Subscribe

UiPath Orchestrator

The UiPath Orchestrator Guide

Assigning Roles

The Assign roles tab of the Manage access page lets you search for users and groups that already exist at the organization level and configure permissions for them in Orchestrator.
Group configuration (roles, web login, robot settings) is passed on to any user that belongs to that group and is later added or auto-provisioned.

On the Manage access page, click Assign roles, and select User or Group. The Assign roles window opens.

Assigning roles to a group


If you assign roles to a group, those roles are inherited by all users who are part of that group.

Groups are created and maintained by organization administrators from the Admin > Accounts and Groups page in Automation Cloud.

1) General Details

  1. In the Select a group field, type to search for an existing user group to which you want to assign roles.
    If needed, you can create a new group by clicking Add new to the right of the field, but you must be an organization administrator in Automation Cloud to create or edit groups.
  2. Click the Roles field and then select the check box for each role you want to assign to the selected group.
    If needed, you can define a new role by clicking New role to the right of the field.
    If classic folders are inactive for your tenant, you can only assign Tenant roles and Mixed roles. If you want to also assign Folder roles to this group, you must do so from the Folders page or from the folder's Settings page.
  3. Under Web Access, click the toggle to select if the group members can log in to the Orchestrator UI.
    If this setting is enabled in at least one of the groups to which an account belongs (including the Everyone group), then setting it to disabled at the account level or for other groups has no effect for that particular account, only for other group members that are not in the same situation.
  4. Under UI Profile, select the user interface profile for the members of this group.
  1. If you want to also create an attended robot for group members, click Next.
    Otherwise, click Skip and assign to apply your settings. Skip the rest of the instructions in this section.

2) Robot Setup

  1. Under Attended Robot, set the first toggle to Enabled if you want to automatically create an attended robot for each group member.
    For groups, the default robot settings apply. If you want to customize robot settings, you have to make the adjustments explicitly for each user after you finish this process.

📘

Note:

Make sure that you also assign an attended user license - either at the group level, or to individual users - so that they can use the attended robot.

  1. Click the second toggle Automatically create Personal Workspaces for members of this group to set it to off (left position) if you do not want each user to have a Personal Workspace.
  2. Click Assign.

The group is now visible on the Assign roles tab of the Manage access page and the members of the group benefit from the changes as soon as they log in or within the hour if they are already logged in.

Assigning roles to a user


We recommend that you maintain user access by assigning roles to groups and then adequately assigning users to the right groups to grant them the roles they need.
However, if you need to perform a one-time role assignment for a specific user, you can assign roles to the user directly, as described below.

1) General Details

  1. In the Select a user field, type to search for the user to whom you want to assign roles.
    If needed, you can add a new user to your organization by clicking Add new to the right of the field. You must be an organization administrator in Automation Cloud to be able to add a new user.
  2. Click the Roles field and then select the check box for each role you want to assign to the selected user.
    If needed, you can define a new role by clicking New role to the right of the field.
    If classic folders are inactive for your tenant, you can only assign Tenant roles and Mixed roles. If you want to also assign Folder roles to this user, you must do so from the Folders page or from the folder's Settings page.
  3. Under Web Access, click the toggle to select if the user can log in to Orchestrator by navigating directly to the Orchestrator URL.
    If this account is a member of any groups that have Web Access set to enabled, changing this setting for individual accounts has no effect because the group-level setting is inherited by all accounts. To control web access for individual accounts, you must either remove the account from groups with a conflicting setting, or remove the group with the conflicting setting from Orchestrator.
  4. Under UI Profile, select the user interface profile for the user.
  1. If you want to also create an attended or unattended robot for this user, click Next.
    Otherwise, click Skip and assign to apply your settings. Skip the rest of the instructions in this section.

2a) Attended Robot

  1. Under Attended Robot, set the first toggle to Enabled if you want to automatically create an attended robot for each group member.

📘

Note:

Make sure that you also assign an attended user license - either at the group level, or to individual users - so that they can use the attended robot.

  1. Click the second toggle Automatically create Personal Workspaces for members of this group to set it to off (left position) if you do not want each user to have a Personal Workspace.

2b) Unattended Robot

  1. Under Unattended Robot, click the toggle to set it to Enabled (right position) if you want to also create an unattended robot for the user.
    If this user does not require an unattended robot, click Next to review robot settings and continue with step 15 or click Skip and assign to apply your changes and skip the rest of the instructions in this section.
  2. In the Domain\Username field, type the domain and username used to log on to the machine on which UiPath Robot is installed. The credentials must exist in the selected credential store.
  • For domain-joined users, use the domain\username syntax. For example deskover\localUser1.
  • For local Windows accounts, use the host_machine_name\username syntax, with the host machine's name instead of the domain. For example, LAPTOP1935\localUser2.
  • For local Windows accounts residing on multiple host machines, which you want to use regardless of machine, use the .\username syntax with a dot instead of the host machine name. For example .\localUser3.
  1. In the Password field, enter the password for the above-mentioned account which is used to log on to the machine on which UiPath Robot is installed.
  2. From the Credential Type list, select the type of credentials you provided above for the unattended robot.
  3. Optional: If you opted for a CyberArk® credential store, indicate the External Name. If not specified, the default value is used.
  4. Under Concurrent execution, click the toggle to set it to Enabled (right position) if you want to only allow this robot to run one job at a time. If disabled, the user can simultaneously execute multiple jobs.
  5. Click Next to review additional settings for the unattended robot.
    If you do not want to customize robot settings, click Skip and assign to apply your changes and skip the remaining instructions in this section.

3) Robot Settings

  1. Configure execution settings for the UiPath Robot.
    For details about each setting, see Robot Settings.
  2. Click Assign. The entity is created and displayed on the Manage Access page. One floating robot is created for each configured above per user.

Checking roles


To see what roles are assigned to a user or a group:

  1. Go to Tenant > Manage access > Assign roles tab.
  2. Click the Check roles & permissions above the table.
    The Check roles window opens.
  3. In the Select a user field, type to search for the group or user whose roles you want to check. Optionally, filter the results by Users or Groups.
  4. Select the group or user from the search results.
    You can see the user or group's roles at the tenant and folder level. You can also see whether the role has been explicitly assigned or inherited from a group they are in.

Editing roles


  1. Go to Tenant > Manage access > Assign roles tab.
  2. At the right end of the row, click More Actions and select Edit.
  3. Make changes as needed.
  4. When finished, click Update to apply your changes.

Activating or deactivating an account


Deactivated users can no longer access Orchestrator.

📘

Note

Only users with the Administrator role can perform this operation.

  1. Go to Tenant > Manage access > Assign roles tab.
  2. At the right end of the row, click More Actions and select Activate or Deactivate.
    The user entity is updated on the Assign roles page.

Removing an account or group


Removing a user or group from Orchestrator does not delete the account from your organization.

  1. Go to Tenant > Manage access > Assign roles tab.
  2. At the right end of the row, click More Actions and select Remove.
  3. Confirm the operation.

The account or group is removed from Orchestrator and all roles are revoked.

Alternatively, select one or multiple accounts, and click Remove.

🚧

Important

Removing a directory group does not remove the license of an associated directory user, even if the group removal unassigns the user from any folder. The only way to release the license is to close UiPath Assistant on the user's machine.

🚧

Important!

For accounts that are part of mappings which are employed in triggers, you cannot delete them or unassign them from the folder where the trigger resides. Make sure the account is not set as an execution target in a trigger so you can delete them.

Updated about a month ago


Assigning Roles


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.