Users and Groups
Manage access rights for users and groups.
The Users and Groups module allows you to manage the data of all the users and groups that belong to your tenant. To give users access to the system, add them to the tenant, create the relevant groups, and assign users to those groups. A user’s effective access is determined by the access controls assigned to their groups and the scopes included in those access controls. Groups can also include site-based or custom restrictions to limit visibility to specific data sets where supported.
How authorization works
User access in the platform follows a consistent model:
Users belong to one or more groups
Groups are assigned one or more access controls
Access controls contain lists of scopes
Scopes determine what users can view or manage
This means Users and Groups is the place where you connect people to the access model. For more information about the underlying authorization objects, see Access Controls and Scopes.
When Microsoft Entra ID Access is enabled, group membership for mapped employees is applied at login from the entraid_mapping tenant configuration. Manual assignment of users to groups is disabled in the Management Dashboard. Add and remove employees in Microsoft Entra ID directly.
The Management Dashboard views are dependent on the user's permissions. If you don't see a particular node, or section described in the Emporix documentation, or are not able to modify an entity, it might mean you don't have sufficient permissions set. Contact the administrator if you need additional access.
Definitions
User - an employee using the Emporix Management Dashboard.
User Group - a group of users that share some common characteristics, like performing similar job. User group defines access controls for the users. It can define site permissions or custom restrictions to limit visibility for members to only entities assigned to particular sites/restriction values. See more in Restrictions.
Role - a combination of predefined access controls that allow users to perform some actions on resources within the system. You can apply a role to a user group.
Access control - a combination of scopes that allows performing specific actions on specific resources.
Scope - a single permission for a specific action on a resource, for example, viewing orders. Available scopes in your tenant include platform scopes, tenant-defined scopes, and scopes generated for custom entities.
Restriction - the condition applied on entities and employee groups to manage access or roles separation. Most commonly, restrictions are identical to sites, but can also apply to custom keys.
Users
You can filter or sort the users list by first name, last name, email address, department or status.
There are two status types:
The Green dot shows the user is active
The Grey dot shows that the user was added and provisioned, but has not registered their account yet
Create a user
If at any point you decide to stop adding the new user, you can use the Discard option. It clears all the fields and removes the data you’ve entered for the user.
Preferred language
The Preferred Language field stores the language preference in the Identity and Access Management (IAM) profile of the user being created or edited. When that user signs in, the Management Dashboard evaluates the preference separately for the interface language and data language selectors. The interface supports English and German. Available data languages depend on the tenant configuration. Each selector applies the preference when that language is available. Otherwise, it keeps the language last selected in the browser. If no language was previously selected, the interface uses English, and the data language uses the tenant's default language.
For details about the language selectors, see Data and interface languages.
Groups
You can filter and sort groups by the group name.
Create a user group
Provide the group's details
In General section, provide the group's ID, name and description.
Only the Group Name is mandatory for a user group creation. You can decide to edit other details later. You can also set up a custom user group ID in the Id field. Otherwise, a unique ID is automatically generated when the group is created.
Optional: Define the group restrictions
This step applies if you'd like to restrict access control to the entities that are site-aware, such as companies (legal entities), customers, carts, orders, or quotes. Choose one or multiple sites or custom restrictions from the list.
The sites and restrictions list depends on the configuration settings in the System Preferences. If the site sync is enabled, you are able to assign site-related permissions to a group; if the sync is off and you have defined custom restrictions, the groups can be assigned with the relevant restrictions values.
The restrictions regulate access to entities associated with particular sites in your tenant, or to other custom-defined restrictions.
Learn more in the Restrictions section.
Optional: Choose the group role
Choose the Role for the group, you can select between:
Standard role for Management Dashboard users: Viewer, Manager, or Admin.
One of the Templates for Manager roles with specific access rights.
Vendors role for a created vendor with orders or products read/manage access rights.
In the case when you have both Commerce Engine and Orchestration Engine setup in your tenant, firstly choose which product you want to define the group for. The available options for roles and permissions depend on this choice.
Based on your choice of Role, you can see that the pre-defined access controls in Management Dashboard Settings section get selected automatically.
Set access rights
Set up the group access rights in the Access Controls Assignment section:
Choose +Assign Access Controls to select access controls from the list of available options. Access controls are created in the Access Controls view and include the scopes selected for each control.
The site-aware (or restriction-aware for custom setup) entities are marked with the checkmark ✓ if you expand the access control, so that you know which entities are affected when you apply any site or other restrictions to the employee group.
Setting permissions
There are some resource types within CE that you access through other resources only and that don't have a separate view in the Management Dashboard, for example media, or payment gateway. For Category Manager, Category Viewer, Product Manager, and Product Viewer access controls, the system automatically assigns the matching Media Manager or Media Viewer access control—you do not need to add media permissions separately. For other resources (for example payment gateway), access may still depend on permissions defined for the parent entity.
There are also resources that do have a separate view in the Management Dashboard but you also access them through other entities, for example categories in products. Access to such resources depends on the permissions you define at a group level for the particular resource. For example, if a group has manage access for products and read access for categories, the users are able to edit products, but not the categories within products. Or, if a group has manage access to products but no access to categories, the users don't have permission to see categories assigned to products. In that case, the users see No permissions message on a particular field.
For more information, see Permissions.
Assign users to a group
To allow a user to work within the tenant, assign the user to a user group with a set of specific access rights. You can do it in two ways: from the user perspective and from the user group perspective.
From the user perspective
From the user group perspective
From the user group edit mode
Select user roles
User roles can be configured either with the predefined roles that are automatically available to choose from, or by creating custom roles which you can use for more complex and specific system access requirements.
Predefined roles
You can choose from the predefined roles for a user group or define manually the relevant access controls. Note that manage access control contains read, create, edit, and delete actions.
Viewer
Manager
Administrator
Catalog and Product Manager
Pricing Manager
Order Fulfillment Manager
Compare role templates