# Users and Groups

The **Users and Groups** module allows you to manage the data of all the users and groups that belong to your tenant.\
To authorize the users in the system, add them to the tenant and create relevant user groups with sets of access rights. Then, link the users with the user groups to make the access rights work.

{% hint style="danger" %}
The Management Dashboard views are dependent on the user's permissions. If you don't see a particular node, or section described in the Emporix documentation, or are not able to modify an entity, it might mean you don't have sufficient permissions set. Contact the administrator if you need additional access.
{% endhint %}

## Definitions

**User** - an employee using the Emporix Management Dashboard.

**User Group** - a group of users that share some common characteristics, like performing similar job. User group defines access controls for the users. It can define site permissions or custom restrictions to limit visibility for members to only entities assigned to particular sites/restriction values. See more in [Restrictions](#restrictions).

**Role** - a combination of predefined permissions that allow users to perform some actions on resources within the system. You can apply a role to a user group.

**Permission** - a mechanism for limiting what actions a user belonging to a role can perform on specific resources.

**Access controls** - a combination of roles and resources. For example, a user with a `manage` access control on product resources can view, create, delete, and edit product entities.

**Resource** or **Entity** - the object type within the Emporix Management Dashboard.

**Action** - the ability to perform an action on entities of specific type.

**Restriction** - the condition applied on entities and employee groups to manage access or roles separation. Most commonly, restrictions are identical to sites, but can also apply to custom keys.

## Users

You can filter or sort the users list by first name, last name, email address, department or status.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-c1a8062af9a1766c9006bd5e9d3482ba7eed4d8d%2Fadmin.png?alt=media" alt="Users view"><figcaption><p>Users view</p></figcaption></figure>

There are two status types:

* The **Green** dot shows the user is active
* The **Grey** dot shows that the user was added and provisioned, but has not registered their account yet

### Create a user

{% stepper %}
{% step %}

#### Go to the users view

In the **Administration** module, go to **Users and Groups**.
{% endstep %}

{% step %}

#### Choose to create a user

In the **Users** tab, choose **Create New User**.
{% endstep %}

{% step %}

#### Provide the user details

Provide all the requested information. All fields are mandatory.
{% endstep %}

{% step %}

#### Save your configuration

Saving your changes adds the new user to the users list straight away.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The user receives an email invitation to join the tenant. Note the email has to be a company email address.
{% endhint %}

If at any point you decide to stop adding the new user, you can use the **Discard** option. It clears all the fields and removes the data you’ve entered for the user.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-31c05c8042834fb5b818bdd2559cfb4e2babef6a%2Fadd_user.png?alt=media" alt="Add user"><figcaption><p>Add user</p></figcaption></figure>

## Groups

You can filter and sort groups by the group name.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-757774ac30ac1b2f574557a5f3d95e31a0bf43bf%2Fgroups.png?alt=media" alt="Groups view"><figcaption><p>Groups view</p></figcaption></figure>

{% hint style="info" %}
Set the relevant users permissions at the group level. Users can belong to several groups with different access rights. By assigning users to relevant groups, you control what they are able to see and/or edit in the Management Dashboard. Bear in mind that if you assign a user to two groups that have different permissions set for a specific resource, the manage overwrites read permission and the user is able to manage the resource, not only view it.
{% endhint %}

### Create a user group

{% stepper %}
{% step %}

#### Go to Users and Groups

In the **Administration** module, go to **Users and Groups** dashboard.
{% endstep %}

{% step %}

#### Choose to create a new group

Go to the **Groups** tab and click the **Create New Group**.
{% endstep %}

{% step %}

#### Provide the group's details

In **General** section, provide the group's ID, name and description.

{% hint style="warning" %}
Only the **Group Name** is mandatory for a user group creation. You can decide to edit other details later.\
You can also set up a custom user group ID in the **Id** field. Otherwise, a unique ID is automatically generated when the group is created.
{% endhint %}
{% endstep %}

{% step %}

#### Optional: Define the group site/custom restrictions

This step applies if you'd like to restrict access control to the entities that are site-aware, such as companies (legal entities), customers, carts, orders, or quotes. Choose one or multiple sites or custom restrictions from the list.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-83131a153e8a6ab03c61a694b60d3e40282a98c0%2Fgroups_site_permissions.png?alt=media" alt="Group site permissions" width="200"><figcaption><p>Group site permissions</p></figcaption></figure>

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-506c938fe585b5cfeeaeb8f49c582afa5519c339%2Fgroups_restrictions.png?alt=media" alt="Group restrictions" width="200"><figcaption><p>Group restrictions</p></figcaption></figure>

{% hint style="warning" %}
The sites and restrictions list depends on the configuration settings in the [**System Preferences**](https://developer.emporix.io/ce/management-dashboard/settings/system-preferences). If the site sync is enabled, you are able to assign site-related permissions to a group; if the sync is off and you have defined custom restrictions, the groups can be assigned with the relevant restrictions values.

The restrictions regulate access to entities associated with particular sites in your tenant, or to other custom-defined restrictions.

Learn more in the [Restrictions](#restrictions) section.
{% endhint %}
{% endstep %}

{% step %}

#### Optional: Choose the group role

Choose the **Role** for the group, you can select between:

* **Standard** role for Management Dashboard users: **Viewer**, **Manager**, or **Admin**.
* One of the **Templates** for Manager roles with specific access rights.
* **Vendors** role for a created vendor with orders or products read/manage access rights.

{% hint style="warning" %}
In the case when you have both Commerce Engine and Orchestration Engine setup in your tenant, firstly choose which product you want to define the group for. The available options for roles and permissions depend on this choice.
{% endhint %}

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-657d6617d71030cb96c4f1071afbbf6ad63e2aa2%2Fproduct_switcher.png?alt=media" alt="Product switcher" width="600"><figcaption><p>Product switcher</p></figcaption></figure>

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-0ee85545ffff16a741ccc626a53638201624d56c%2Ftemplate_roles.png?alt=media" alt="Role templates" width="600"><figcaption><p>Role templates</p></figcaption></figure>

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-c27a7e1529f61eae28a804c92ae8002e0a067c3b%2Fvendor_roles.png?alt=media" alt="Vendor roles" width="600"><figcaption><p>Vendor roles</p></figcaption></figure>

{% hint style="info" %}
For more information, see [Predefined roles](#predefined-roles).
{% endhint %}

Based on your choice of Role, you can see that the access controls in **Management Dashboard Settings** section get selected automatically.
{% endstep %}

{% step %}

#### Set access rights

Set up the group access rights in the **Management Dashboard Settings** section:

* **read** access selected - a user is able to see entities of a specific type
* **manage** access selected - a user is able to see, edit, create, and delete entities of a specific type
* none selected - a user is not able to see entities of a specific type

Use the checkboxes to define the access rights only for the particular types the group is supposed to have access to. If a group is not supposed to manage or even see a particular entity in the Management Dashboard, don't select any permission.

{% hint style="success" %}
The site-aware (or restriction-aware for custom setup) entities are marked with the checkmark ✓ next to the entity so that you know which entities are affected when you apply any site permissions or other restrictions to the employee group.

<img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-4aa1b7ec0129aade2281b6bec46dce08b86cbd23%2Fsite_aware.png?alt=media" alt="Site-aware entities" data-size="original">

<img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-6919bf45263efd35ab1ed4cfee591493346cd6f6%2Frestriction_aware.png?alt=media" alt="Restriction-aware entities" data-size="original">
{% endhint %}

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-8a0733abdbae219ec558f2fc2b97fe66f06ea2b7%2Fcreating_group.png?alt=media" alt="Creating group"><figcaption><p>Creating a group</p></figcaption></figure>

{% hint style="warning" %}
Selecting **manage** automatically deselects **view** access and the other way round.\
To disable existing access rights for an entity, uncheck the checkbox.
{% endhint %}
{% endstep %}

{% step %}

#### Confirm with **Save**

{% endstep %}
{% endstepper %}

{% hint style="danger" %}
Setting permissions

There are some resource types within CE that you access through other resources only and that don't have a separate view in the Management Dashboard, for example media, or payment gateway. Access to such resources depends on the permissions defined for the parent entity. For example, if you have read access to products, you get read access to media.

There are also resources that do have a separate view in the Management Dashboard but you also access them through other entities, for example categories in products. Access to such resources depends on the permissions you define at a group level for the particular resource. For example, if a group has `manage` access for products and `read` access for categories, the users are able to edit products, but not the categories within products. Or, if a group has `manage` access to products but no access to categories, the users don't have permission to see categories assigned to products. In that case, the users see `No permissions` message on a particular field.

For more information, see [Permissions](#permissions).

<img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-09ba409b31b4b668983f577d54ab87cc21d4c91e%2Fnopermission.png?alt=media" alt="Not sufficient permissions" data-size="original">
{% endhint %}

## Assign users to a group

To allow a user to work within the tenant, assign the user to a user group with a set of specific access rights. You can do it in two ways: from the user perspective and from the user group perspective.

### From the user perspective

{% stepper %}
{% step %}

#### Go to users view

In the **Administration** module, go to **Users and Groups** -> **Users**.
{% endstep %}

{% step %}

#### Choose the user

To open the edit mode, select the relevant user row.
{% endstep %}

{% step %}

#### Assign the user group

Go to the **Access** tab and select the relevant user group.
{% endstep %}

{% step %}

#### Save your changes

Choose **Save** to persist your edits.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-e7d9cf7e6612bc461a8ac3517d0718bfdc2ce7e6%2Fuser_access.png?alt=media" alt="User access groups"><figcaption><p>User access groups</p></figcaption></figure>
{% endstep %}
{% endstepper %}

### From the user group perspective

{% stepper %}
{% step %}

#### Go to the groups view

In the **Administration** module, go to **Users and Groups** -> **Groups**.
{% endstep %}

{% step %}

#### Go to the members management

Open the group you want to add members to and go to **Members** tab. Choose **Add members**.
{% endstep %}

{% step %}

#### Add the members

Select the users to add, you can search by first name, last name, email or department. Confirm with **Add members**.
{% endstep %}
{% endstepper %}

### From the user group edit mode

{% stepper %}
{% step %}

#### Go to the groups view

In the **Administration** module, go to **Users and Groups** -> **Groups**.
{% endstep %}

{% step %}

#### Choose the group

To open the edit mode, select the relevant group.
{% endstep %}

{% step %}

#### Assign the members

Go to the **Members** tab and choose **Add Members**. Select the users that you want to add to the group, you can search by first name, last name, email or department.
{% endstep %}

{% step %}

#### Save your changes

Choose **Save** to persist your edits.
{% endstep %}
{% endstepper %}

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-b1d07edeeb8533718be1a179a2ed15762dfb3e41%2Fmembers.png?alt=media" alt="Group members"><figcaption><p>Group members</p></figcaption></figure>

### Predefined roles

You can choose from the predefined roles for a user group or define manually the relevant access controls. Note that `manage` access control contains read, create, edit, and delete actions.

**Viewer**

<details>

<summary>Viewer Access Matrix</summary>

|                             Service                             |      Resource      | Read | Manage |
| :-------------------------------------------------------------: | :----------------: | :--: | :----: |
| <p><strong>Customer</strong><br><strong>Management</strong></p> |                    |   ✓  |        |
|                                                                 |      Companies     |   ✓  |        |
|                                                                 |      Customer      |   ✓  |        |
|                                                                 |       Coupons      |   ✓  |        |
|                            **Quotes**                           |                    |   ✓  |        |
|                                                                 |       Quotes       |   ✓  |        |
|                                                                 |    Status Quotes   |   ✓  |        |
|                            **Orders**                           |                    |   ✓  |        |
|                                                                 |       Orders       |   ✓  |        |
|                                                                 |        SEPA        |   ✓  |        |
|                                                                 |       Returns      |   ✓  |        |
|                           **Catalogs**                          |                    |   ✓  |        |
|                                                                 |      Catalogs      |   ✓  |        |
|                                                                 |     Categories     |   ✓  |        |
|                           **Products**                          |                    |   ✓  |        |
|                                                                 |      Products      |   ✓  |        |
|                                                                 |  Product Templates |   ✓  |        |
|                                                                 |       Labels       |   ✓  |        |
|                                                                 |      Suppliers     |   ✓  |        |
|                                                                 |       Brands       |   ✓  |        |
|                           **Pricing**                           |                    |   ✓  |        |
|                                                                 |    Price Models    |   ✓  |        |
|                                                                 |     Price Lists    |   ✓  |        |
|                           **Settings**                          |                    |   ✓  |        |
|                                                                 |        Sites       |   ✓  |        |
|                                                                 |  Delivery Methods  |   ✓  |        |
|                                                                 |   Delivery Times   |   ✓  |        |
|                                                                 |        Units       |   ✓  |        |
|                                                                 |         Tax        |   ✓  |        |
|                                                                 |      Countries     |   ✓  |        |
|                                                                 |     Currencies     |   ✓  |        |
|                                                                 |      Languages     |   ✓  |        |
|                                                                 | System Preferences |   ✓  |        |
|                                                                 |    Mixin Schemas   |   ✓  |        |
|                          **Extensions**                         |                    |   ✓  |        |
|                                                                 | e.g. site settings |   ✓  |        |
|                        **Administration**                       |                    |   ✓  |        |
|                                                                 |  Users and Groups  |   ✓  |        |
|                                                                 |      Webhooks      |   ✓  |        |
|                                                                 |     Extensions     |   ✓  |        |

</details>

**Manager**

<details>

<summary>Manager Access Matrix</summary>

|                             Service                             |      Resource      | Read | Manage |
| :-------------------------------------------------------------: | :----------------: | :--: | :----: |
| <p><strong>Customer</strong><br><strong>Management</strong></p> |                    |      |    ✓   |
|                                                                 |      Companies     |      |    ✓   |
|                                                                 |      Customer      |      |    ✓   |
|                                                                 |       Coupons      |      |    ✓   |
|                            **Quotes**                           |                    |      |    ✓   |
|                                                                 |       Quotes       |      |    ✓   |
|                                                                 |    Status Quotes   |      |    ✓   |
|                            **Orders**                           |                    |      |    ✓   |
|                                                                 |       Orders       |      |    ✓   |
|                                                                 |        SEPA        |      |    ✓   |
|                                                                 |       Returns      |      |    ✓   |
|                           **Catalogs**                          |                    |      |    ✓   |
|                                                                 |      Catalogs      |      |    ✓   |
|                                                                 |     Categories     |      |    ✓   |
|                           **Products**                          |                    |      |    ✓   |
|                                                                 |      Products      |      |    ✓   |
|                                                                 |  Product Templates |      |    ✓   |
|                                                                 |       Labels       |      |    ✓   |
|                                                                 |      Suppliers     |      |    ✓   |
|                                                                 |       Brands       |      |    ✓   |
|                           **Pricing**                           |                    |      |    ✓   |
|                                                                 |    Price Models    |      |    ✓   |
|                                                                 |     Price Lists    |      |    ✓   |
|                           **Settings**                          |                    |      |    ✓   |
|                                                                 |        Sites       |      |    ✓   |
|                                                                 |  Delivery Methods  |      |    ✓   |
|                                                                 |   Delivery Times   |      |    ✓   |
|                                                                 |        Units       |      |    ✓   |
|                                                                 |         Tax        |      |    ✓   |
|                                                                 |      Countries     |      |    ✓   |
|                                                                 |     Currencies     |      |    ✓   |
|                                                                 |      Languages     |      |    ✓   |
|                                                                 | System Preferences |      |    ✓   |
|                                                                 |    Mixin Schemas   |      |    ✓   |
|                          **Extensions**                         |                    |      |    ✓   |
|                                                                 | e.g. site settings |      |    ✓   |
|                        **Administration**                       |                    |      |        |
|                                                                 |  Users and Groups  |   ✓  |        |
|                                                                 |      Webhooks      |      |    ✓   |
|                                                                 |     Extensions     |   ✓  |        |

</details>

**Administrator**

<details>

<summary>Administrator Access Matrix</summary>

|                             Service                             |      Resource      | Read | Manage |
| :-------------------------------------------------------------: | :----------------: | :--: | :----: |
| <p><strong>Customer</strong><br><strong>Management</strong></p> |                    |      |    ✓   |
|                                                                 |      Companies     |      |    ✓   |
|                                                                 |      Customer      |      |    ✓   |
|                                                                 |       Coupons      |      |    ✓   |
|                            **Quotes**                           |                    |      |    ✓   |
|                                                                 |       Quotes       |      |    ✓   |
|                                                                 |    Status Quotes   |      |    ✓   |
|                            **Orders**                           |                    |      |    ✓   |
|                                                                 |       Orders       |      |    ✓   |
|                                                                 |        SEPA        |      |    ✓   |
|                                                                 |       Returns      |      |    ✓   |
|                           **Catalogs**                          |                    |      |    ✓   |
|                                                                 |      Catalogs      |      |    ✓   |
|                                                                 |     Categories     |      |    ✓   |
|                           **Products**                          |                    |      |    ✓   |
|                                                                 |      Products      |      |    ✓   |
|                                                                 |  Product Templates |      |    ✓   |
|                                                                 |       Labels       |      |    ✓   |
|                                                                 |      Suppliers     |      |    ✓   |
|                                                                 |       Brands       |      |    ✓   |
|                           **Pricing**                           |                    |      |    ✓   |
|                                                                 |    Price Models    |      |    ✓   |
|                                                                 |     Price Lists    |      |    ✓   |
|                           **Settings**                          |                    |      |    ✓   |
|                                                                 |        Sites       |      |    ✓   |
|                                                                 |  Delivery Methods  |      |    ✓   |
|                                                                 |   Delivery Times   |      |    ✓   |
|                                                                 |        Units       |      |    ✓   |
|                                                                 |         Tax        |      |    ✓   |
|                                                                 |      Countries     |      |    ✓   |
|                                                                 |     Currencies     |      |    ✓   |
|                                                                 |      Languages     |      |    ✓   |
|                                                                 | System Preferences |      |    ✓   |
|                                                                 |    Mixin Schemas   |      |    ✓   |
|                          **Extensions**                         |                    |      |    ✓   |
|                                                                 | e.g. site settings |      |    ✓   |
|                        **Administration**                       |                    |      |    ✓   |
|                                                                 |  Users and Groups  |      |    ✓   |
|                                                                 |      Webhooks      |      |    ✓   |
|                                                                 |     Extensions     |      |    ✓   |

</details>

**Catalog Manager**

<details>

<summary>Catalog Manager Access Matrix</summary>

|       Service      |      Resource     | Read | Manage |
| :----------------: | :---------------: | :--: | :----: |
|    **Catalogs**    |                   |      |    ✓   |
|                    |      Catalogs     |      |    ✓   |
|                    |     Categories    |      |    ✓   |
|    **Products**    |                   |      |    ✓   |
|                    |      Products     |      |    ✓   |
|                    | Product Templates |      |    ✓   |
|                    |       Labels      |      |    ✓   |
|                    |     Suppliers     |      |    ✓   |
|                    |       Brands      |      |    ✓   |
| **Administration** |                   |      |        |
|                    |      Webhooks     |      |    ✓   |

</details>

**Pricing Manager**

<details>

<summary>Pricing Manager Access Matrix</summary>

|       Service      |      Resource     | Read | Manage |
| :----------------: | :---------------: | :--: | :----: |
|     **Pricing**    |                   |      |        |
|                    |    Price Models   |      |    ✓   |
|                    |    Price Lists    |      |    ✓   |
|    **Settings**    |                   |      |        |
|                    |        Tax        |      |    ✓   |
|                    |       Units       |      |    ✓   |
|                    |     Countries     |      |    ✓   |
|                    |     Currencies    |      |    ✓   |
|    **Products**    |                   |      |        |
|                    |      Products     |      |    ✓   |
|                    | Product templates |   ✓  |        |
|    **Catalogs**    |                   |      |        |
|                    |      Catalogs     |   ✓  |        |
|                    |     Categories    |   ✓  |        |
| **Administration** |                   |      |        |
|                    |  Users and Groups |   ✓  |        |

</details>

**Order Fulfillment Manager**

<details>

<summary>Order Fulfillment Manager Access Matrix</summary>

|                             Service                             | Resource | Read | Manage |
| :-------------------------------------------------------------: | :------: | :--: | :----: |
| <p><strong>Customer</strong><br><strong>Management</strong></p> |          |      |        |
|                                                                 | Customer |   ✓  |        |
|                            **Orders**                           |          |      |    ✓   |
|                                                                 |  Orders  |      |    ✓   |
|                                                                 |   SEPA   |      |    ✓   |
|                                                                 |  Returns |      |    ✓   |
|                           **Settings**                          |          |      |        |
|                                                                 |   Sites  |   ✓  |        |

</details>

**Compare role templates**

|         Service         |      Resource      | Viewer | Manager | Administrator | Catalog Manager | Pricing Manager | Order Fulfillment Manager |
| :---------------------: | :----------------: | :----: | :-----: | :-----------: | :-------------: | :-------------: | :-----------------------: |
| **Customer Management** |                    |        |         |               |                 |                 |                           |
|                         |      Companies     |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         |      Customer      |  Read  |  Manage |     Manage    |        ✗        |        ✗        |            Read           |
|                         |       Coupons      |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|        **Quotes**       |                    |        |         |               |                 |                 |                           |
|                         |       Quotes       |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         |    Status Quotes   |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|        **Orders**       |                    |        |         |               |                 |                 |                           |
|                         |       Orders       |  Read  |  Manage |     Manage    |        ✗        |        ✗        |           Manage          |
|                         |        SEPA        |  Read  |  Manage |     Manage    |        ✗        |        ✗        |           Manage          |
|                         |       Returns      |  Read  |  Manage |     Manage    |        ✗        |        ✗        |           Manage          |
|       **Catalogs**      |                    |        |         |               |                 |                 |                           |
|                         |      Catalogs      |  Read  |  Manage |     Manage    |      Manage     |       Read      |             ✗             |
|                         |     Categories     |  Read  |  Manage |     Manage    |      Manage     |       Read      |             ✗             |
|       **Products**      |                    |        |         |               |                 |                 |                           |
|                         |      Products      |  Read  |  Manage |     Manage    |      Manage     |      Manage     |             ✗             |
|                         |  Product Templates |  Read  |  Manage |     Manage    |      Manage     |       Read      |             ✗             |
|                         |       Labels       |  Read  |  Manage |     Manage    |      Manage     |        ✗        |             ✗             |
|                         |      Suppliers     |  Read  |  Manage |     Manage    |      Manage     |        ✗        |             ✗             |
|                         |       Brands       |  Read  |  Manage |     Manage    |      Manage     |        ✗        |             ✗             |
|       **Pricing**       |                    |        |         |               |                 |                 |                           |
|                         |    Price Models    |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|                         |     Price Lists    |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|       **Settings**      |                    |        |         |               |                 |                 |                           |
|                         |        Sites       |  Read  |  Manage |     Manage    |        ✗        |        ✗        |            Read           |
|                         |  Delivery Methods  |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         |   Delivery Times   |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         |        Units       |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|                         |         Tax        |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|                         |      Countries     |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|                         |     Currencies     |  Read  |  Manage |     Manage    |        ✗        |      Manage     |             ✗             |
|                         |      Languages     |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         | System Preferences |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|                         |    Mixin Schemas   |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|      **Extensions**     |                    |        |         |               |                 |                 |                           |
|                         | e.g. site settings |  Read  |  Manage |     Manage    |        ✗        |        ✗        |             ✗             |
|    **Administration**   |                    |        |         |               |                 |                 |                           |
|                         |  Users and Groups  |  Read  |   Read  |     Manage    |        ✗        |       Read      |             ✗             |
|                         |      Webhooks      |  Read  |  Manage |     Manage    |      Manage     |        ✗        |             ✗             |
|                         |     Extensions     |  Read  |   Read  |     Manage    |        ✗        |        ✗        |             ✗             |

### Permissions

As particular resources have references to other resources, you need to take that into account when setting the relevant access controls for the groups you create. We've prepared a matrix of possible functions in a company and expected permissions in Management Dashboard. You might use it as a baseline for managing permissions for particular groups.

{% hint style="success" %}
Example

You want to create a user group responsible for managing quotes in the system. Therefore, you select `manage` access control for quotes resources, however that might not be enough. Most probably, you also have to select at least `read` access control for companies resources, and you'd also need `manage` access for products so that the group members are able to manage price resources (which they access through products). Without these additional `read` and `manage` access, the users are not able to view the relevant resources that are related in one way or another to quotes, and are not able to process quotes accordingly.

The `manage` permission for a particular entity also gives a possibility for a user to configure the table columns for the list view by using the orchestration icon. They can adjust which columns are visible and which are hidden for the particular resource view in Management Dashboard that they have `manage` right to.

<img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-7cfcfdf2cec4c375b7575ad6c176c07374395af1%2Forchestration.png?alt=media" alt="" data-size="original">
{% endhint %}

Take a look at the matrix to see what to take into account.

<details>

<summary>Role/Permission Matrix</summary>

| Function/role              | Read                                                                                                                    | Manage                                                                                     |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| Manage customer management | customers (user and groups)                                                                                             | <p>customers<br>companies<br>coupons</p>                                                   |
| Manage companies           | customers (assigning customers to a company only)                                                                       | <p>companies<br>customers (including creating contacts, customers functionality)</p>       |
| Manage coupon              | categories                                                                                                              | coupons                                                                                    |
| Manage quotes              | companies                                                                                                               | <p>quotes<br>products</p>                                                                  |
| Manage orders              |                                                                                                                         | orders                                                                                     |
| Manage SEPA                |                                                                                                                         | SEPA                                                                                       |
| Manage returns             | <p>customers<br>orders<br>products</p>                                                                                  | returns                                                                                    |
| Manage catalogs            | categories                                                                                                              | catalogs                                                                                   |
| Manage categories          | media                                                                                                                   | categories                                                                                 |
| Manage products            | <p>product templates<br>suppliers<br>categories<br>price models<br>price lists<br>taxes<br></p>                         | products                                                                                   |
| Manage product templates   |                                                                                                                         | product templates                                                                          |
| Manage labels              |                                                                                                                         | labels                                                                                     |
| Manage suppliers           |                                                                                                                         | suppliers                                                                                  |
| Manage brands              |                                                                                                                         | brands                                                                                     |
| Manage price models        |                                                                                                                         | <p>price models<br>products</p>                                                            |
| Manage price lists         | <p>catalogs<br>categories<br>customers (user and groups)</p>                                                            | <p>price lists<br>price models<br>products<br>tax<br>unites<br>countries<br>currencies</p> |
| Manage sites               | <p>currencies<br>payment methods<br>countries<br>languages</p>                                                          | sites                                                                                      |
| Manage delivery methods    | sites                                                                                                                   | delivery methods                                                                           |
| Manage delivery times      | sites                                                                                                                   | delivery time                                                                              |
| Manage units               |                                                                                                                         | units                                                                                      |
| Manage tax                 |                                                                                                                         | tax                                                                                        |
| Manage countries           |                                                                                                                         | countries                                                                                  |
| Manage currencies          |                                                                                                                         | currencies                                                                                 |
| Manage system preferences  |                                                                                                                         | system preferences                                                                         |
| Manage mixin schemas       | <p>categories<br>companies<br>coupons<br>customers<br>customer.addresses<br>orders<br>products<br>quotes<br>returns</p> | mixin schemas                                                                              |

</details>

{% hint style="info" %}
For more information about the access controls, see the [Identity and Access Management](https://developer.emporix.io/ce/system-management/authentication-and-authorization/authorization/iam) tutorial related to the Emporix API IAM Service.
{% endhint %}

## Restrictions

An employee group can limit visibility of site-aware entities based on specific restriction values they are assigned with. This separates responsibility of your employees to certain sites or markets. For example, you want to have separate employee groups of Order Fulfillment Managers for each site (`DE`, `FR`, `NL`, `US`). Typically, restrictions are associated with sites, or storefronts you run your business at, but you can also create your custom restrictions, for example, regional groupings like `West-EU`, `APAC` or other.

{% hint style="danger" %}
The custom restrictions functionality (when the sites sync is **disabled**) requires implementing automatic restriction assignment to the relevant entities at the Backend for Frontend (BFF) level. This step is essential because, for example, the end customers that make purchases in your store do not have the scopes or permissions needed to apply restrictions during registration or cart creation.

Since the exact implementation depends on your setup, ensure you have an appropriate solution in place to use this feature effectively.

On the other hand, when the sites sync is **enabled**, **no further** implementation is required as new data inherit the site codes from the customer or cart entities.

To learn more about site permissions and restrictions management, see the [Site Permissions](https://developer.emporix.io/ce/system-management/authentication-and-authorization/authorization/site-permissions).
{% endhint %}

### Assigning site permissions to groups

If you want to use **sites** as group restrictions, make sure you have the `enableSyncBetweenRestrictionsAndSiteCodes` setting enabled in the **System Preferences**.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-0f0446d23e254a88b9b3efba2a156363dd5f1037%2FenableSiteSync_setting.png?alt=media" alt="Sites and restrictions sync on setting"><figcaption><p>Enable sites and restrictions sync setting</p></figcaption></figure>

This takes care of making site-aware entities bear relevant site codes as restrictions. Also, it automatically populates site codes as possible restriction values on user groups.

To create a group with a particular site or multiple sites permissions, add the site code value in the **Restriction** field. The employees belonging to such a group are only able to see and/or manage (depending on access control permissions) the site-aware entities that have the same restriction.

For example, the `DE Order Fulfillment Manager` employee group has assigned `DE` site permission, while the `US Order Fulfillment Manager` employee group has assigned `US` site permission. The groups have the same access permissions for cart, order, and quote entities defined for its members.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-2ec4d747fdd244847f8b6c5d083e9d239030feb5%2Fgroups_site_permissions_de.png?alt=media" alt="Group with DE site permissions"><figcaption><p>Group with DE site permissions</p></figcaption></figure>

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-c251b2fc7108cf7f5fc1fbfa4e893e9aefad6ddd%2Fgroups_site_permissions_us.png?alt=media" alt="Group with US site permissions"><figcaption><p>Group with US site permissions</p></figcaption></figure>

The visibility of the site-aware entities is different for the employees from these groups. `DE` group members see only entities with `DE` restriction, while `US` group employees view only `US` entities. They are not able to view nor manage any entity that has a different restriction or no restriction assigned. However, employees that have no restrictions assigned to their groups see all the entities.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-3cbaf4cfa8cb0fdcf00cde5787c487da776d9888%2Fgroups_restricted_access.png?alt=media" alt="User&#x27;s view with restricted order access"><figcaption><p>User's view with restricted order access</p></figcaption></figure>

{% hint style="warning" %}
Employees who belong to user groups that have no site permissions or restrictions assigned can view and/or manage all entities, regardless of the site or restriction values associated with those entities. For example, in addition to site-specific groups, you can grant unrestricted access to all entities to admin or global manager groups. Ensure your group configuration applies restrictions at the appropriate level to achieve the degree of control you intend.
{% endhint %}

### Assigning custom restrictions to groups

For the cases when you want to use restrictions in another context outside the sites scope, you have an option to use **custom-defined restriction** values. To make it work, firstly make sure you have the right configuration in the **System Preferences**:

* disable the sync between sites and restrictions, that is set the `enableSyncBetweenRestrictionsAndSiteCodes` setting to `false`

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-12690bc6ba14dd7f014da217e86c51bdfd12c7d4%2FsiteSyncOff_setting.png?alt=media" alt="Sites and restrictions sync off setting"><figcaption><p>Sites and restrictions sync off setting</p></figcaption></figure>

* define the possible values list in the `restrictions` setting

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-79500b7edec6e3771007baa615703968d5ba6e4c%2Fsetting_restrictionslist.png?alt=media" alt="List of custom restrictions list setting"><figcaption><p>List of custom restrictions list setting</p></figcaption></figure>

Then, you can use these restrictions on the user groups level. Select one or more restriction values in the **Restrictions** field.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-c4a4480ac3186c053c9d1b88bb81a6f35aff0a36%2Fgroups_custom_restrictions.png?alt=media" alt="Group with custom restrictions"><figcaption><p>Group with custom restrictions</p></figcaption></figure>

When the proper implementation is in place, the employees from the restricted employee group view and/or manage restriction-aware entities with the same set of restrictions only. They don't have access to the restricted entities with different values and get relevant notification in the Management Dashboard.

## Vendor groups

Vendor groups are specifically related to [Vendor Management](https://developer.emporix.io/ce/management-dashboard/vendors). When a vendor is created, it automatically creates four new user groups for your tenant - `vendor.order.manager`, `vendor.order.viewer`, `vendor.product.manager`, `vendor.product.viewer`.

In the example based on ABC Company the groups are as below and they can be already visible in the users and groups view.

* ABC Company Vendor Product Manager
* ABC Company Vendor Product Viewer
* ABC Company Vendor Order Manager
* ABC Company Vendor Order Viewer

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-e96807868264bc6768825ea2fed3641a6c55b2b7%2Fvendor_users.png?alt=media" alt="Vendor users"><figcaption><p>Vendor users</p></figcaption></figure>

Each group has the role and access rights already configured during creation, the role is **Vendor** and the access rights depend on the type of group. For example, for ABC Company Vendor Order Manager the access rights are Orders - Manage.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-714058f36a8c91ec55735b794e428f1fef4f486e%2Fvendor_users3.png?alt=media" alt="Vendor users"><figcaption><p>Vendor users</p></figcaption></figure>

The specific vendor group access rights are:

| Group                  | Order Access  | Product Access                                             | Notes                                                          |
| ---------------------- | ------------- | ---------------------------------------------------------- | -------------------------------------------------------------- |
| Vendor order manager   | Manage orders | ✗                                                          | –                                                              |
| Vendor order viewer    | Read orders   | ✗                                                          | –                                                              |
| Vendor product manager | ✗             | Manage products, including prices, availability, and media | Can also be granted permissions to publish/unpublish products. |
| Vendor product viewer  | ✗             | Read products, including prices, availability, and media   | Cannot be granted publishing rights.                           |

As in the standard user group management, in the group's **Members** tab you can view and manage the group members.

<figure><img src="https://3057647601-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbTY7EwZtYYQYC6GOcdTj%2Fuploads%2Fgit-blob-dab7d3e9a4ed426ee83a9ebf875d37839596d308%2Fvendor_users2.png?alt=media" alt="Vendor users"><figcaption><p>Vendor users</p></figcaption></figure>

{% hint style="info" %}
For more details about vendors, see the following guides:

* [Vendor Management](https://developer.emporix.io/ce/management-dashboard/vendors)
* [Vendor Products](https://developer.emporix.io/ce/products-module/products#vendor-related-products)
* [Vendor Order Split](https://developer.emporix.io/ce/orders-module/orders#vendors-order-splitting)
* [Vendor Service](https://app.gitbook.com/s/d4POTWomuSS7d3dnh4Dg/api-guides/companies-and-customers/vendor-service)
  {% endhint %}