Default Execution Identity

The Default Execution Identity feature reduces the setup required to run automations in a new Orchestrator tenant. Without this feature, deploying an automation to a new tenant typically fails with a "No unattended robot could be found" error because each folder requires a robot account and machine template before any job can run.

With Default Execution Identity, Orchestrator automatically provisions the required accounts and machines when a new tenant is registered, and applies a configurable default identity to every new root folder created in that tenant.

Wie es funktioniert

Auto-provisioning on new tenant registration

When a new tenant is registered, Orchestrator automatically provisions:

• A default robot account with the Automation User role
• A Default Serverless machine template

This provisioning happens at tenant creation time and requires no admin intervention. Automations can run in a newly created tenant without any manual robot or machine setup.

Default Execution Identity tenant setting

Administrators can configure a Default Execution Identity in Tenant > Settings. The configuration specifies:

• One account, with the roles that account holds in each folder it is assigned to
• One machine template
• A flag controlling whether the assigned machine propagates to subfolders

At most one account and one machine can be specified in the configuration. A configuration referencing more than one account or more than one machine is rejected with a validation error.

Applying the identity to new root folders

When a new root folder is created, Orchestrator reads the Default Execution Identity configuration and automatically assigns the configured account and machine to that folder. Developers can deploy processes and run jobs immediately, without additional account or machine setup.

The default identity applies only to newly created root folders. Subfolders are not directly assigned; subfolder access follows the propagate-to-subfolders flag. Existing folders are not affected.

Scope and limitations

Bedingung	Verhalten
New tenant registration	A default robot account (Automation User role) and a Default Serverless machine template are automatically provisioned
Existing tenants	Auto-provisioning does not apply retroactively. Administrators must configure the Default Execution Identity setting manually.
New root folders	The configured account and machine are automatically assigned at folder creation
Existing folders	Not affected by the Default Execution Identity setting
Unterordner	Not directly assigned. Access follows the propagate-to-subfolders flag.
Account limit	One account per Default Execution Identity configuration
Machine limit	One machine per Default Execution Identity configuration

Cleanup behavior

When the account or machine referenced in the Default Execution Identity configuration is deleted, Orchestrator automatically removes that entry from the configuration. If the resulting configuration becomes empty, the apply-on-folder-creation path skips without raising an error.

If a referenced account or machine is missing at folder-creation time before the automatic cleanup runs, Orchestrator logs a warning and skips the assignment. Folder creation never fails because of a stale Default Execution Identity configuration.

Related task

To configure the Default Execution Identity setting, see Configure the Default Execution Identity.