# Assigning credential stores to folders

> Assign a credential store to specific folders in Orchestrator, and limit a store so that only the folders you assign can use it.

These procedures cover assigning a credential store to folders, limiting a store to the folders you assign, and reversing both. For how folder access works, including inheritance and where it applies, see [Credential store folder access](https://docs.uipath.com/orchestrator/automation-cloud/latest/user-guide/credential-store-folder-access).

## Prerequisites

To assign a credential store to folders, you need both of the following permissions:

* **Edit** on **Settings**, on a tenant role. This is required for every assignment, whichever folders are involved.
* Edit rights on the folders themselves, through either:
  * **Edit** on **Folders**, on a tenant role, which covers all folders; or
  * **Edit** on **Subfolders**, on a folder role, in each folder you assign the store to or remove it from.

Folder rights alone are not enough: a folder administrator without **Edit** on **Settings** at tenant level cannot assign a store to their own folder.

## Assigning a store to folders from the Stores page

1. At tenant level, select **Credentials** > **Stores**.
2. From the **More Actions** menu of the store, select **Manage in folders**.
3. Select the folders that need the store, and clear the ones that no longer do. Subfolders of a selected folder inherit the store, so you do not need to select them.
4. Select **Update**, then confirm.

All the folders you added and removed are applied together.

If the store is still set to **All folders**, Orchestrator shows a notice that the folders you link have no effect yet. The assignments are saved and apply as soon as you set the store to **Selected folders only**.

## Limiting a store to selected folders

Assign the folders before you change the mode. A store switched to **Selected folders only** stops working in every folder it is not yet assigned to, which interrupts any automation using it.

1. Assign the store to every folder that uses it, as described above. Do not change the mode yet.
2. From the **More Actions** menu of the store, select **Edit**.
3. Under **Folder access**, select **Selected folders only**.
4. Select **Update**. Orchestrator lists the resources that lose access and asks you to confirm.
5. Review the list.
   1. If the list is empty or contains only resources you intend to cut off, continue to step 6.
   2. Otherwise, cancel the change, assign the missing folders, and restart from step 1.
6. Select **Enable restriction**.

The store is now usable only in the folders it is assigned to, and in their subfolders.

:::note
The built-in **Orchestrator Database** store has no other editable properties, but it can be edited to change its **Folder access**.
:::

## Assigning a store from a folder

1. Select the folder, then select **Credential stores**.
2. Select **Manage Credential Stores in Folder**.
3. Select the stores the folder needs, then select **Update**.

The **Access origin** column of the folder's list shows **Assigned** for each store you added.

## Unassigning a store from a folder

1. Select the folder, then select **Credential stores**.
2. Remove the stores:
   1. To unassign a single store, from the **More Actions** menu of the store, select **Unassign**.
   2. To unassign several stores at once, select them in the list, then select **Remove from folder**.
3. Confirm the removal.

You can only unassign a store that is assigned directly to this folder, and **Unassign** is offered only for those stores. A store the folder reaches by inheritance cannot be removed here — either because it is assigned to a parent folder, or because it is available to the whole tenant. To remove an inherited store, unassign it at the parent folder that holds the assignment, or change the store's **Folder access**.

## Making a store available to all folders again

1. At tenant level, select **Credentials** > **Stores**.
2. From the **More Actions** menu of the store, select **Edit**.
3. Under **Folder access**, select **All folders**.
4. Select **Update**.

Every folder in the tenant can use the store again. The folders you assigned are kept, so the same folders apply if you set **Folder access** back to **Selected folders only** later.