- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read only)
- Storing Unattended Robot Credentials in AWS Secrets Manager (read only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- SmartCard Authentication
- Account types
- Default roles
- Managing custom roles
- Configuring access for accounts
- Configuring automation capabilities
- Audit
- Settings - Tenant Level
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Test Suite - Orchestrator
- Other Configurations
- Integrations
- Host administration
- Organization administration
- Troubleshooting
Configuring access for accounts
As an administrator, you can configure fine-grained tenant or folder permissions for objects that already exist at the organization level (i.e. groups, users, robot accounts, external apps), via Orchestrator, by assigning them to tenants or folders in Orchestrator. An object gets the permissions required to perform particular operations in a tenant or folder through one or more roles.
You can use groups to simplify access control, as groups allow you to manage objects with similar needs together.
- assign to a tenant any objects that already exist at the organization level
- configure permissions for objects in Orchestrator
- remove tenant access from the existing objects
Group configuration (roles, web login, robot settings) is passed on to any user that belongs to that group and is later added or auto-provisioned.
In a tenant, when assigning groups and adding roles to it, note that these are inherited by all users and robot accounts that are part of that group.
Groups are created and maintained by organization administrators from the Admin > Accounts and Groups page.
We recommend that you manage user access by assigning roles to groups and then adequately assigning users to the right groups to grant them the necessary roles.
However, if you need to perform a one-time role assignment for a particular user, you can directly provide access to the user, as follows:
We recommend that you manage robot access by assigning roles to groups and then adequately assigning robot accounts to the right groups to grant them the necessary roles.
However, if you need to perform a one-time role assignment for a particular robot account, you can directly grant access to the robot, as follows:
As an administrator, you can configure fine-grained tenant or folder permissions for confidential apps, by assigning them to folders or tenants in Orchestrator. An external app gets the permissions required to perform particular operations in a folder or tenant through one or more roles.
Changes to roles apply immediately when a user logs in, or automatically within one hour.
- Go to Tenant > Manage access > Assign roles tab.
-
Select the user you want to remove the access for, click More Actions , and select Activate or Deactivate.
The user entity is updated on the Users page.
Removing a user or group from Orchestrator does not delete the account from your organization.
The user or group is removed from Orchestrator and all roles are revoked.
Alternatively, select one or multiple users, and click the Remove button.
- You cannot remove a user having the Administrator role.
- You cannot remove or unassign users part of mappings that are employed in triggers from the folder the trigger resides in. Make sure the user is not set as an execution target in a trigger so you can delete them.
- Removing a directory group does not remove the license of an associated directory user, even if the group removal unassigns the user from any folder. The only way to release the license is to close UiPath Assistant.
Group |
Has access to the Orchestrator interface |
Has access to all folders/personal workspace only |
Has API access |
Tenant role |
Folder role |
---|---|---|---|---|---|
Automation Users |
No |
Personal workspace Important:
If a user is assigned to other folders via API, they also have access to those in addition to the personal workspace. |
Yes |
Allow to be Automation User | Automation User |
Automation Developers |
Yes |
All folders |
Yes | Allow to be Automation Developer | Automation Developer |
Administrators |
Yes |
All folders |
Yes |
Orchestrator Administrator |
Folder Administrator |
Automation Express |
Yes |
All folders |
Yes |
Allow to be Automation User | Automation User |
The Not Found error
Not found (#1002)
error is displayed.
In this case, the account in fact no longer exists and no longer has access to the UiPath products.
In the tenant, access can also be controlled at folder-level from the Folders tab, used for managing folders and objects, and from the folder context, in the sidebar menu.
Go to Tenant > Folders tab, choose the folder, and click Accounts & Groups. Next, click Assign and select the object to be added to the folder.
In order to assign the object, you are required to add a role to it. Once this is done, click Assign, and the object becomes visible in the list.
Another method to assign objects to a folder is to go to the folder context from the sidebar menu and click Users > Assign. In the search field, type the name of the object you want to add to the folder, select the roles it needs, and click Assign to finish the configuration.
To give specific folder access to assigned objects (groups, users, robot accounts, external apps), open a folder from the sidebar menu and go to Users. Next to the object for which you want to edit the folder access, click More Actions > Edit role in this folder. This brings up the assign page, where you can add or remove any roles for the selected object.
The same steps can be applied when going to Tenant > Folder tab > Accounts & Groups > More Actions next to the object you want to modify > Edit role in this folder. Now you can add or remove any roles for the selected object.
Go to Tenant > Folders tab, choose the folder, and click Accounts & Groups. Next to the object you would like to remove, click More Actions > Unassign. Once this is performed, the object no longer has access to that folder.
A folder hierarchy can be established with up to 7 levels. This structure includes the top-level folder and allows for 6 additional layers of subfolders beneath it. In terms of user access, it is inherited from the parent folders. This means if you are assigned access to a folder, you automatically gain access to all of its subfolders.
When configuring attended robots for a group or a single user, you also have the option to create a personal workspace for it.
To enable this option, go to Tenant > Manage Access > select the user or group > More Actions > Edit > Next > check the option Enable this user to run automations > check the option Create a personal workspace for this user. Once this is done, a new folder, My Workspace, is visible in the sidebar menu, next to the other folders.
Personal Workspaces permissions
Tenant-level permissions required to manage the workspaces of other users:
- Settings - View and Settings - Edit to allow the use of personal workspaces in the tenant from the Tenant > Settings page.
- Users - View and Users - Edit to enable a personal workspace for a user or group by editing it from the Manage Access page.
Folder-level permissions required to use a personal workspace:
- Alerts - View to see alerts generated for the personal workspace.
- Actions - View,Actions - Edit,Actions - Create, and Actions - Delete to enable long-running workflow execution in the personal workspace.
- Action Catalogs - View,Action Catalogs - Edit,Action Catalogs - Create,Action Catalogs - Delete to allow the user to manage action catalogs in the personal workspace.
To see what roles are assigned to a user or a group:
Recommended role-to-group mapping
Group |
Has access to the Orchestrator interface |
Has access to all folders/personal workspace only |
Has API access |
Tenant role |
Folder role |
---|---|---|---|---|---|
Automation Users |
No |
Personal workspace Important:
If a user is assigned to other folders via API, they also have access to those in addition to the personal workspace. |
Yes |
Allow to be Automation User | Automation User |
Automation Developers |
Yes |
All folders |
Yes | Allow to be Automation Developer | Automation Developer |
Administrators |
Yes |
All folders |
Yes |
Orchestrator Administrator |
Folder Administrator |
Automation Express |
Yes |
All folders |
Yes |
Allow to be Automation User | Automation User |
- Tenant-level access control
- Assigning groups to a tenant
- Assigning accounts to a tenant
- Assigning robot accounts to a tenant
- Assigning external apps to a tenant
- Assigning multiple accounts
- Checking Assigned Roles
- Activating or deactivating a user
- Removing a user or group
- Recommended role-to-group mapping
- Troubleshooting
- Folder-level access control
- Assigning objects to a folder
- Editing access
- Removing folder access
- Subfolder access
- Personal Workspace access control
- Checking Assigned Roles