Skip to main content

Assign a Role to a User

Goal​

Grant a user a role (or remove one) so the user's access matches what the role allows.

Prerequisites​

  • You are signed in to the Admin Control Center as a platform administrator.
  • The user already exists (see Create a User).
  • The role already exists (see Create a Role).

Steps​

  1. Open the Users page from the left navigation.
  2. Find the user's row in the users table. The Roles column names what they already hold — up to three, then a count.
  3. Tick the row and select Manage roles on the toolbar. (You can also reach it from inside a user's edit panel, which is where you already are if you opened them to change something else.)
  4. The panel lists every role in the tenant, with the ones this user holds already ticked. Tick to grant, untick to remove. Use the search box to narrow a long list — it matches a role's name and its description.
  5. Select Save.

Nothing is written until you press Save, so a panel opened by mistake costs nothing: Cancel leaves the user exactly as they were.

The user must sign out and back in

A role you grant here does not reach a session that is already open. The user's access is carried by the token they were given when they signed in, so tell them to sign out and sign in again — until they do, the new role changes nothing for them: screens stay hidden, and tasks offered to that role do not appear in their task list.

This applies to removing a role too. If somebody must lose access immediately rather than at their next sign-in, disable the user instead.

What happens behind the scenes​

The role assignment is stored against the user. The next time the user signs in, their access token carries the updated roles, so role-restricted screens and actions reflect the change.

A role reaching somebody through a team behaves differently, and it is worth knowing which you are doing. A team's roles are worked out inside the environment each time it is asked, so adding a person to a team takes effect on their very next action with no sign-out. A role granted here reaches them through their token, which is only reissued when they sign in. If you need a change to take hold immediately, granting it to a team they are in is the way that does.

Troubleshooting​

  • Manage roles is greyed out — it acts on one person at a time, so tick exactly one row.
  • The role is not in the list — it does not exist yet; create it first.
  • A ticked role I do not recognise — the user holds a role the tenant no longer defines. It is listed first, ticked, so you can take it off; leaving it ticked keeps it.
  • "Role … was not found." — the role was deleted after the page loaded. Refresh the page.
  • I granted the role and nothing changed for them — they are still signed in on the token they had before. Ask them to sign out and sign in again. This is the usual reason a person's task list stays empty after being given the role a process assigns work to.
  • Create a user.
  • Create a role.