Orchestrator uses an access-control mechanism based on roles and permissions. Roles are collections of permissions meaning that the permissions needed to use certain Orchestrator entities are assigned to roles.

Role-permissions and user-roles relationships allow for a certain level of access to Orchestrator. A user gets the permissions required to perform particular operations through one or multiple roles. Since users are not assigned permissions directly, but only acquire them through roles, management of access rights involves assigning appropriate roles to the user. See Modifying the Roles of a User.

📘

Important!

Users without a role cannot access any resource.

There are two categories of permissions when defining roles:

• Tenant Permissions - Define a user's access to resources at the tenant level.
• Folder Permissions - Define the user's access and ability within each folder they are assigned to.

📘

Note:

For a global operation, only the user's permissions set at tenant level are taken into consideration. For a folder specific operation, if a custom role is defined those permissions are applied in favor of any tenant level permissions present.

You have the possibility to disable permissions completely from the user interface and API using the Auth.DisabledPermissions parameter in web.config. More details here.

Permissions Without Effect

The Orchestrator interface enables the selection of all applicable rights (View, Edit, Create, Delete) for all listed permissions, but please note that not all rights are applicable to each listed permission:

Default Roles

By default, the following roles exist in Orchestrator:

See the Default Roles page for the permissions specific to each role.

Default Roles for Folders

For all users, Orchestrator automatically creates the following roles:

Note that the associated permissions for these roles may change between versions as new features and integrations are added. When this occurs, the affected role(s) appear red in your Tenant Settings page. Click on the affected role(s) to display a prompt enabling you to add the missing permissions for this role.