUserRole<string>
+                foreach (var identityUserRole in _groups.Select(x => new IdentityUserRole
                 {
                     RoleId = x.Alias,
                     UserId = Id.ToString()
@@ -288,7 +298,8 @@ namespace Umbraco.Core.BackOffice
             get
             {
                 // return if it exists
-                if (_logins != null) return _logins;
+                if (_logins != null)
+                    return _logins;
 
                 _logins = new ObservableCollection<IIdentityUserLogin>();
 
@@ -318,7 +329,7 @@ namespace Umbraco.Core.BackOffice
             _beingDirty.OnPropertyChanged(nameof(Roles));
         }
 
-        private readonly ObservableCollection<IdentityUserRole<string>> _roles;
+        private readonly ObservableCollection<IdentityUserRole> _roles;
 
         /// <summary>
         /// helper method to easily add a role without having to deal with IdentityUserRole{T}
@@ -329,7 +340,7 @@ namespace Umbraco.Core.BackOffice
         /// </remarks>
         public void AddRole(string role)
         {
-            Roles.Add(new IdentityUserRole<string>
+            Roles.Add(new IdentityUserRole
             {
                 UserId = Id.ToString(),
                 RoleId = role
@@ -339,7 +350,7 @@ namespace Umbraco.Core.BackOffice
         /// <summary>
         /// Override Roles because the value of these are the user's group aliases
         /// </summary>
-        public override ICollection<IdentityUserRole<string>> Roles => _roles;
+        public override ICollection<IdentityUserRole> Roles => _roles;
 
         /// <summary>
         /// Used to set a lazy call back to populate the user's Login list
diff --git a/src/Umbraco.Core/BackOffice/BackOfficeUserPasswordCheckerResult.cs b/src/Umbraco.Core/Security/BackOfficeUserPasswordCheckerResult.cs
similarity index 87%
rename from src/Umbraco.Core/BackOffice/BackOfficeUserPasswordCheckerResult.cs
rename to src/Umbraco.Core/Security/BackOfficeUserPasswordCheckerResult.cs
index 7936fab682..c640c85d0c 100644
--- a/src/Umbraco.Core/BackOffice/BackOfficeUserPasswordCheckerResult.cs
+++ b/src/Umbraco.Core/Security/BackOfficeUserPasswordCheckerResult.cs
@@ -1,4 +1,4 @@
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
     /// <summary>
     /// The result returned from the IBackOfficeUserPasswordChecker
diff --git a/src/Umbraco.Core/BackOffice/ClaimsPrincipalExtensions.cs b/src/Umbraco.Core/Security/ClaimsPrincipalExtensions.cs
similarity index 98%
rename from src/Umbraco.Core/BackOffice/ClaimsPrincipalExtensions.cs
rename to src/Umbraco.Core/Security/ClaimsPrincipalExtensions.cs
index 7cbca0428a..395465cfb7 100644
--- a/src/Umbraco.Core/BackOffice/ClaimsPrincipalExtensions.cs
+++ b/src/Umbraco.Core/Security/ClaimsPrincipalExtensions.cs
@@ -1,10 +1,10 @@
-using System;
+using System;
 using System.Globalization;
 using System.Linq;
 using System.Security.Claims;
 using System.Security.Principal;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Extensions
 {
diff --git a/src/Umbraco.Core/BackOffice/IBackOfficeUserPasswordChecker.cs b/src/Umbraco.Core/Security/IBackOfficeUserPasswordChecker.cs
similarity index 93%
rename from src/Umbraco.Core/BackOffice/IBackOfficeUserPasswordChecker.cs
rename to src/Umbraco.Core/Security/IBackOfficeUserPasswordChecker.cs
index 5874337f4a..45f5ea44e2 100644
--- a/src/Umbraco.Core/BackOffice/IBackOfficeUserPasswordChecker.cs
+++ b/src/Umbraco.Core/Security/IBackOfficeUserPasswordChecker.cs
@@ -1,6 +1,6 @@
-using System.Threading.Tasks;
+using System.Threading.Tasks;
 
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
     /// <summary>
     /// Used by the BackOfficeUserManager to check the username/password which allows for developers to more easily
diff --git a/src/Umbraco.Core/BackOffice/IdentityAuditEventArgs.cs b/src/Umbraco.Core/Security/IdentityAuditEventArgs.cs
similarity index 96%
rename from src/Umbraco.Core/BackOffice/IdentityAuditEventArgs.cs
rename to src/Umbraco.Core/Security/IdentityAuditEventArgs.cs
index 1d51c45074..454d651944 100644
--- a/src/Umbraco.Core/BackOffice/IdentityAuditEventArgs.cs
+++ b/src/Umbraco.Core/Security/IdentityAuditEventArgs.cs
@@ -1,7 +1,7 @@
-using System;
+using System;
 
 
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
 
     /// <summary>
@@ -58,7 +58,7 @@ namespace Umbraco.Core.BackOffice
             DateTimeUtc = DateTime.UtcNow;
             Action = action;
             IpAddress = ipAddress;
-            Comment = comment;            
+            Comment = comment;
             PerformingUser = performingUser;
             AffectedUsername = affectedUsername;
             AffectedUser = affectedUser;
diff --git a/src/Umbraco.Core/BackOffice/IdentityMapDefinition.cs b/src/Umbraco.Core/Security/IdentityMapDefinition.cs
similarity index 97%
rename from src/Umbraco.Core/BackOffice/IdentityMapDefinition.cs
rename to src/Umbraco.Core/Security/IdentityMapDefinition.cs
index 61fdf82d19..26a5d11f6e 100644
--- a/src/Umbraco.Core/BackOffice/IdentityMapDefinition.cs
+++ b/src/Umbraco.Core/Security/IdentityMapDefinition.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using Microsoft.Extensions.Options;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.Configuration.Models;
@@ -7,7 +7,7 @@ using Umbraco.Core.Models;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Services;
 
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
     public class IdentityMapDefinition : IMapDefinition
     {
@@ -65,7 +65,7 @@ namespace Umbraco.Core.BackOffice
             target.Culture = source.GetUserCulture(_textService, _globalSettings).ToString(); // project CultureInfo to string
             target.IsApproved = source.IsApproved;
             target.SecurityStamp = source.SecurityStamp;
-            target.LockoutEndDateUtc = source.IsLockedOut ? DateTime.MaxValue.ToUniversalTime() : (DateTime?) null;
+            target.LockoutEndDateUtc = source.IsLockedOut ? DateTime.MaxValue.ToUniversalTime() : (DateTime?)null;
 
             // this was in AutoMapper but does not have a setter anyways
             //target.AllowedSections = source.AllowedSections.ToArray(),
diff --git a/src/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentity.cs b/src/Umbraco.Core/Security/UmbracoBackOfficeIdentity.cs
similarity index 85%
rename from src/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentity.cs
rename to src/Umbraco.Core/Security/UmbracoBackOfficeIdentity.cs
index 9a60c5d64f..3430814f83 100644
--- a/src/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentity.cs
+++ b/src/Umbraco.Core/Security/UmbracoBackOfficeIdentity.cs
@@ -1,9 +1,9 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Security.Claims;
 
-namespace Umbraco.Core.BackOffice
+namespace Umbraco.Core.Security
 {
 
     /// <summary>
@@ -15,13 +15,12 @@ namespace Umbraco.Core.BackOffice
         // TODO: Ideally we remove this class and only deal with ClaimsIdentity as a best practice. All things relevant to our own
         // identity are part of claims. This class would essentially become extension methods on a ClaimsIdentity for resolving
         // values from it. 
-
         public static bool FromClaimsIdentity(ClaimsIdentity identity, out UmbracoBackOfficeIdentity backOfficeIdentity)
         {
-            //validate that all claims exist
+            // validate that all claims exist
             foreach (var t in RequiredBackOfficeIdentityClaimTypes)
             {
-                //if the identity doesn't have the claim, or the claim value is null
+                // if the identity doesn't have the claim, or the claim value is null
                 if (identity.HasClaim(x => x.Type == t) == false || identity.HasClaim(x => x.Type == t && x.Value.IsNullOrWhiteSpace()))
                 {
                     backOfficeIdentity = null;
@@ -59,11 +58,16 @@ namespace Umbraco.Core.BackOffice
             string securityStamp, IEnumerable<string> allowedApps, IEnumerable<string> roles)
             : base(Enumerable.Empty<Claim>(), Constants.Security.BackOfficeAuthenticationType) //this ctor is used to ensure the IsAuthenticated property is true
         {
-            if (allowedApps == null) throw new ArgumentNullException(nameof(allowedApps));
-            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
-            if (string.IsNullOrWhiteSpace(realName)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(realName));
-            if (string.IsNullOrWhiteSpace(culture)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
-            if (string.IsNullOrWhiteSpace(securityStamp)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(securityStamp));
+            if (allowedApps == null)
+                throw new ArgumentNullException(nameof(allowedApps));
+            if (string.IsNullOrWhiteSpace(username))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
+            if (string.IsNullOrWhiteSpace(realName))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(realName));
+            if (string.IsNullOrWhiteSpace(culture))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
+            if (string.IsNullOrWhiteSpace(securityStamp))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(securityStamp));
             AddRequiredClaims(userId, username, realName, startContentNodes, startMediaNodes, culture, securityStamp, allowedApps, roles);
         }
 
@@ -88,10 +92,14 @@ namespace Umbraco.Core.BackOffice
             string securityStamp, IEnumerable<string> allowedApps, IEnumerable<string> roles)
         : base(childIdentity.Claims, Constants.Security.BackOfficeAuthenticationType)
         {
-            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
-            if (string.IsNullOrWhiteSpace(realName)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(realName));
-            if (string.IsNullOrWhiteSpace(culture)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
-            if (string.IsNullOrWhiteSpace(securityStamp)) throw new ArgumentException("Value cannot be null or whitespace.", nameof(securityStamp));
+            if (string.IsNullOrWhiteSpace(username))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(username));
+            if (string.IsNullOrWhiteSpace(realName))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(realName));
+            if (string.IsNullOrWhiteSpace(culture))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(culture));
+            if (string.IsNullOrWhiteSpace(securityStamp))
+                throw new ArgumentException("Value cannot be null or whitespace.", nameof(securityStamp));
 
             AddRequiredClaims(userId, username, realName, startContentNodes, startMediaNodes, culture, securityStamp, allowedApps, roles);
         }
@@ -205,7 +213,7 @@ namespace Umbraco.Core.BackOffice
 
         public string SecurityStamp => this.FindFirstValue(Constants.Security.SecurityStampClaimType);
 
-        public string[] Roles => this.FindAll(x => x.Type == DefaultRoleClaimType).Select(role => role.Value).ToArray();
+        public string[] Roles => FindAll(x => x.Type == DefaultRoleClaimType).Select(role => role.Value).ToArray();
 
         /// <summary>
         /// Overridden to remove any temporary claims that shouldn't be copied
diff --git a/src/Umbraco.Infrastructure/BackOffice/BackOfficeClaimsPrincipalFactory.cs b/src/Umbraco.Infrastructure/BackOffice/BackOfficeClaimsPrincipalFactory.cs
index 22ea4423d2..380ed452d0 100644
--- a/src/Umbraco.Infrastructure/BackOffice/BackOfficeClaimsPrincipalFactory.cs
+++ b/src/Umbraco.Infrastructure/BackOffice/BackOfficeClaimsPrincipalFactory.cs
@@ -4,6 +4,7 @@ using System.Security.Claims;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Options;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Core.BackOffice
 {
@@ -36,11 +37,13 @@ namespace Umbraco.Core.BackOffice
 
             ClaimsIdentity baseIdentity = await base.GenerateClaimsAsync(user);
 
+            // TODO: How to flow claims then? This is most likely built into aspnetcore now and this is not the way
+
             // now we can flow any custom claims that the actual user has currently assigned which could be done in the OnExternalLogin callback
-            foreach (Models.Identity.IdentityUserClaim<int> claim in user.Claims)
-            {
-                baseIdentity.AddClaim(new Claim(claim.ClaimType, claim.ClaimValue));
-            }
+            //foreach (Models.Identity.IdentityUserClaim<int> claim in user.Claims)
+            //{
+            //    baseIdentity.AddClaim(new Claim(claim.ClaimType, claim.ClaimValue));
+            //}
 
             // TODO: We want to remove UmbracoBackOfficeIdentity and only rely on ClaimsIdentity, once
             // that is done then we'll create a ClaimsIdentity with all of the requirements here instead
diff --git a/src/Umbraco.Infrastructure/BackOffice/BackOfficeIdentityBuilder.cs b/src/Umbraco.Infrastructure/BackOffice/BackOfficeIdentityBuilder.cs
index 5bae03cad6..90c2823122 100644
--- a/src/Umbraco.Infrastructure/BackOffice/BackOfficeIdentityBuilder.cs
+++ b/src/Umbraco.Infrastructure/BackOffice/BackOfficeIdentityBuilder.cs
@@ -3,6 +3,7 @@ using System.Reflection;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Infrastructure.BackOffice
 {
diff --git a/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserStore.cs b/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserStore.cs
index b271f5aa41..e297eca86d 100644
--- a/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserStore.cs
+++ b/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserStore.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Data;
 using System.Linq;
@@ -13,6 +13,7 @@ using Umbraco.Core.Models;
 using Umbraco.Core.Models.Identity;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Scoping;
+using Umbraco.Core.Security;
 using Umbraco.Core.Services;
 
 namespace Umbraco.Core.BackOffice
@@ -23,7 +24,7 @@ namespace Umbraco.Core.BackOffice
             IUserLoginStore<BackOfficeIdentityUser>,
             IUserRoleStore<BackOfficeIdentityUser>,
             IUserSecurityStampStore<BackOfficeIdentityUser>,
-            IUserLockoutStore<BackOfficeIdentityUser>,            
+            IUserLockoutStore<BackOfficeIdentityUser>,
             IUserSessionStore<BackOfficeIdentityUser>
 
         // TODO: This would require additional columns/tables and then a lot of extra coding support to make this happen natively within umbraco
diff --git a/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserValidator.cs b/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserValidator.cs
index 131bd08ac9..b7cbb7555d 100644
--- a/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserValidator.cs
+++ b/src/Umbraco.Infrastructure/BackOffice/BackOfficeUserValidator.cs
@@ -1,5 +1,6 @@
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Core.BackOffice
 {
diff --git a/src/Umbraco.Infrastructure/BackOffice/IBackOfficeUserManager.cs b/src/Umbraco.Infrastructure/BackOffice/IBackOfficeUserManager.cs
index c026c256f5..be4bd194f9 100644
--- a/src/Umbraco.Infrastructure/BackOffice/IBackOfficeUserManager.cs
+++ b/src/Umbraco.Infrastructure/BackOffice/IBackOfficeUserManager.cs
@@ -1,324 +1,11 @@
-using System;
-using System.Collections.Generic;
-using System.Security.Claims;
-using System.Security.Principal;
-using System.Threading.Tasks;
-using Microsoft.AspNetCore.Identity;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Web.Models.ContentEditing;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Core.BackOffice
 {
-    public interface IBackOfficeUserManager : IBackOfficeUserManager<BackOfficeIdentityUser>
+    /// <summary>
+    /// The user manager for the back office
+    /// </summary>
+    public interface IBackOfficeUserManager : IUmbracoUserManager<BackOfficeIdentityUser>
     {
-
-    }
-    public interface  IBackOfficeUserManager<TUser>: IDisposable
-        where TUser : BackOfficeIdentityUser
-    {
-        Task<string> GetUserIdAsync(TUser user);
-
-        Task<TUser> GetUserAsync(ClaimsPrincipal principal);
-
-        string GetUserId(ClaimsPrincipal principal);
-
-        Task<IList<UserLoginInfo>> GetLoginsAsync(TUser user);
-
-        Task<IdentityResult> DeleteAsync(TUser user);
-
-        Task<TUser> FindByLoginAsync(string loginProvider, string providerKey);
-
-        /// <summary>
-        /// Finds and returns a user, if any, who has the specified <paramref name="userId"/>.
-        /// </summary>
-        /// <param name="userId">The user ID to search for.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the user matching the specified <paramref name="userId"/> if it exists.
-        /// </returns>
-        Task<TUser> FindByIdAsync(string userId);
-
-        /// <summary>
-        /// Generates a password reset token for the specified <paramref name="user"/>, using
-        /// the configured password reset token provider.
-        /// </summary>
-        /// <param name="user">The user to generate a password reset token for.</param>
-        /// <returns>The <see cref="Task"/> that represents the asynchronous operation,
-        /// containing a password reset token for the specified <paramref name="user"/>.</returns>
-        Task<string> GeneratePasswordResetTokenAsync(TUser user);
-
-        /// <summary>
-        /// This is a special method that will reset the password but will raise the Password Changed event instead of the reset event
-        /// </summary>
-        /// <param name="userId"></param>
-        /// <param name="token"></param>
-        /// <param name="newPassword"></param>
-        /// <returns></returns>
-        /// <remarks>
-        /// We use this because in the back office the only way an admin can change another user's password without first knowing their password
-        /// is to generate a token and reset it, however, when we do this we want to track a password change, not a password reset
-        /// </remarks>
-        Task<IdentityResult> ChangePasswordWithResetAsync(int userId, string token, string newPassword);
-
-        /// <summary>
-        /// Validates that an email confirmation token matches the specified <paramref name="user"/>.
-        /// </summary>
-        /// <param name="user">The user to validate the token against.</param>
-        /// <param name="token">The email confirmation token to validate.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> ConfirmEmailAsync(TUser user, string token);
-
-        /// <summary>
-        /// Gets the user, if any, associated with the normalized value of the specified email address.
-        /// Note: Its recommended that identityOptions.User.RequireUniqueEmail be set to true when using this method, otherwise
-        /// the store may throw if there are users with duplicate emails.
-        /// </summary>
-        /// <param name="email">The email address to return the user for.</param>
-        /// <returns>
-        /// The task object containing the results of the asynchronous lookup operation, the user, if any, associated with a normalized value of the specified email address.
-        /// </returns>
-        Task<TUser> FindByEmailAsync(string email);
-
-        /// <summary>
-        /// Resets the <paramref name="user"/>'s password to the specified <paramref name="newPassword"/> after
-        /// validating the given password reset <paramref name="token"/>.
-        /// </summary>
-        /// <param name="user">The user whose password should be reset.</param>
-        /// <param name="token">The password reset token to verify.</param>
-        /// <param name="newPassword">The new password to set if reset token verification succeeds.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> ResetPasswordAsync(TUser user, string token, string newPassword);
-
-        /// <summary>
-        /// Override to check the user approval value as well as the user lock out date, by default this only checks the user's locked out date
-        /// </summary>
-        /// <param name="user"></param>
-        /// <returns></returns>
-        /// <remarks>
-        /// In the ASP.NET Identity world, there is only one value for being locked out, in Umbraco we have 2 so when checking this for Umbraco we need to check both values
-        /// </remarks>
-        Task<bool> IsLockedOutAsync(TUser user);
-
-        /// <summary>
-        /// Locks out a user until the specified end date has passed. Setting a end date in the past immediately unlocks a user.
-        /// </summary>
-        /// <param name="user">The user whose lockout date should be set.</param>
-        /// <param name="lockoutEnd">The <see cref="DateTimeOffset"/> after which the <paramref name="user"/>'s lockout should end.</param>
-        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/> of the operation.</returns>
-        Task<IdentityResult> SetLockoutEndDateAsync(TUser user, DateTimeOffset? lockoutEnd);
-
-        /// <summary>
-        /// Gets a flag indicating whether the email address for the specified <paramref name="user"/> has been verified, true if the email address is verified otherwise
-        /// false.
-        /// </summary>
-        /// <param name="user">The user whose email confirmation status should be returned.</param>
-        /// <returns>
-        /// The task object containing the results of the asynchronous operation, a flag indicating whether the email address for the specified <paramref name="user"/>
-        /// has been confirmed or not.
-        /// </returns>
-        Task<bool> IsEmailConfirmedAsync(TUser user);
-
-        /// <summary>
-        /// Updates the specified <paramref name="user"/> in the backing store.
-        /// </summary>
-        /// <param name="user">The user to update.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> UpdateAsync(TUser user);
-
-        /// <summary>
-        /// Returns a flag indicating whether the specified <paramref name="token"/> is valid for
-        /// the given <paramref name="user"/> and <paramref name="purpose"/>.
-        /// </summary>
-        /// <param name="user">The user to validate the token against.</param>
-        /// <param name="tokenProvider">The token provider used to generate the token.</param>
-        /// <param name="purpose">The purpose the token should be generated for.</param>
-        /// <param name="token">The token to validate</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, returning true if the <paramref name="token"/>
-        /// is valid, otherwise false.
-        /// </returns>
-        Task<bool> VerifyUserTokenAsync(TUser user, string tokenProvider, string purpose,
-            string token);
-
-        /// <summary>
-        /// Adds the <paramref name="password"/> to the specified <paramref name="user"/> only if the user
-        /// does not already have a password.
-        /// </summary>
-        /// <param name="user">The user whose password should be set.</param>
-        /// <param name="password">The password to set.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> AddPasswordAsync(TUser user, string password);
-
-
-        /// <summary>
-        /// Returns a flag indicating whether the given <paramref name="password"/> is valid for the
-        /// specified <paramref name="user"/>.
-        /// </summary>
-        /// <param name="user">The user whose password should be validated.</param>
-        /// <param name="password">The password to validate</param>
-        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing true if
-        /// the specified <paramref name="password" /> matches the one store for the <paramref name="user"/>,
-        /// otherwise false.</returns>
-        Task<bool> CheckPasswordAsync(TUser user, string password);
-
-        /// <summary>
-        /// Changes a user's password after confirming the specified <paramref name="currentPassword"/> is correct,
-        /// as an asynchronous operation.
-        /// </summary>
-        /// <param name="user">The user whose password should be set.</param>
-        /// <param name="currentPassword">The current password to validate before changing.</param>
-        /// <param name="newPassword">The new password to set for the specified <paramref name="user"/>.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> ChangePasswordAsync(TUser user, string currentPassword,
-            string newPassword);
-
-        /// <summary>
-        /// Used to validate a user's session
-        /// </summary>
-        /// <param name="userId"></param>
-        /// <param name="sessionId"></param>
-        /// <returns></returns>
-        Task<bool> ValidateSessionIdAsync(string userId, string sessionId);
-
-        /// <summary>
-        /// Creates the specified <paramref name="user"/> in the backing store with no password,
-        /// as an asynchronous operation.
-        /// </summary>
-        /// <param name="user">The user to create.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
-        /// of the operation.
-        /// </returns>
-        Task<IdentityResult> CreateAsync(TUser user);
-
-        /// <summary>
-        /// Helper method to generate a password for a user based on the current password validator
-        /// </summary>
-        /// <returns></returns>
-        string GeneratePassword();
-
-
-        /// <summary>
-        /// Generates an email confirmation token for the specified user.
-        /// </summary>
-        /// <param name="user">The user to generate an email confirmation token for.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, an email confirmation token.
-        /// </returns>
-        Task<string> GenerateEmailConfirmationTokenAsync(TUser user);
-
-        /// <summary>
-        /// Finds and returns a user, if any, who has the specified user name.
-        /// </summary>
-        /// <param name="userName">The user name to search for.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, containing the user matching the specified <paramref name="userName"/> if it exists.
-        /// </returns>
-        Task<TUser> FindByNameAsync(string userName);
-
-        /// <summary>
-        /// Increments the access failed count for the user as an asynchronous operation.
-        /// If the failed access account is greater than or equal to the configured maximum number of attempts,
-        /// the user will be locked out for the configured lockout time span.
-        /// </summary>
-        /// <param name="user">The user whose failed access count to increment.</param>
-        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/> of the operation.</returns>
-        Task<IdentityResult> AccessFailedAsync(TUser user);
-
-        /// <summary>
-        /// Returns a flag indicating whether the specified <paramref name="user"/> has two factor authentication enabled or not,
-        /// as an asynchronous operation.
-        /// </summary>
-        /// <param name="user">The user whose two factor authentication enabled status should be retrieved.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents the asynchronous operation, true if the specified <paramref name="user "/>
-        /// has two factor authentication enabled, otherwise false.
-        /// </returns>
-        Task<bool> GetTwoFactorEnabledAsync(TUser user);
-
-        /// <summary>
-        /// Gets a list of valid two factor token providers for the specified <paramref name="user"/>,
-        /// as an asynchronous operation.
-        /// </summary>
-        /// <param name="user">The user the whose two factor authentication providers will be returned.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents result of the asynchronous operation, a list of two
-        /// factor authentication providers for the specified user.
-        /// </returns>
-        Task<IList<string>> GetValidTwoFactorProvidersAsync(TUser user);
-
-        /// <summary>
-        /// Verifies the specified two factor authentication <paramref name="token" /> against the <paramref name="user"/>.
-        /// </summary>
-        /// <param name="user">The user the token is supposed to be for.</param>
-        /// <param name="tokenProvider">The provider which will verify the token.</param>
-        /// <param name="token">The token to verify.</param>
-        /// <returns>
-        /// The <see cref="Task"/> that represents result of the asynchronous operation, true if the token is valid,
-        /// otherwise false.
-        /// </returns>
-        Task<bool> VerifyTwoFactorTokenAsync(TUser user, string tokenProvider, string token);
-
-        /// <summary>
-        /// Adds an external Microsoft.AspNetCore.Identity.UserLoginInfo to the specified user.
-        /// </summary>
-        /// <param name="user">The user to add the login to.</param>
-        /// <param name="login">The external Microsoft.AspNetCore.Identity.UserLoginInfo to add to the specified user.</param>
-        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the Microsoft.AspNetCore.Identity.IdentityResult of the operation.</returns>
-        Task<IdentityResult> AddLoginAsync(TUser user, UserLoginInfo login);
-
-        /// <summary>
-        /// Attempts to remove the provided external login information from the specified user. and returns a flag indicating whether the removal succeed or not.
-        /// </summary>
-        /// <param name="user">The user to remove the login information from.</param>
-        /// <param name="loginProvider">The login provide whose information should be removed.</param>
-        /// <param name="providerKey">The key given by the external login provider for the specified user.</param>
-        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the Microsoft.AspNetCore.Identity.IdentityResult of the operation.</returns>
-        Task<IdentityResult> RemoveLoginAsync(TUser user, string loginProvider, string providerKey);
-
-        Task<IdentityResult> ResetAccessFailedCountAsync(TUser user);
-
-        Task<string> GenerateTwoFactorTokenAsync(TUser user, string tokenProvider);
-
-        /// <summary>
-        /// Gets the email address for the specified user.
-        /// </summary>
-        /// <param name="user">The user whose email should be returned.</param>
-        /// <returns> The task object containing the results of the asynchronous operation, the email address for the specified user.</returns>
-        Task<string> GetEmailAsync(TUser user);
-
-        /// <summary>
-        /// Gets the telephone number, if any, for the specified user.
-        /// </summary>
-        /// <param name="user">The user whose telephone number should be retrieved.</param>
-        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the user's telephone number, if any.</returns>
-        /// <remarks>
-        /// A user can only support a phone number if the BackOfficeUserStore is replaced with another that implements IUserPhoneNumberStore
-        /// </remarks>
-        Task<string> GetPhoneNumberAsync(TUser user);
-
-        // TODO: These are raised from outside the signinmanager and usermanager in the auth and user controllers,
-        // let's see if there's a way to avoid that and only have these called within signinmanager and usermanager
-        // which means we can remove these from the interface (things like invite seems like they cannot be moved)
-        void RaiseForgotPasswordRequestedEvent(IPrincipal currentUser, int userId);
-        void RaiseForgotPasswordChangedSuccessEvent(IPrincipal currentUser, int userId);
-        SignOutAuditEventArgs RaiseLogoutSuccessEvent(IPrincipal currentUser, int userId);
-        UserInviteEventArgs RaiseSendingUserInvite(IPrincipal currentUser, UserInvite invite, IUser createdUser);
-        bool HasSendingUserInviteEventHandler { get; }
-
     }
 }
diff --git a/src/Umbraco.Infrastructure/BackOffice/IUmbracoUserManager.cs b/src/Umbraco.Infrastructure/BackOffice/IUmbracoUserManager.cs
new file mode 100644
index 0000000000..8f8e0ffc50
--- /dev/null
+++ b/src/Umbraco.Infrastructure/BackOffice/IUmbracoUserManager.cs
@@ -0,0 +1,326 @@
+using System;
+using System.Collections.Generic;
+using System.Security.Claims;
+using System.Security.Principal;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Identity;
+using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
+using Umbraco.Web.Models.ContentEditing;
+
+namespace Umbraco.Core.BackOffice
+{
+
+    /// <summary>
+    /// A user manager for Umbraco (either back office users or front-end members)
+    /// </summary>
+    /// <typeparam name="TUser">The type of user</typeparam>
+    public interface IUmbracoUserManager<TUser> : IDisposable
+        where TUser : BackOfficeIdentityUser
+    {
+        Task<string> GetUserIdAsync(TUser user);
+
+        Task<TUser> GetUserAsync(ClaimsPrincipal principal);
+
+        string GetUserId(ClaimsPrincipal principal);
+
+        Task<IList<UserLoginInfo>> GetLoginsAsync(TUser user);
+
+        Task<IdentityResult> DeleteAsync(TUser user);
+
+        Task<TUser> FindByLoginAsync(string loginProvider, string providerKey);
+
+        /// <summary>
+        /// Finds and returns a user, if any, who has the specified <paramref name="userId"/>.
+        /// </summary>
+        /// <param name="userId">The user ID to search for.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the user matching the specified <paramref name="userId"/> if it exists.
+        /// </returns>
+        Task<TUser> FindByIdAsync(string userId);
+
+        /// <summary>
+        /// Generates a password reset token for the specified <paramref name="user"/>, using
+        /// the configured password reset token provider.
+        /// </summary>
+        /// <param name="user">The user to generate a password reset token for.</param>
+        /// <returns>The <see cref="Task"/> that represents the asynchronous operation,
+        /// containing a password reset token for the specified <paramref name="user"/>.</returns>
+        Task<string> GeneratePasswordResetTokenAsync(TUser user);
+
+        /// <summary>
+        /// This is a special method that will reset the password but will raise the Password Changed event instead of the reset event
+        /// </summary>
+        /// <param name="userId"></param>
+        /// <param name="token"></param>
+        /// <param name="newPassword"></param>
+        /// <returns></returns>
+        /// <remarks>
+        /// We use this because in the back office the only way an admin can change another user's password without first knowing their password
+        /// is to generate a token and reset it, however, when we do this we want to track a password change, not a password reset
+        /// </remarks>
+        Task<IdentityResult> ChangePasswordWithResetAsync(int userId, string token, string newPassword);
+
+        /// <summary>
+        /// Validates that an email confirmation token matches the specified <paramref name="user"/>.
+        /// </summary>
+        /// <param name="user">The user to validate the token against.</param>
+        /// <param name="token">The email confirmation token to validate.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> ConfirmEmailAsync(TUser user, string token);
+
+        /// <summary>
+        /// Gets the user, if any, associated with the normalized value of the specified email address.
+        /// Note: Its recommended that identityOptions.User.RequireUniqueEmail be set to true when using this method, otherwise
+        /// the store may throw if there are users with duplicate emails.
+        /// </summary>
+        /// <param name="email">The email address to return the user for.</param>
+        /// <returns>
+        /// The task object containing the results of the asynchronous lookup operation, the user, if any, associated with a normalized value of the specified email address.
+        /// </returns>
+        Task<TUser> FindByEmailAsync(string email);
+
+        /// <summary>
+        /// Resets the <paramref name="user"/>'s password to the specified <paramref name="newPassword"/> after
+        /// validating the given password reset <paramref name="token"/>.
+        /// </summary>
+        /// <param name="user">The user whose password should be reset.</param>
+        /// <param name="token">The password reset token to verify.</param>
+        /// <param name="newPassword">The new password to set if reset token verification succeeds.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> ResetPasswordAsync(TUser user, string token, string newPassword);
+
+        /// <summary>
+        /// Override to check the user approval value as well as the user lock out date, by default this only checks the user's locked out date
+        /// </summary>
+        /// <param name="user"></param>
+        /// <returns></returns>
+        /// <remarks>
+        /// In the ASP.NET Identity world, there is only one value for being locked out, in Umbraco we have 2 so when checking this for Umbraco we need to check both values
+        /// </remarks>
+        Task<bool> IsLockedOutAsync(TUser user);
+
+        /// <summary>
+        /// Locks out a user until the specified end date has passed. Setting a end date in the past immediately unlocks a user.
+        /// </summary>
+        /// <param name="user">The user whose lockout date should be set.</param>
+        /// <param name="lockoutEnd">The <see cref="DateTimeOffset"/> after which the <paramref name="user"/>'s lockout should end.</param>
+        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/> of the operation.</returns>
+        Task<IdentityResult> SetLockoutEndDateAsync(TUser user, DateTimeOffset? lockoutEnd);
+
+        /// <summary>
+        /// Gets a flag indicating whether the email address for the specified <paramref name="user"/> has been verified, true if the email address is verified otherwise
+        /// false.
+        /// </summary>
+        /// <param name="user">The user whose email confirmation status should be returned.</param>
+        /// <returns>
+        /// The task object containing the results of the asynchronous operation, a flag indicating whether the email address for the specified <paramref name="user"/>
+        /// has been confirmed or not.
+        /// </returns>
+        Task<bool> IsEmailConfirmedAsync(TUser user);
+
+        /// <summary>
+        /// Updates the specified <paramref name="user"/> in the backing store.
+        /// </summary>
+        /// <param name="user">The user to update.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> UpdateAsync(TUser user);
+
+        /// <summary>
+        /// Returns a flag indicating whether the specified <paramref name="token"/> is valid for
+        /// the given <paramref name="user"/> and <paramref name="purpose"/>.
+        /// </summary>
+        /// <param name="user">The user to validate the token against.</param>
+        /// <param name="tokenProvider">The token provider used to generate the token.</param>
+        /// <param name="purpose">The purpose the token should be generated for.</param>
+        /// <param name="token">The token to validate</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, returning true if the <paramref name="token"/>
+        /// is valid, otherwise false.
+        /// </returns>
+        Task<bool> VerifyUserTokenAsync(TUser user, string tokenProvider, string purpose,
+            string token);
+
+        /// <summary>
+        /// Adds the <paramref name="password"/> to the specified <paramref name="user"/> only if the user
+        /// does not already have a password.
+        /// </summary>
+        /// <param name="user">The user whose password should be set.</param>
+        /// <param name="password">The password to set.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> AddPasswordAsync(TUser user, string password);
+
+
+        /// <summary>
+        /// Returns a flag indicating whether the given <paramref name="password"/> is valid for the
+        /// specified <paramref name="user"/>.
+        /// </summary>
+        /// <param name="user">The user whose password should be validated.</param>
+        /// <param name="password">The password to validate</param>
+        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing true if
+        /// the specified <paramref name="password" /> matches the one store for the <paramref name="user"/>,
+        /// otherwise false.</returns>
+        Task<bool> CheckPasswordAsync(TUser user, string password);
+
+        /// <summary>
+        /// Changes a user's password after confirming the specified <paramref name="currentPassword"/> is correct,
+        /// as an asynchronous operation.
+        /// </summary>
+        /// <param name="user">The user whose password should be set.</param>
+        /// <param name="currentPassword">The current password to validate before changing.</param>
+        /// <param name="newPassword">The new password to set for the specified <paramref name="user"/>.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> ChangePasswordAsync(TUser user, string currentPassword,
+            string newPassword);
+
+        /// <summary>
+        /// Used to validate a user's session
+        /// </summary>
+        /// <param name="userId"></param>
+        /// <param name="sessionId"></param>
+        /// <returns></returns>
+        Task<bool> ValidateSessionIdAsync(string userId, string sessionId);
+
+        /// <summary>
+        /// Creates the specified <paramref name="user"/> in the backing store with no password,
+        /// as an asynchronous operation.
+        /// </summary>
+        /// <param name="user">The user to create.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/>
+        /// of the operation.
+        /// </returns>
+        Task<IdentityResult> CreateAsync(TUser user);
+
+        /// <summary>
+        /// Helper method to generate a password for a user based on the current password validator
+        /// </summary>
+        /// <returns></returns>
+        string GeneratePassword();
+
+
+        /// <summary>
+        /// Generates an email confirmation token for the specified user.
+        /// </summary>
+        /// <param name="user">The user to generate an email confirmation token for.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, an email confirmation token.
+        /// </returns>
+        Task<string> GenerateEmailConfirmationTokenAsync(TUser user);
+
+        /// <summary>
+        /// Finds and returns a user, if any, who has the specified user name.
+        /// </summary>
+        /// <param name="userName">The user name to search for.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, containing the user matching the specified <paramref name="userName"/> if it exists.
+        /// </returns>
+        Task<TUser> FindByNameAsync(string userName);
+
+        /// <summary>
+        /// Increments the access failed count for the user as an asynchronous operation.
+        /// If the failed access account is greater than or equal to the configured maximum number of attempts,
+        /// the user will be locked out for the configured lockout time span.
+        /// </summary>
+        /// <param name="user">The user whose failed access count to increment.</param>
+        /// <returns>The <see cref="Task"/> that represents the asynchronous operation, containing the <see cref="IdentityResult"/> of the operation.</returns>
+        Task<IdentityResult> AccessFailedAsync(TUser user);
+
+        /// <summary>
+        /// Returns a flag indicating whether the specified <paramref name="user"/> has two factor authentication enabled or not,
+        /// as an asynchronous operation.
+        /// </summary>
+        /// <param name="user">The user whose two factor authentication enabled status should be retrieved.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents the asynchronous operation, true if the specified <paramref name="user "/>
+        /// has two factor authentication enabled, otherwise false.
+        /// </returns>
+        Task<bool> GetTwoFactorEnabledAsync(TUser user);
+
+        /// <summary>
+        /// Gets a list of valid two factor token providers for the specified <paramref name="user"/>,
+        /// as an asynchronous operation.
+        /// </summary>
+        /// <param name="user">The user the whose two factor authentication providers will be returned.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents result of the asynchronous operation, a list of two
+        /// factor authentication providers for the specified user.
+        /// </returns>
+        Task<IList<string>> GetValidTwoFactorProvidersAsync(TUser user);
+
+        /// <summary>
+        /// Verifies the specified two factor authentication <paramref name="token" /> against the <paramref name="user"/>.
+        /// </summary>
+        /// <param name="user">The user the token is supposed to be for.</param>
+        /// <param name="tokenProvider">The provider which will verify the token.</param>
+        /// <param name="token">The token to verify.</param>
+        /// <returns>
+        /// The <see cref="Task"/> that represents result of the asynchronous operation, true if the token is valid,
+        /// otherwise false.
+        /// </returns>
+        Task<bool> VerifyTwoFactorTokenAsync(TUser user, string tokenProvider, string token);
+
+        /// <summary>
+        /// Adds an external Microsoft.AspNetCore.Identity.UserLoginInfo to the specified user.
+        /// </summary>
+        /// <param name="user">The user to add the login to.</param>
+        /// <param name="login">The external Microsoft.AspNetCore.Identity.UserLoginInfo to add to the specified user.</param>
+        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the Microsoft.AspNetCore.Identity.IdentityResult of the operation.</returns>
+        Task<IdentityResult> AddLoginAsync(TUser user, UserLoginInfo login);
+
+        /// <summary>
+        /// Attempts to remove the provided external login information from the specified user. and returns a flag indicating whether the removal succeed or not.
+        /// </summary>
+        /// <param name="user">The user to remove the login information from.</param>
+        /// <param name="loginProvider">The login provide whose information should be removed.</param>
+        /// <param name="providerKey">The key given by the external login provider for the specified user.</param>
+        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the Microsoft.AspNetCore.Identity.IdentityResult of the operation.</returns>
+        Task<IdentityResult> RemoveLoginAsync(TUser user, string loginProvider, string providerKey);
+
+        Task<IdentityResult> ResetAccessFailedCountAsync(TUser user);
+
+        Task<string> GenerateTwoFactorTokenAsync(TUser user, string tokenProvider);
+
+        /// <summary>
+        /// Gets the email address for the specified user.
+        /// </summary>
+        /// <param name="user">The user whose email should be returned.</param>
+        /// <returns> The task object containing the results of the asynchronous operation, the email address for the specified user.</returns>
+        Task<string> GetEmailAsync(TUser user);
+
+        /// <summary>
+        /// Gets the telephone number, if any, for the specified user.
+        /// </summary>
+        /// <param name="user">The user whose telephone number should be retrieved.</param>
+        /// <returns>The System.Threading.Tasks.Task that represents the asynchronous operation, containing the user's telephone number, if any.</returns>
+        /// <remarks>
+        /// A user can only support a phone number if the BackOfficeUserStore is replaced with another that implements IUserPhoneNumberStore
+        /// </remarks>
+        Task<string> GetPhoneNumberAsync(TUser user);
+
+        // TODO: These are raised from outside the signinmanager and usermanager in the auth and user controllers,
+        // let's see if there's a way to avoid that and only have these called within signinmanager and usermanager
+        // which means we can remove these from the interface (things like invite seems like they cannot be moved)
+        void RaiseForgotPasswordRequestedEvent(IPrincipal currentUser, int userId);
+        void RaiseForgotPasswordChangedSuccessEvent(IPrincipal currentUser, int userId);
+        SignOutAuditEventArgs RaiseLogoutSuccessEvent(IPrincipal currentUser, int userId);
+        UserInviteEventArgs RaiseSendingUserInvite(IPrincipal currentUser, UserInvite invite, IUser createdUser);
+        bool HasSendingUserInviteEventHandler { get; }
+
+    }
+}
diff --git a/src/Umbraco.Infrastructure/Composing/CompositionExtensions/CoreMappingProfiles.cs b/src/Umbraco.Infrastructure/Composing/CompositionExtensions/CoreMappingProfiles.cs
index 04f715c7c0..ed45f24a96 100644
--- a/src/Umbraco.Infrastructure/Composing/CompositionExtensions/CoreMappingProfiles.cs
+++ b/src/Umbraco.Infrastructure/Composing/CompositionExtensions/CoreMappingProfiles.cs
@@ -1,7 +1,7 @@
 using Microsoft.Extensions.DependencyInjection;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Builder;
 using Umbraco.Core.Mapping;
+using Umbraco.Core.Security;
 using Umbraco.Web.Models.Mapping;
 
 namespace Umbraco.Core.Composing.CompositionExtensions
diff --git a/src/Umbraco.Infrastructure/Security/SignOutAuditEventArgs.cs b/src/Umbraco.Infrastructure/Security/SignOutAuditEventArgs.cs
index 961c2e6137..34bd9c9a42 100644
--- a/src/Umbraco.Infrastructure/Security/SignOutAuditEventArgs.cs
+++ b/src/Umbraco.Infrastructure/Security/SignOutAuditEventArgs.cs
@@ -1,4 +1,6 @@
-namespace Umbraco.Core.BackOffice
+using Umbraco.Core.Security;
+
+namespace Umbraco.Core.BackOffice
 {
 
     /// <summary>
diff --git a/src/Umbraco.Infrastructure/Security/UserInviteEventArgs.cs b/src/Umbraco.Infrastructure/Security/UserInviteEventArgs.cs
index 4e980b7bb1..2aefb47c14 100644
--- a/src/Umbraco.Infrastructure/Security/UserInviteEventArgs.cs
+++ b/src/Umbraco.Infrastructure/Security/UserInviteEventArgs.cs
@@ -1,4 +1,5 @@
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Web.Models.ContentEditing;
 
 namespace Umbraco.Core.BackOffice
diff --git a/src/Umbraco.Tests.Integration/TestServerTest/TestAuthHandler.cs b/src/Umbraco.Tests.Integration/TestServerTest/TestAuthHandler.cs
index b9acd9529c..ab5821c81c 100644
--- a/src/Umbraco.Tests.Integration/TestServerTest/TestAuthHandler.cs
+++ b/src/Umbraco.Tests.Integration/TestServerTest/TestAuthHandler.cs
@@ -4,9 +4,9 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Mapping;
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Core.Services;
 using Umbraco.Web.Common.Security;
 
diff --git a/src/Umbraco.Tests.Integration/Umbraco.Web.BackOffice/UmbracoBackOfficeServiceCollectionExtensionsTests.cs b/src/Umbraco.Tests.Integration/Umbraco.Web.BackOffice/UmbracoBackOfficeServiceCollectionExtensionsTests.cs
index 26c3f7875c..b6a86344a2 100644
--- a/src/Umbraco.Tests.Integration/Umbraco.Web.BackOffice/UmbracoBackOfficeServiceCollectionExtensionsTests.cs
+++ b/src/Umbraco.Tests.Integration/Umbraco.Web.BackOffice/UmbracoBackOfficeServiceCollectionExtensionsTests.cs
@@ -5,6 +5,7 @@ using NUnit.Framework;
 using Umbraco.Extensions;
 using Umbraco.Core.BackOffice;
 using Umbraco.Tests.Integration.Testing;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Tests.Integration.Umbraco.Web.BackOffice
 {
diff --git a/src/Umbraco.Tests.UnitTests/AutoFixture/AutoMoqDataAttribute.cs b/src/Umbraco.Tests.UnitTests/AutoFixture/AutoMoqDataAttribute.cs
index 78d5d5554c..365dca780c 100644
--- a/src/Umbraco.Tests.UnitTests/AutoFixture/AutoMoqDataAttribute.cs
+++ b/src/Umbraco.Tests.UnitTests/AutoFixture/AutoMoqDataAttribute.cs
@@ -10,10 +10,10 @@ using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Options;
 using Moq;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Hosting;
+using Umbraco.Core.Security;
 using Umbraco.Tests.Common.Builders;
 using Umbraco.Web.BackOffice.Controllers;
 using Umbraco.Web.BackOffice.Routing;
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/BackOfficeClaimsPrincipalFactoryTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/BackOfficeClaimsPrincipalFactoryTests.cs
index 5291c1b12e..9d8edbc75e 100644
--- a/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/BackOfficeClaimsPrincipalFactoryTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/BackOfficeClaimsPrincipalFactoryTests.cs
@@ -10,6 +10,7 @@ using Umbraco.Core;
 using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Extensions;
 
 namespace Umbraco.Tests.UnitTests.Umbraco.Core.BackOffice
@@ -98,7 +99,7 @@ namespace Umbraco.Tests.UnitTests.Umbraco.Core.BackOffice
             const string expectedClaimType = ClaimTypes.Role;
             const string expectedClaimValue = "b87309fb-4caf-48dc-b45a-2b752d051508";
 
-            _testUser.Roles.Add(new global::Umbraco.Core.Models.Identity.IdentityUserRole<string>{RoleId = expectedClaimValue});
+            _testUser.Roles.Add(new global::Umbraco.Core.Models.Identity.IdentityUserRole{RoleId = expectedClaimValue});
             _mockUserManager.Setup(x => x.SupportsUserRole).Returns(true);
             _mockUserManager.Setup(x => x.GetRolesAsync(_testUser)).ReturnsAsync(new[] {expectedClaimValue});
 
@@ -115,7 +116,7 @@ namespace Umbraco.Tests.UnitTests.Umbraco.Core.BackOffice
             const string expectedClaimType = "custom";
             const string expectedClaimValue = "val";
 
-            _testUser.Claims.Add(new global::Umbraco.Core.Models.Identity.IdentityUserClaim<int> {ClaimType = expectedClaimType, ClaimValue = expectedClaimValue});
+            _testUser.Claims.Add(new global::Umbraco.Core.Models.Identity.IdentityUserClaim {ClaimType = expectedClaimType, ClaimValue = expectedClaimValue});
             _mockUserManager.Setup(x => x.SupportsUserClaim).Returns(true);
             _mockUserManager.Setup(x => x.GetClaimsAsync(_testUser)).ReturnsAsync(
                 new List<Claim> {new Claim(expectedClaimType, expectedClaimValue)});
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentityTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentityTests.cs
index 9e9d29a123..8dcaafafcb 100644
--- a/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentityTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Core/BackOffice/UmbracoBackOfficeIdentityTests.cs
@@ -3,7 +3,7 @@ using System.Linq;
 using System.Security.Claims;
 using NUnit.Framework;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Tests.UnitTests.Umbraco.Core.BackOffice
 {
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Core/Extensions/ClaimsPrincipalExtensionsTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Core/Extensions/ClaimsPrincipalExtensionsTests.cs
index a078456f8f..30706b1b67 100644
--- a/src/Umbraco.Tests.UnitTests/Umbraco.Core/Extensions/ClaimsPrincipalExtensionsTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Core/Extensions/ClaimsPrincipalExtensionsTests.cs
@@ -5,7 +5,7 @@ using System.Linq;
 using System.Security.Claims;
 using Umbraco.Extensions;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Tests.UnitTests.Umbraco.Core.Extensions
 {
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/UsersControllerUnitTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/UsersControllerUnitTests.cs
index b04a5ff158..6ecda57cc6 100644
--- a/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/UsersControllerUnitTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/UsersControllerUnitTests.cs
@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Identity;
 using Moq;
 using NUnit.Framework;
 using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 using Umbraco.Tests.UnitTests.AutoFixture;
 using Umbraco.Web.BackOffice.Controllers;
 using Umbraco.Web.Common.Exceptions;
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Security/BackOfficeAntiforgeryTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Security/BackOfficeAntiforgeryTests.cs
index d93bc01b4e..ccebe17b09 100644
--- a/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Security/BackOfficeAntiforgeryTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Security/BackOfficeAntiforgeryTests.cs
@@ -1,19 +1,15 @@
-using Microsoft.AspNetCore.Antiforgery;
+using System;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Antiforgery;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Features;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using Microsoft.Net.Http.Headers;
-using Moq;
 using NUnit.Framework;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Security.Claims;
-using System.Text;
-using System.Threading.Tasks;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 using Umbraco.Web.BackOffice.Security;
 
 namespace Umbraco.Tests.UnitTests.Umbraco.Web.BackOffice.Security
@@ -25,8 +21,16 @@ namespace Umbraco.Tests.UnitTests.Umbraco.Web.BackOffice.Security
         {
             var httpContext = new DefaultHttpContext()
             {
-                User = new ClaimsPrincipal(new UmbracoBackOfficeIdentity(-1, "test", "test", Enumerable.Empty<int>(), Enumerable.Empty<int>(), "en-US",
-                    Guid.NewGuid().ToString(), Enumerable.Empty<string>(), Enumerable.Empty<string>()))
+                User = new ClaimsPrincipal(new UmbracoBackOfficeIdentity(
+                    -1,
+                    "test",
+                    "test",
+                    Enumerable.Empty<int>(),
+                    Enumerable.Empty<int>(),
+                    "en-US",
+                    Guid.NewGuid().ToString(),
+                    Enumerable.Empty<string>(),
+                    Enumerable.Empty<string>()))
             };
             httpContext.Request.IsHttps = true;
             return httpContext;
diff --git a/src/Umbraco.Tests/Security/OwinDataProtectorTokenProviderTests.cs b/src/Umbraco.Tests/Security/OwinDataProtectorTokenProviderTests.cs
index 66965ca632..c44844fd66 100644
--- a/src/Umbraco.Tests/Security/OwinDataProtectorTokenProviderTests.cs
+++ b/src/Umbraco.Tests/Security/OwinDataProtectorTokenProviderTests.cs
@@ -6,10 +6,10 @@ using Microsoft.AspNetCore.Identity;
 using Microsoft.Owin.Security.DataProtection;
 using Moq;
 using NUnit.Framework;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Tests.Common.Builders;
 using Umbraco.Web.Security;
 
diff --git a/src/Umbraco.Tests/TestHelpers/ControllerTesting/AuthenticateEverythingMiddleware.cs b/src/Umbraco.Tests/TestHelpers/ControllerTesting/AuthenticateEverythingMiddleware.cs
index 48ffdbcdec..3673bdf333 100644
--- a/src/Umbraco.Tests/TestHelpers/ControllerTesting/AuthenticateEverythingMiddleware.cs
+++ b/src/Umbraco.Tests/TestHelpers/ControllerTesting/AuthenticateEverythingMiddleware.cs
@@ -1,10 +1,10 @@
-using System;
+using System;
 using System.Threading.Tasks;
 using Microsoft.Owin;
 using Microsoft.Owin.Security;
 using Microsoft.Owin.Security.Infrastructure;
 using Owin;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Tests.TestHelpers.ControllerTesting
 {
diff --git a/src/Umbraco.Tests/TestHelpers/ControllerTesting/TestControllerActivatorBase.cs b/src/Umbraco.Tests/TestHelpers/ControllerTesting/TestControllerActivatorBase.cs
index 23f7e09f5d..f993ee5b6a 100644
--- a/src/Umbraco.Tests/TestHelpers/ControllerTesting/TestControllerActivatorBase.cs
+++ b/src/Umbraco.Tests/TestHelpers/ControllerTesting/TestControllerActivatorBase.cs
@@ -6,7 +6,6 @@ using System.Web.Http;
 using System.Web.Http.Controllers;
 using System.Web.Http.Dispatcher;
 using Moq;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Models.PublishedContent;
diff --git a/src/Umbraco.Web.BackOffice/Extensions/IdentityBuilderExtensions.cs b/src/Umbraco.Web.BackOffice/Extensions/IdentityBuilderExtensions.cs
index ddf46a24a7..e6385e6bf9 100644
--- a/src/Umbraco.Web.BackOffice/Extensions/IdentityBuilderExtensions.cs
+++ b/src/Umbraco.Web.BackOffice/Extensions/IdentityBuilderExtensions.cs
@@ -1,6 +1,6 @@
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.DependencyInjection;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Extensions
 {
diff --git a/src/Umbraco.Web.BackOffice/Filters/CheckIfUserTicketDataIsStaleAttribute.cs b/src/Umbraco.Web.BackOffice/Filters/CheckIfUserTicketDataIsStaleAttribute.cs
index 9cfaae6980..a770a01e4d 100644
--- a/src/Umbraco.Web.BackOffice/Filters/CheckIfUserTicketDataIsStaleAttribute.cs
+++ b/src/Umbraco.Web.BackOffice/Filters/CheckIfUserTicketDataIsStaleAttribute.cs
@@ -7,12 +7,12 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Options;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Cache;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Mapping;
 using Umbraco.Core.Models;
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Core.Services;
 using Umbraco.Extensions;
 using Umbraco.Web.BackOffice.Security;
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficePasswordHasher.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficePasswordHasher.cs
index 6c61e7bb35..65f1a7f5bc 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficePasswordHasher.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficePasswordHasher.cs
@@ -1,5 +1,4 @@
 using Microsoft.AspNetCore.Identity;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Security;
 using Umbraco.Core;
 using Umbraco.Core.Models.Membership;
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficeSecureDataFormat.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficeSecureDataFormat.cs
index 91b982b5f6..377801a0b7 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficeSecureDataFormat.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficeSecureDataFormat.cs
@@ -1,7 +1,7 @@
 using Microsoft.AspNetCore.Authentication;
 using System;
 using System.Security.Claims;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.BackOffice.Security
 {
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficeSecurityStampValidator.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficeSecurityStampValidator.cs
index f12b6279bb..abd0af1353 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficeSecurityStampValidator.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficeSecurityStampValidator.cs
@@ -5,7 +5,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 using Umbraco.Web.Common.Security;
 
 namespace Umbraco.Web.BackOffice.Security
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficeSignInManager.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficeSignInManager.cs
index e17067daa0..6d1c348d7f 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficeSignInManager.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficeSignInManager.cs
@@ -9,7 +9,6 @@ using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Security;
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManager.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManager.cs
index 2906d9d87a..cc9b9410a6 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManager.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManager.cs
@@ -65,6 +65,7 @@ namespace Umbraco.Web.Common.Security
             IpResolver = ipResolver ?? throw new ArgumentNullException(nameof(ipResolver));
             _httpContextAccessor = httpContextAccessor;
             PasswordConfiguration = passwordConfiguration.Value ?? throw new ArgumentNullException(nameof(passwordConfiguration));
+
         }
 
         // We don't support an IUserClaimStore and don't need to (at least currently)
diff --git a/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManagerAuditer.cs b/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManagerAuditer.cs
index 019eed7e39..5f0757ea9c 100644
--- a/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManagerAuditer.cs
+++ b/src/Umbraco.Web.BackOffice/Security/BackOfficeUserManagerAuditer.cs
@@ -6,6 +6,7 @@ using Umbraco.Core.BackOffice;
 using Umbraco.Core.Compose;
 using Umbraco.Core.Configuration.Models;
 using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Security;
 using Umbraco.Core.Services;
 
 namespace Umbraco.Web.Common.Security
diff --git a/src/Umbraco.Web.BackOffice/Security/ConfigureBackOfficeCookieOptions.cs b/src/Umbraco.Web.BackOffice/Security/ConfigureBackOfficeCookieOptions.cs
index 590edf397a..9f90395ff3 100644
--- a/src/Umbraco.Web.BackOffice/Security/ConfigureBackOfficeCookieOptions.cs
+++ b/src/Umbraco.Web.BackOffice/Security/ConfigureBackOfficeCookieOptions.cs
@@ -9,7 +9,6 @@ using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Cache;
 using Umbraco.Core.Configuration;
 using Umbraco.Core.Configuration.Models;
diff --git a/src/Umbraco.Web.BackOffice/Security/ExternalSignInAutoLinkOptions.cs b/src/Umbraco.Web.BackOffice/Security/ExternalSignInAutoLinkOptions.cs
index 8d9f57945b..8636d9e62d 100644
--- a/src/Umbraco.Web.BackOffice/Security/ExternalSignInAutoLinkOptions.cs
+++ b/src/Umbraco.Web.BackOffice/Security/ExternalSignInAutoLinkOptions.cs
@@ -1,8 +1,8 @@
 using Microsoft.AspNetCore.Identity;
 using System;
 using System.Runtime.Serialization;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration.Models;
+using Umbraco.Core.Security;
 using SecurityConstants = Umbraco.Core.Constants.Security;
 
 namespace Umbraco.Web.BackOffice.Security
diff --git a/src/Umbraco.Web.BackOffice/Security/IBackOfficeSignInManager.cs b/src/Umbraco.Web.BackOffice/Security/IBackOfficeSignInManager.cs
index ce87484b2c..669ca21239 100644
--- a/src/Umbraco.Web.BackOffice/Security/IBackOfficeSignInManager.cs
+++ b/src/Umbraco.Web.BackOffice/Security/IBackOfficeSignInManager.cs
@@ -3,7 +3,7 @@ using Microsoft.AspNetCore.Identity;
 using System.Collections.Generic;
 using System.Security.Claims;
 using System.Threading.Tasks;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Common.Security
 {
diff --git a/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs b/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs
index 15d3d04c0b..f484ddac18 100644
--- a/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs
+++ b/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs
@@ -5,7 +5,7 @@ using System.Security.Claims;
 using System.Security.Principal;
 using System.Text;
 using Microsoft.AspNetCore.Http.Features;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Extensions
 {
diff --git a/src/Umbraco.Web/Security/ActiveDirectoryBackOfficeUserPasswordChecker.cs b/src/Umbraco.Web/Security/ActiveDirectoryBackOfficeUserPasswordChecker.cs
index 82c9cb8496..8071af2f5d 100644
--- a/src/Umbraco.Web/Security/ActiveDirectoryBackOfficeUserPasswordChecker.cs
+++ b/src/Umbraco.Web/Security/ActiveDirectoryBackOfficeUserPasswordChecker.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.DirectoryServices.AccountManagement;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Options;
@@ -9,6 +9,7 @@ using Umbraco.Core.Configuration.Models;
 namespace Umbraco.Web.Security
 {
     // TODO: This relies on an assembly that is not .NET Standard (at least not at the time of implementation) :(
+    // TODO: This could be ported now, see https://stackoverflow.com/questions/37330705/working-with-directoryservices-in-asp-net-core
     public class ActiveDirectoryBackOfficeUserPasswordChecker : IBackOfficeUserPasswordChecker
     {
         private readonly IOptions<ActiveDirectorySettings> _activeDirectorySettings;
diff --git a/src/Umbraco.Web/Security/AuthenticationExtensions.cs b/src/Umbraco.Web/Security/AuthenticationExtensions.cs
index de5abf8a6b..aa0cd6aca2 100644
--- a/src/Umbraco.Web/Security/AuthenticationExtensions.cs
+++ b/src/Umbraco.Web/Security/AuthenticationExtensions.cs
@@ -12,8 +12,8 @@ using Microsoft.Owin;
 using Microsoft.Owin.Security;
 using Newtonsoft.Json;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration.Models;
+using Umbraco.Core.Security;
 using Umbraco.Extensions;
 using Umbraco.Web.Composing;
 using Constants = Umbraco.Core.Constants;
diff --git a/src/Umbraco.Web/Security/BackOfficeSignInManager.cs b/src/Umbraco.Web/Security/BackOfficeSignInManager.cs
index e5ba931b0b..010c2d4d33 100644
--- a/src/Umbraco.Web/Security/BackOfficeSignInManager.cs
+++ b/src/Umbraco.Web/Security/BackOfficeSignInManager.cs
@@ -10,6 +10,7 @@ using Microsoft.Owin.Security;
 using Umbraco.Core;
 using Umbraco.Core.BackOffice;
 using Umbraco.Core.Configuration.Models;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Security
 {
diff --git a/src/Umbraco.Web/Security/FixWindowsAuthMiddlware.cs b/src/Umbraco.Web/Security/FixWindowsAuthMiddlware.cs
index 9e26964091..3338344e73 100644
--- a/src/Umbraco.Web/Security/FixWindowsAuthMiddlware.cs
+++ b/src/Umbraco.Web/Security/FixWindowsAuthMiddlware.cs
@@ -4,7 +4,7 @@ using System.Security.Principal;
 using System.Threading.Tasks;
 using Microsoft.Owin;
 using Umbraco.Core;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Security
 {
diff --git a/src/Umbraco.Web/Security/IBackOfficeUserPasswordChecker.cs b/src/Umbraco.Web/Security/IBackOfficeUserPasswordChecker.cs
index 2fae308eb0..7bd67e608a 100644
--- a/src/Umbraco.Web/Security/IBackOfficeUserPasswordChecker.cs
+++ b/src/Umbraco.Web/Security/IBackOfficeUserPasswordChecker.cs
@@ -1,5 +1,5 @@
 using System.Threading.Tasks;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Security
 {
diff --git a/src/Umbraco.Web/Security/OwinDataProtectorTokenProvider.cs b/src/Umbraco.Web/Security/OwinDataProtectorTokenProvider.cs
index 72e12b8621..429014dea8 100644
--- a/src/Umbraco.Web/Security/OwinDataProtectorTokenProvider.cs
+++ b/src/Umbraco.Web/Security/OwinDataProtectorTokenProvider.cs
@@ -5,7 +5,7 @@ using System.Text;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Owin.Security.DataProtection;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Security
 {
diff --git a/src/Umbraco.Web/Security/UmbracoSecureDataFormat.cs b/src/Umbraco.Web/Security/UmbracoSecureDataFormat.cs
index 73c1c3fd55..d1b0c54279 100644
--- a/src/Umbraco.Web/Security/UmbracoSecureDataFormat.cs
+++ b/src/Umbraco.Web/Security/UmbracoSecureDataFormat.cs
@@ -1,6 +1,6 @@
 using System;
 using Microsoft.Owin.Security;
-using Umbraco.Core.BackOffice;
+using Umbraco.Core.Security;
 
 namespace Umbraco.Web.Security
 {