Assigning Roles

Overview

The Assign roles tab of the Manage access page lets you search for users and groups that already exist at the organization level and configure permissions for them in Orchestrator.

Group configuration (roles, web login, robot settings) is passed on to any user that belongs to that group and is later added or auto-provisioned.

To assign roles

1. Go to Tenant > Manage access.

2. Above the table, on the right, click Assign roles and select User, Robot account, or Group.

   The Assign roles window opens.

3. Follow the applicable instructions, available below:

   a. Assigning roles to a group

   b. Assigning roles to a user

   c. Assigning roles to a robot account

Automatic assignment suggestion

When you assign a folder-level role, we check if you also have the corresponding tenant-level role. If you do not, you are automatically prompted to assign that as well. You can choose to assign the required role on the spot or to postpone the action for later.

Important:

• This works for all entities that can be assigned roles.

• It only applies to folder roles that are explicitly assigned, not inherited.

Known issue:

This option does not work for Active Directory users or groups.

Assigning groups to a tenant

If you assign roles to a group, these are inherited by all users and robot accounts that are part of that group.

Groups are created and maintained by organization administrators from the Admin > Accounts and Groups page.

1) General Details

1. In the Select a group field, type to search for an existing user group to which you want to assign roles.

   If needed, you can create a new group by clicking Add new to the right of the field.

2. Click the Roles field and then select the check box for each role you want to assign to the selected group.

   If needed, you can define a new role by clicking New role to the right of the field.

   If classic folders are inactive for your tenant, you can only assign Tenant roles and Mixed roles. If you want to also assign Folder roles to this group, you must do so from the Folders page or from the folder's Settings page.

3. Under Web Access, click the toggle to select if the group members can log in to the Orchestrator UI.
   Important: If this setting is enabled in at least one of the groups to which an account belongs (including the Everyone group), then setting it to disabled at the account level or for other groups has no effect for that particular account, only for other group members that are not in the same situation.
4. Under UI Profile settings, select the user interface profile for the members of this group.
5. If you want to also create an attended robot for group members, click Next.

   Otherwise, click Skip and assign to apply your settings. Skip the rest of the instructions in this section.

Permissions for Personal Workspace

1. When configuring an attended robot, you also have the option to create a personal workspaces for it. to set it to off (left position) if you do not want each user to have a Personal Workspace.
2. Click Assign.

The group is now visible on the Assign roles tab of the Manage access page and the members of the group benefit from the changes as soon as they log in or within the hour if they are already logged in.

Assigning accounts to a tenant

We recommend that you manage user access by assigning roles to groups and then adequately assigning users to the right groups to grant them the necessary roles.

However, if you need to perform a one-time role assignment for a particular user, you can directly assign roles to the user, as follows:

1) General Details

1. In the Select a user field, type to search for the user to whom you want to assign roles.

   If needed, you can add a new user to your organization by clicking Add new to the right of the field.

2. Click the Roles field and then select the check box for each role you want to assign to the selected user.

   If needed, you can define a new role by clicking New role to the right of the field.

   If classic folders are inactive for your tenant, you can only assign Tenant roles and Mixed roles. If you want to also assign Folder roles to this user, you must do so from the Folders page or from the folder's Settings page.

3. Under Web Access, click the toggle to select if the user can log in to Orchestrator by navigating directly to the Orchestrator URL.
   If this account is a member of any groups that have Web Access set to enabled, changing this setting for individual accounts has no effect because the group-level setting is inherited by all accounts. To control web access for individual accounts, you must either remove the account from groups with a conflicting setting, or remove the group with the conflicting setting from Orchestrator.
4. Under UI Profile settings, select the user interface profile for the user.
5. (Optional) Under Update policy settings, choose the release level to which you want this user to be required to update UiPath applications on their workstation. If you select a policy, the user will not be able to use UiPath Robot, Studio, or Assistant until they upgrade these applications to the version required by the policy. This setting can help you make sure that all your users are using the same versions.
6. If you want to also create an attended or unattended robot for this user, click Next.

   Otherwise, click Skip and assign to apply your settings. Skip the rest of the instructions in this section.

2a) Attended Robot

1. Under Attended Robot, set the first toggle to Enabled if you want to automatically create an attended robot for each group member.
2. Select the Enable a Personal Workspaces for this user if you want them to have a Personal Workspace.
3. If the user license management model is disabled, under License Type select a user license to assign to the user. What is my licensing model?
   If the user license management model is enabled, the License Type options are not available on this page.

   Note: Make sure that you also assign an attended user license - either at the group level, or to individual accounts - so that they can use the attended robot.

2b) Unattended Robot

1. Under Unattended Robot, click the toggle to set it to Enabled (right position) if you want to also create an unattended robot for the user.

   If this user does not require an unattended robot, click Next to review robot settings and continue with step 15 or click Skip and assign.

2. In the Domain\Username field, type the domain and username used to log on to the machine on which UiPath Robot is installed. The credentials must exist in the selected credential store.
   • For domain-joined users, use the domain\username syntax. For example deskover\localUser1.
   • For local Windows accounts, use the host_machine_name\username syntax, with the host machine's name instead of the domain. For example, LAPTOP1935\localUser2.
   • For local Windows accounts residing on multiple host machines, which you want to use regardless of machine, use the .\username syntax with a dot instead of the host machine name. For example .\localUser3.
   Note:

   The credentials you set must match the Windows account credentials for the machine on which this account can run automations.

   To get the account name, on the machine, open command prompt and use the `whoami` command.

3. In the Password field, enter the password for the above-mentioned account which is used to log on to the machine on which UiPath Robot is installed.
4. From the Credential Type list, select the type of credentials you provided above for the unattended robot.
5. (Optional) If you opted for a CyberArk® credential store, indicate the External Name. If not specified, the default value is used.
6. Under Concurrent execution, click the toggle to set it to Enabled (right position) if you want to only allow this robot to run one job at a time. If disabled, the user can simultaneously execute multiple jobs.
7. Click Next to review additional settings for the unattended robot.

   If you do not want to customize robot settings, click Skip and assign to apply your changes and skip the remaining instructions in this section.

3) Robot Settings

1. Configure execution settings for the UiPath Robot.

   For details about each setting, see Robot Settings.

2. Click Assign. The entity is created and displayed on the Manage Access page. One floating robot is created for each configured above per user.

Assigning multiple accounts

1. Go to Tenant > Manage access and click the Roles tab.
2. On the Roles page, select a role from the list and click More Actions > Manage Users.

   The Manage Users window is displayed and all users, groups, and robots are listed. If a checkbox is selected, that means the objects have this role assigned to them.

3. Select or clear the checkboxes as needed so that only those who should have this role are selected.
   
   

   

   
   
4. Click Update to apply your changes.

Changes to roles apply immediately when a user logs in, or automatically within one hour.

Checking Assigned Roles

To see what roles are assigned to a user or a group:

1. Go to Tenant > Manage access > Assign roles tab.
2. Click the Check roles & permissions above the table.

   The Check roles window opens.

3. In the Select a user field, type to search for the group or user whose roles you want to check. Optionally, filter the results by Users or Groups.
4. Select the group or user from the search results.

   You can see the user or group's roles at the tenant and folder level. You can also see whether the role has been explicitly assigned or inherited from a group they are in.

   
   

   

   
   

   Important: If you are using an Azure AD guest user account, the role information that is displayed may not be accurate.

Activating or deactivating a user

Note: Only users with administrative privileges can perform this operation. Orchestrator access is revoked for deactivated users.

1. Go to Tenant > Manage access > Assign roles tab.

2. Select the user you want to remove the access for, click More Actions , and select Activate or Deactivate.

   The user entity is updated on the Users page.

Removing a user or group

Removing a user or group from Orchestrator does not delete the account from your organization.

1. Go to Tenant > Manage access > Assign roles tab.
2. Select the user or group, click More Actions , and select Remove.

   If the user whose role you want to delete has a robot that is currently busy, you are informed that any running jobs will be deleted, and are asked whether you want to proceed with the deletion or cancel the operation.

3. Confirm the operation.

The user or group is removed from Orchestrator and all roles are revoked.

Alternatively, select one or multiple users, and click the Remove button.

Important:

• You cannot remove a user having the Administrator role.
• You cannot remove or unassign users part of mappings that are employed in triggers from the folder the trigger resides in. Make sure the user is not set as an execution target in a trigger so you can delete them.
• Removing a directory group does not remove the license of an associated directory user, even if the group removal unassigns the user from any folder. The only way to release the license is to close UiPath Assistant.

Troubleshooting

The Not Found error

If an account was removed from the organization, when attempting to edit, enable/disable, or remove the account from Orchestrator (Tenant > Manage Access), a Not found (#1002) error is displayed.

In this case, the account in fact no longer exists and no longer has access to the UiPath products.