Assigning credential stores to folders

Assign a credential store to specific folders in Orchestrator, and limit a store so that only the folders you assign can use it.

These procedures cover assigning a credential store to folders, limiting a store to the folders you assign, and reversing both. For how folder access works, including inheritance and where it applies, see Credential store folder access.

Voraussetzungen

To assign a credential store to folders, you need both of the following permissions:

• Edit on Settings, on a tenant role. This is required for every assignment, whichever folders are involved.
• Edit rights on the folders themselves, through either:
  • Edit on Folders, on a tenant role, which covers all folders; or
  • Edit on Subfolders, on a folder role, in each folder you assign the store to or remove it from.

Folder rights alone are not enough: a folder administrator without Edit on Settings at tenant level cannot assign a store to their own folder.

Assigning a store to folders from the Stores page

1. At tenant level, select Credentials > Stores.
2. From the More Actions menu of the store, select Manage in folders.
3. Select the folders that need the store, and clear the ones that no longer do. Subfolders of a selected folder inherit the store, so you do not need to select them.
4. Select Update, then confirm.

All the folders you added and removed are applied together.

If the store is still set to All folders, Orchestrator shows a notice that the folders you link have no effect yet. The assignments are saved and apply as soon as you set the store to Selected folders only.

Limiting a store to selected folders

Assign the folders before you change the mode. A store switched to Selected folders only stops working in every folder it is not yet assigned to, which interrupts any automation using it.

1. Assign the store to every folder that uses it, as described above. Do not change the mode yet.
2. From the More Actions menu of the store, select Edit.
3. Under Folder access, select Selected folders only.
4. Select Update. Orchestrator lists the resources that lose access and asks you to confirm.
5. Review the list.
   1. If the list is empty or contains only resources you intend to cut off, continue to step 6.
   2. Otherwise, cancel the change, assign the missing folders, and restart from step 1.
6. Select Enable restriction.

The store is now usable only in the folders it is assigned to, and in their subfolders.

Hinweis:

The built-in Orchestrator Database store has no other editable properties, but it can be edited to change its Folder access.

Assigning a store from a folder

1. Select the folder, then select Credential stores.
2. Select Manage Credential Stores in Folder.
3. Select the stores the folder needs, then select Update.

The Access origin column of the folder's list shows Assigned for each store you added.

Unassigning a store from a folder

1. Select the folder, then select Credential stores.
2. Remove the stores:
   1. To unassign a single store, from the More Actions menu of the store, select Unassign.
   2. To unassign several stores at once, select them in the list, then select Remove from folder.
3. Bestätigen Sie das Entfernen.

You can only unassign a store that is assigned directly to this folder, and Unassign is offered only for those stores. A store the folder reaches by inheritance cannot be removed here — either because it is assigned to a parent folder, or because it is available to the whole tenant. To remove an inherited store, unassign it at the parent folder that holds the assignment, or change the store's Folder access.

Making a store available to all folders again

1. At tenant level, select Credentials > Stores.
2. From the More Actions menu of the store, select Edit.
3. Under Folder access, select All folders.
4. Wählen Sie Aktualisieren.

Every folder in the tenant can use the store again. The folders you assigned are kept, so the same folders apply if you set Folder access back to Selected folders only later.