- 入门指南
- 最佳实践
- 租户
- 注册表
- Cloud Robots
- Automation Suite 机器人
- 文件夹上下文
- 流程
- 作业
- Apps
- 触发器
- 日志
- 监控
- 索引
- 队列
- 资产
- 连接
- 业务规则
- 存储桶
- MCP 服务器
- Orchestrator 测试
- 资源目录服务
- 集成
- 故障排除
Orchestrator 用户指南
The Default Execution Identity feature reduces the setup required to run automations in a new Orchestrator tenant. Without this feature, deploying an automation to a new tenant typically fails with a "No unattended robot could be found" error because each folder requires a robot account and machine template before any job can run.
With Default Execution Identity, Orchestrator automatically provisions the required accounts and machines when a new tenant is registered, and applies a configurable default identity to every new root folder created in that tenant.
工作方式
Auto-provisioning on new tenant registration
When a new tenant is registered, Orchestrator automatically provisions:
- A default robot account with the Automation User role
- A Default Serverless machine template
This provisioning happens at tenant creation time and requires no admin intervention. Automations can run in a newly created tenant without any manual robot or machine setup.
Default Execution Identity tenant setting
Administrators can configure a Default Execution Identity in Tenant > Settings. The configuration specifies:
- One account, with the roles that account holds in each folder it is assigned to
- One machine template
- A flag controlling whether the assigned machine propagates to subfolders
At most one account and one machine can be specified in the configuration. A configuration referencing more than one account or more than one machine is rejected with a validation error.
Applying the identity to new root folders
When a new root folder is created, Orchestrator reads the Default Execution Identity configuration and automatically assigns the configured account and machine to that folder. Developers can deploy processes and run jobs immediately, without additional account or machine setup.
The default identity applies only to newly created root folders. Subfolders are not directly assigned; subfolder access follows the propagate-to-subfolders flag. Existing folders are not affected.
Scope and limitations
| 条件 | 行为 |
|---|---|
| New tenant registration | A default robot account (Automation User role) and a Default Serverless machine template are automatically provisioned |
| Existing tenants | Auto-provisioning does not apply retroactively. Administrators must configure the Default Execution Identity setting manually. |
| New root folders | The configured account and machine are automatically assigned at folder creation |
| Existing folders | Not affected by the Default Execution Identity setting |
| 子文件夹 | Not directly assigned. Access follows the propagate-to-subfolders flag. |
| Account limit | One account per Default Execution Identity configuration |
| Machine limit | One machine per Default Execution Identity configuration |
Cleanup behavior
When the account or machine referenced in the Default Execution Identity configuration is deleted, Orchestrator automatically removes that entry from the configuration. If the resulting configuration becomes empty, the apply-on-folder-creation path skips without raising an error.
If a referenced account or machine is missing at folder-creation time before the automatic cleanup runs, Orchestrator logs a warning and skips the assignment. Folder creation never fails because of a stale Default Execution Identity configuration.
Related task
To configure the Default Execution Identity setting, see Configure the Default Execution Identity.