- Getting started
- Data security and compliance
- Organizations
- Authentication and security
- Licensing
- About licensing
- Unified Pricing: Licensing plan framework
- Flex: Licensing plan framework
- Activating your Enterprise license
- Upgrading and downgrading licenses
- Requesting a service trial
- Assigning licenses to tenants
- Assigning user licenses
- Deallocating user licenses
- Monitoring license allocation
- License overallocation
- Licensing notifications
- User license management
- Tenants and services
- Accounts and roles
- Testing in your organization
- AI Trust Layer
- External applications
- Notifications
- Logging
- Troubleshooting
- Migrating to Automation Cloud
Automation Cloud admin guide
You can manage and assign service-level roles from within each service as long as you have the appropriate permissions in the service.
For example, users with the Administrator role in Orchestrator can create and edit roles, and assign roles to existing accounts.
The Manage access user interface (UI) keeps a consistent appearance across all scopes.
The following table illustrates how the Manage access UI looks like for each scope:
|
Scope |
Manage access UI |
|---|---|
|
Organization |
|
|
Tenant |
|
|
Service |
|
|
Project |
|
As an organization administrators, you can navigate to Manage access at organization level to assign tenant-level roles.
To view the role definition and the permissions granted, take the following steps:
- Navigate to Manage access.
- In the Roles tab, select the View button next to the role.
You can assign an organization-level role to a user, group, robot account, or external application. To assign a role, take the following steps:
- Navigate to Manage access, then
- in the Role assignments tab, search for the account you want to assign the role to and choose the appropriate role.
- Select Assign.
Tenant-level roles can be assigned at tenant level and can have granted permissions up to the service level.
Organization Administrators or other Tenant Administrators can view the Manage access screen.
- Navigate to Manage access.
- In the Roles tab, select the View button next to the role.
- Navigate to Manage access.
- In the Role assignments tab, search for the account you want to assign the role to and choose the appropriate role.
- Select Assign.
Tenant Administrator role visibility at service level
The Tenant Administrator role assignment is visible both at tenant and individual service level. At the service level, the Tenant Administrator role has the following properties:
-
It is shown with a platform role label.
-
It is immutable, implying that you cannot remove the assignment at the service level.
-
In some services, such as Orchestrator, there is a link next to the role that redirects you to the Manage access page at platform level, where you can change the tenant-level role assignments.
You can manage and assign service-level roles from within the services. You can assign roles to groups (recommended), or to accounts that have already been added.
For information and instructions, refer to the applicable documentation, as described in the following table:
|
Service |
Details |
|---|---|
|
Managed from Orchestrator. |
|
Managed from Orchestrator.
|
|
Managed from Orchestrator.
|
|
Managed from Automation Hub. For more information about which roles are required and instructions for assigning them, refer to Role description and matrix. |
|
Managed from AutomationOps. For more information, refer to AutomationOps user roles. |
|
Managed from Orchestrator. For information about the roles required to use AI Center, refer to AI Center access control. |
|
Managed from Orchestrator. For more information, refer to Orchestrator permissions. |
|
Managed from Data Fabric.
|
|
Managed from Document Understanding. For more information about which roles are required and instructions for assigning them, refer to Role-based access control. |
|
Managed from Insights. For more information, refer to Granting permissions. |
|
Managed from IXP. For more information, refer to Roles and their underlying permissions. |
|
Managed from Process Mining. For more information, refer to User management in Process Mining. |
|
Managed from Studio Web. For more information, refer to Managing access to Studio Web. |
|
Managed using Automation CloudTM organization-level roles. For information about the rights that organization-level roles grant in Task Mining, refer to Managing access and roles in the Task Mining documentation. |
|
Managed from Test Cloud. For more information, refer to Managing access. |
|
Managed from Test Manager. For information and instructions, refer to User and group access management. |
Assigning roles to an account
If you want to control the access a certain account has in a service at a more granular level, but you do not want to add new roles to an entire group, you can explicitly add the account to the service and assign one or more service-level roles to it directly.
For information about the available roles and instructions, refer to the documentation for the target service, as previously described.
Depending on the service you use, you can assign:
-
folder roles from Orchestrator.
- project roles from:
- Document Understanding
- IXP
- Test Manager
- Task Mining
For more information, refer to the table in Assigning and managing service-level roles.
To export role assignments, take the following steps:
-
Navigate to Admin at organization level.
-
Select Accounts & local groups.
-
Select Download role assignments for the roles you want to export.
The following table describes the fields from the tole assignments file.
| Field | Description |
|---|---|
| Id | The unique identifier of the role assignment. |
| RoleName | The role name as displayed in the interface.
For example, Folder Administrator |
| RoleId | The unique identifier of the role. |
| RoleDescription | The role description, as displayed in the interface.
For example, Folder Administrator For example, Folder Administrator |
| RoleType | The role type, as defined by the user or the system:
|
| RoleAssignmentType | The role assignment type when it was created, which can be one of the
following two options:
|
| Scope | The scope is a specific level in the organizational hierarchy that
serves as a boundary for certain actions, permissions, and objects. A
scope can be one of the following hierarchical options, represented as
IDs:
|
| ScopeWithDisplayNames | The scope is a specific level in the organizational hierarchy that
serves as a boundary for certain actions, permissions, and objects. A
scope can be one of the following hierarchical options:
|
| ServiceName | The name of the UiPath service that the role belongs to. |
| SecurityPrincipalId | The unique identifier for the identity of a user, group, etc. |
| SecurityPrincipalType | The identity type of a user, group, or robot. |
| SecurityPrincipalEmail | The email of the user. This field is blank in case the identity is not a user. |
| SecurityPrincipalDisplayName | The name of the identity. This field is blank in case of directory users. |
| InheritedFromGroupName | The group name from which the role assignment is inherited. |
| InheritedFromGroupId | Group identifier from which the role assignment is inherited. |
| TenantName | The name of the tenant where the assignment is made. This field is blank in case of organization-level assignments. |
| OrganizationName | The name of the organization where the assignment is made. |
| OrganizationId | The identifier of the organization where the assignment is made. |
| TenantId | The identifier of the tenant where the assignment is made. This field is blank in case of organization-level assignments. |
| CreatedBy | The unique identifier of the user who creates the assignment. |
| CreatedByDisplayName | The name of the user who creates the assignment. |
| CreatedOn | The timestamp when the role is assigned. |
| FolderName | The name of the folder associated with the assignment. |
| FolderKey | The unique identifier of the folder associated with the assignment. |
| ProjectId | The ID of the project (for example, Document Understanding or IXP) associated with the assignment. |
