Configuring Account-machine Mappings

When starting a job or configuring a trigger, administrators can define specific account-machine pairs for execution. The account-machine mappings feature enables you to tie unattended usage under particular accounts to specific machine templates. This allows you to configure specific account-machine pairs as the only valid targets for execution and gives granular control over the execution targets of your automation, by restricting users to executing automations on machines on which they log in.

Account-machine mappings can be tenant-based (not tied to a specific folder), or folder-based (tied to a specific folder).

Configuring Mappings at the Tenant Level

Note: You need View on Machines, Edit on Machines OR View on Machines, Create on Machines to change account-machine mappings at the tenant level.

Click Add a new machine or Edit Machine to create a new machine template or edit an existing one.
Configure general details.
Click the Account-Machine Mappings tab.
Select the mapping strategy:
- Any account can use this machine - No specific mappings in place.
- Specific accounts only can be assigned to this machine - Configure specific account-machine pairs on which execution is allowed.
For a specific mapping strategy, select the accounts for whom execution is allowed on the machine in question. You can create a more granular subset of allowed account-machine pairs on a per-folder basis.

See how to configure account-machine pairs for a folder

Accounts are depicted on the Account-Machine Mappings page using the Windows credentials (Domain\Username) of their unattended robot if one has been created.

All changes made to tenant mappings are reflected at a folder level as follows:

Inherit from tenant - all account configuration changes made for tenant mappings are reflected at a folder level, adding or removing accounts to tenant mappings adds/removes them from folder mappings as well.
Specific acount-machine mappings for this folder - adding an account to tenant mappings does not make them available for folder mappings; the account is excluded from folder mappings. Removing an account from tenant mappings removes them at the folder level as well.

Configuring Mappings at the Folder Level

Note: You need Edit permissions on Folders OR Edit on Subfolders to change account-machine mappings at the folder level.

Note: You cannot configure account-machine mappings for propagated machines.

You can configure account-machine mappings on a per-folder basis, meaning that, in a particular folder, on a machine template, you can limit the execution to specific accounts only. The resulting account-machine mappings then become the only supported pairs for execution in that folder.

Folder mappings act as subsets of template mappings and allow you to achieve the utmost level of granularity possible. Not providing folder-level mappings leaves template-level mappings in place as the defaults.

Important:

Accounts added to a folder after account-machine mappings have been configured are not added to the existing mappings; hence, they will not be able to use that machine. Make sure to manually map the accounts to the machines in order to use it.
Accounts part of mappings that are employed in triggers cannot be deleted or unassigned from the folder the trigger resides in. Make sure the account is not set as an execution target in a trigger so you can delete them.

Enabling/disabling Account-machine Mappings

At the tenant level, navigate to Settings > General.
In the Modern Folders section, enable/disable the corresponding toggle.

Note: Upon disabling the Account-Machine Mappings feature, existing account-machine mappings will be kept when running jobs, even if the mappings are not visible in the UI.