Users and Groups
Manage access rights for users and groups.
The Users and Groups module allows you to manage the data of all the users and groups that belong to your tenant. To give users access to the system, add them to the tenant, create the relevant groups, and assign users to those groups. A user’s effective access is determined by the access controls assigned to their groups and the scopes included in those access controls. Groups can also include site-based or custom restrictions to limit visibility to specific data sets where supported.
How authorization works
User access in the platform follows a consistent model:
Users belong to one or more groups
Groups are assigned one or more access controls
Access controls contain lists of scopes
Scopes determine what users can view or manage
This means Users and Groups is the place where you connect people to the access model. For more information about the underlying authorization objects, see Access Controls and Scopes.
Definitions
User - an employee using the Emporix Management Dashboard.
User Group - a group of users that share some common characteristics, like performing similar job. User group defines access controls for the users. It can define site permissions or custom restrictions to limit visibility for members to only entities assigned to particular sites/restriction values. See more in Restrictions.
Role - a combination of predefined access controls that allow users to perform some actions on resources within the system. You can apply a role to a user group.
Access control - a combination of scopes that allows performing specific actions on specific resources.
Scope - a single permission for a specific action on a resource, for example, viewing orders. Available scopes in your tenant include platform scopes, tenant-defined scopes, and scopes generated for custom entities.
Restriction - the condition applied on entities and employee groups to manage access or roles separation. Most commonly, restrictions are identical to sites, but can also apply to custom keys.
Users
You can filter or sort the users list by first name, last name, email address, department or status.
There are two status types:
The Green dot shows the user is active
The Grey dot shows that the user was added and provisioned, but has not registered their account yet
Create a user
If at any point you decide to stop adding the new user, you can use the Discard option. It clears all the fields and removes the data you’ve entered for the user.
Preferred language
The Preferred Language field stores the language preference in the Identity and Access Management (IAM) profile of the user being created or edited. When that user signs in, the Management Dashboard evaluates the preference separately for the interface language and data language selectors. The interface supports English and German. Available data languages depend on the tenant configuration. Each selector applies the preference when that language is available. Otherwise, it keeps the language last selected in the browser. If no language was previously selected, the interface uses English, and the data language uses the tenant's default language.
For details about the language selectors, see Data and interface languages.
Groups
You can filter and sort groups by the group name.
Create a user group
Optional: Define the group restrictions
This step applies if you'd like to restrict access control to the entities that are site-aware, such as companies (legal entities), customers, carts, orders, or quotes. Choose one or multiple sites or custom restrictions from the list.
Optional: Choose the group role
Choose the Role for the group, you can select between:
Standard role for Management Dashboard users: Viewer, Manager, or Admin.
One of the Templates for Manager roles with specific access rights.
Vendors role for a created vendor with orders or products read/manage access rights.
Based on your choice of Role, you can see that the pre-defined access controls in Management Dashboard Settings section get selected automatically.
Assign users to a group
To allow a user to work within the tenant, assign the user to a user group with a set of specific access rights. You can do it in two ways: from the user perspective and from the user group perspective.
From the user perspective
From the user group perspective
From the user group edit mode
Select user roles
User roles can be configured either with the predefined roles that are automatically available to choose from, or by creating custom roles which you can use for more complex and specific system access requirements.
Predefined roles
You can choose from the predefined roles for a user group or define manually the relevant access controls. Note that manage access control contains read, create, edit, and delete actions.
Viewer
Manager
Administrator
Catalog and Product Manager
Pricing Manager
Order Fulfillment Manager
Compare role templates
Permissions
As particular resources have references to other resources, you need to take that into account when setting the relevant access controls for the groups you create. We've prepared a matrix of possible functions in a company and expected permissions in Management Dashboard. You might use it as a baseline for managing permissions for particular groups.
User-specific roles configuration
In addition to using the predefined set of roles and permissions, you can build your own user roles and assign them to relevant users or groups. This is done by defining scopes and grouping them in the access controls you can assign to users and user groups.
Check the examples matrix below to see how scopes, access controls, and roles can fit together.
Restrictions
An employee group can limit visibility of site-aware entities based on specific restriction values they are assigned with. This separates responsibility of your employees to certain sites or markets. For example, you want to have separate employee groups of Order Fulfillment Managers for each site (DE, FR, NL, UK). Typically, restrictions are associated with sites, or storefronts you run your business at, but you can also create your custom restrictions, for example, regional groupings like West-EU, APAC or other.
Assigning site restrictions to groups
If you want to use sites as group restrictions, make sure you have the enableSyncBetweenRestrictionsAndSiteCodes setting enabled in the System Preferences.
This takes care of making site-aware entities bear relevant site codes as restrictions. Also, it automatically populates site codes as possible restriction values on user groups.
To create a group with a particular site or multiple sites permissions, add the site code value in the Restriction field. The employees belonging to such a group are only able to see and/or manage (depending on access control permissions) the site-aware entities that have the same restriction.
For example, the DE Order Fulfillment Manager employee group has assigned DE site permission, while the UK Order Fulfillment Manager employee group has assigned UK site permission. The groups have the same access permissions for cart, order, and quote entities defined for its members.
The visibility of the site-aware entities is different for the employees from these groups. DE group members see only entities with DE restriction, while UK group employees view only UK entities. They are not able to view nor manage any entity that has a different restriction or no restriction assigned. However, employees that have no restrictions assigned to their groups see all the entities.
Assigning custom restrictions to groups
For the cases when you want to use restrictions in another context outside the sites scope, you have an option to use custom-defined restriction values. To make it work, firstly make sure you have the right configuration in the System Preferences:
disable the sync between sites and restrictions, that is set the
enableSyncBetweenRestrictionsAndSiteCodessetting tofalse
define the possible values list in the
restrictionssetting
Then, you can use these restrictions on the user groups level. Select one or more restriction values in the Restrictions field.
When the proper implementation is in place, the employees from the restricted employee group view and/or manage restriction-aware entities with the same set of restrictions only. They don't have access to the restricted entities with different values and get relevant notification in the Management Dashboard.
Vendor groups
Vendor groups are specifically related to Vendor Management. When a vendor is created, it automatically creates four new user groups for your tenant - vendor.order.manager, vendor.order.viewer, vendor.product.manager, vendor.product.viewer.
In the example based on ABC Company the groups are as below and they can be already visible in the users and groups view.
ABC Company Vendor Product Manager
ABC Company Vendor Product Viewer
ABC Company Vendor Order Manager
ABC Company Vendor Order Viewer
Each group has the role and access rights already configured during creation, the role is Vendor and the access rights depend on the type of group. For example, for ABC Company Vendor Order Manager the access rights are Manage orders and Read products.
The specific vendor group access rights are:
Vendor order manager
Manage orders
✗
–
Vendor order viewer
Read orders
✗
–
Vendor product manager
✗
Manage products, including prices, availability, and media
Can also be granted permissions to publish/unpublish products.
Vendor product viewer
✗
Read products, including prices, availability, and media
Cannot be granted publishing rights.
As in the standard user group management, in the group's Members tab you can view and manage the group members.
Audit Logs
The Audit Logs tab on a user group detail page shows the history of changes for that group, including what changed and when, with field-level previous and updated values. Actors can include named users, anonymous storefront activity, or system actions.
Last updated
Was this helpful?