- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read-only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read-only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- Audit
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Test Suite - Orchestrator
- Host administration
- Identity Server
- Authentication
- Organization administration
- Other Configurations
- Integrations
- Classic Robots
- Troubleshooting
Managing Access and Automation Capabilities
The level of access and the actions that your users can perform is controlled using two elements:
- accounts, which establish the identity of a user and are used to log in to your UiPath applications
- roles, which are assigned to accounts in order to grant them certain permissions within the UiPath ecosystem.
Accounts are created and managed by organization administrators, as described in Accounts and groups.
Accounts must already exist to be able to assign roles to them.
This page, and the following pages, describe:
- how to manage roles
- how to manage automation capabilities, which are configured as part of role setup.
Orchestrator uses an access-control mechanism based on roles and permissions. Roles are collections of permissions meaning that the permissions needed to use certain Orchestrator features are included in roles.
For example, here's a custom role where you can see some of the permissions it includes:
There are two categories of permissions:
- Tenant permissions - Define a user's access to resources at the tenant level.
- Folder permissions - Define the user's access and ability within each folder to which they are assigned.
Based on the permissions they include, there are three types of roles:
- Tenant roles, which include tenant permissions and are required for working at the tenant level.
- Folder roles, which include permissions for working within a folder.
-
Mixed roles, which include both types of permissions.
With mixed roles, for a global operation, only the user's tenant permissions are taken into consideration; for a folder-specific operation, if a custom role is defined, folder permissions are applied in favor of any tenant permissions present.
Note: Mixed roles are no longer supported and you cannot create new ones. If you have mixed roles, we recommend replacing them with a combination of tenant and folder roles to grant the required permissions.
The following resources are available to users, depending on the type of roles they have:
Tenant Resources |
Folder Resources |
---|---|
|
|
UiPath.Orchestrator.dll.config
.
The type of role is important because you assign roles differently based on their type, and it also depends if classic folders are enabled:
-
If Activate Classic Folders is cleared under Tenant > Settings > General:
- You assign Tenant roles and Mixed roles from either the Assign roles tab or from the Roles tab of the Tenant > Manage Access page.
- You assign Folder roles and Mixed roles from the Folders page or from the folder's Settings page.
-
If Activate Classic Folders is selected under Tenant > Settings > General:
- You assign any of the three types of roles from either the Assign roles tab or from the Roles tab of the Tenant > Manage Access page.
- You assign Folder roles and Mixed roles from the Folders page or from the folder's Settings page.
Typically you can select all available rights (View,Edit,Create, or Delete) for any permission, but the following rights have no effect for the listed permission, and therefore you cannot edit them:
Permission type |
Permission |
Unavailable rights |
---|---|---|
Tenant |
Alerts |
|
Audit |
| |
Folder |
Execution Media |
|
Logs |
| |
Monitoring |
|
This is because, for example, it is not possible to edit system-generated logs.
By default, after 10 failed login attempts, you are locked out for 5 minutes.
System administrators can customize the Account Lockout settings from the host Management portal.
To be able to perform various operations on the Users and Roles pages, you need to be granted the corresponding permissions:
- Users - View - Displaying the Users and Profile pages.
- Users - Edit - Editing user details and settings on the Profile page, and activating/deactivating users on the Users page.
- Users - View and Roles - View - Displaying user permissions in the User Permissions window.
- Users - Edit and Roles - View - Editing role assignments on the Manage Access > Assign Roles page.
- Users - Create and Roles - View - Creating a user.
- Users - View and Roles - Edit - Managing roles in the Manage Users window, opened from the Manage Access > Roles page.
- Users - Delete - Removing a user from Orchestrator.