Subscribe

UiPath Orchestrator

The UiPath Orchestrator Guide

Managing roles

You can manage all your roles on the the Tenant > Manage Access page.
This includes viewing the permissions they include and changing them, adding new roles, removing roles, as well as assigning or removing users or groups from roles.

About roles


Orchestrator uses an access-control mechanism based on roles and permissions. Roles are collections of permissions meaning that the permissions needed to use certain Orchestrator features are included in roles.

For example, here's a custom role where you can see some of the permissions it includes:

970970

 

Permission types and role types


There are two categories of permissions:

  • Tenant permissions - Define a user's access to resources at the tenant level.
  • Folder permissions - Define the user's access and ability within each folder to which they are assigned.

Based on the permissions they include, there are three types of roles:

  • Tenant roles, which include tenant permissions and are required for working at the tenant level.
  • Folder roles, which include permissions for working within a folder.
  • Mixed roles, which include both types of permissions.
    With mixed roles, for a global operation, only the user's tenant permissions are taken into consideration; for a folder-specific operation, if a custom role is defined, folder permissions are applied in favor of any tenant permissions present.

📘

Note:

Mixed roles are no longer supported and you cannot create new ones. If you have mixed roles, we recommend replacing them with a combination of tenant and folder roles to grant the required permissions.

The following resources are available to users, depending on the type of roles they have:

Tenant Resources

Folder Resources

Alerts
Audit
Background tasks
Libraries
License
Machines
ML Logs
Packages
Robots
Roles
Settings
Folders
Users
Webhooks

Assets
Storage Files
Storage Buckets
Connections
Environments
Execution Media
Folder Packages
Jobs
Logs
Monitoring
Processes
Queues
Triggers
Subfolders
Action Assignment
Action Catalogs
Actions
Test Case Execution Artifacts
Test Data Queue Items
Test Data Queues
Test Set Executions
Test Sets
Test Set Schedules
Transactions

You have the possibility to disable permissions completely from the user interface and API using the Auth.DisabledPermissions parameter in UiPath.Orchestrator.dll.config.

Assigning the different types of roles

The type of role is important because you assign roles differently based on their type, and it also depends if classic folders are enabled:

  • If Activate Classic Folders is cleared under Tenant > Settings > General:
    • You assign Tenant roles and Mixed roles from either the Assign roles tab or from the Roles tab of the Tenant > Manage Access page.
    • You assign Folder roles and Mixed roles from the Folders page or from the folder's Settings page.
  • If Activate Classic Folders is selected under Tenant > Settings > General:
    • You assign any of the three types of roles from either the Assign roles tab or from the Roles tab of the Tenant > Manage Access page.
    • You assign Folder roles and Mixed roles from the Folders page or from the folder's Settings page.

Permissions without effect

Typically you can select all available rights (View, Edit, Create, or Delete) for any permission, but the following rights have no effect for the listed permission, and therefore you cannot edit them:

Permission type

Permission

Unavailable rights

Tenant

Alerts

Delete

Audit

Edit
Create
Delete

License

only:
Edit
Create
Delete

Folder

Execution Media

Edit

Logs

Edit
Delete

Monitoring

Create
Delete

This is because, for example, it is not possible to edit system-generated logs.

 

Creating a role


When creating a role, you can start from scratch and create a custom role, or you have the option to import a role.

Creating a custom role

  1. Go to Tenant > Manage access and select the Roles tab.
  2. Click Add a new role and select if you want to add a new tenant or folder role.
    A form opens with all the permissions available for the type of role you selected.
  3. Make sure that the Add new option is selected at the top.
    The Import option is for when you want to import a role and use it as a base to create your new role.
  4. In the Name field, type a representative name for the role, such as Action Center Superuser.
  5. Select the check boxes for the permissions you want to include in the new role:
994994

The checkboxes for permissions that have no effect cannot be selected.

  1. Click Create.

The role is now available and you can add one or multiple users who need the set of permissions that this role provides by following the instructions below.

Importing a role

You can base a new role on a role you already have, even if the base role is in a different organization or tenant. If you export the base role, you can import it to any tenant and, if needed, customize it.

  1. Go to Tenant > Manage access and select the Roles tab.
  2. If not already done, export the role that you want to use as a base.
    Note if the exported role is a tenant or a folder role.
  3. Click Add a new role and select if you want to add a new tenant or folder role.
    Make sure you choose the correct type, according to the type of the role you want to import.
  4. At the top of the page, select the Import option:
794794
  1. Upload the CSV file obtained from exporting the base role.
    If the base role included permissions without effect that were selected, the message Uploaded role contains unapplicable permissions. Only applicable permissions are selected. appears along the top. This indicates that, although selected in the base role, these permissions have been deselected following import because we no longer allow selecting these types of permissions.

    The information of the imported role is displayed on the page. All permissions that the exported role included are selected.

10221022
  1. Optional:
    a. edit the name to use for the new role being created and
    b. select or deselect checkboxes to make changes to the permissions.
  2. When finished, click Create.
  3. If the role includes elevated permissions (for example, Users - Create), a notification appears. Click OK to create the new role.

The new role is now available on the Roles page and you can assign it to accounts or groups as needed.

Assigning a role to multiple accounts


📘

Note:

These instructions are for assigning tenant roles.
If you need to assign a folder role, you can:

  • go to Tenant > Folders and then select the folder where you want to assign the role
  • select the folder in the left pane to switch to folder context and then go to the Settings page for that folder.
  1. Go to Tenant > Manage access and select the Roles tab.
  2. On the Roles page, click More Actions at the right end of the row and select Manage Users.
    The Manage Users window is displayed and all users, groups, and robots are listed. If the checkbox on the left is selected, that means they have this role assigned to them.
  3. Select or clear the checkboxes as needed so that only those who should have this role are selected.
677677
  1. Click Update to apply your changes.

Changes to roles apply immediately when a user logs in, or automatically within one hour.

Editing a role


  1. Go to Tenant > Manage access and select the Roles tab.
  2. Click More Actions at the right end of the row and select Edit.
    You cannot edit default roles, so there is no Edit option for these. If you need a custom version of a default role, select Duplicate & Customize instead (not available for mixed roles).
  3. Change the permissions as needed.
  4. Click Update.

Changes to roles apply immediately when a user logs in, or within one hour if the user is already logged in.

Removing a role


You cannot remove any of the default roles, you can only remove custom roles.

🚧

Removing a role also removes it from any user that had it assigned. Users with no roles assigned cannot access any resource.

  1. Go to Tenant > Manage access and select the Roles tab.
  2. Click More Actions at the right end of the row and select Manage Users.
  3. Review the users who has this role assigned and make sure you reassign them to a different or similar role if needed before deleting the role.
  4. Click More Actions at the right end of the row and select Remove.

Exporting a role


If you want to recreate a particular role in a different organization or tenant, you can export the role as a CSV file and then import it in the target Orchestrator tenant.

To export a role as a CSV file:

  1. Go to Tenant > Manage access and select the Roles tab.
  2. Click More Actions at the right end of the row and select Export.
    You cannot export mixed roles because we do not allow creating new mixed roles.
    A download begins for a CSV file which contains the role definition.
  3. Save the file locally.

You can now use this file to import the role into any Orchestrator tenant.

🚧

Do not edit the CSV file

The CSV file is intended to be used strictly for importing back into Orchestrator in the form in which it was exported. Editing the file in any way can result in import errors.
If you need to make changes to the exported role, you have the option to do so during the import process.

Updated 4 months ago


Managing roles


You can manage all your roles on the the Tenant > Manage Access page.
This includes viewing the permissions they include and changing them, adding new roles, removing roles, as well as assigning or removing users or groups from roles.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.