User Roles

Role-based Access Control and managing Teammates

Role-Based Access Control (RBAC)

User management provides a way to control user access (based on the roles) and is the ability to onboard and off-board users across the platform. You can define users and groups and provide the required permissions using user management. The users of the Webex Connect platform are uniquely identified by their email address.

📘

Managing Users

  • Tenant 'Owner' is the user role with highest level of access. If you're a partner helping a client go live with their services on Webex Connect, it is best to assign the Owner rights to the individuals who would need access to features such as Single Sign On (SSO) Configuration, Tenant Time Zone Settings, and platform usage audit trail for monitoring purposes.
  • Users with Owner and/or Full Access roles can add/delete users and edit the permissions of the existing users. Editing the permissions includes revoking access. Only Owner level users can add another user in "Owner" role. Once a user has been added in "Owner" role, their access level cannot be changed or revoked in a self-serve mode. You will need to reach out to Webex Connect support to make a change in their access level.
  • By default, the Service Key and JWT Authentication Tokens are masked. Only Owners, Full Access Users, and Limited Access Users can see the Service Key and JWT Authentication Tokens by clicking the Show Icon (eye icon) next to these credentials.

📘

Note

The same email ID of a user can be added to multiple tenants. The user will be able to take up different roles in each of these tenants.

For example, [email protected] can have the role A (Owner) in tenant Q, and he/she can have role B (Full access) in tenant Z.

The users' access to assets varies depending on the user's hierarchy. Users, also known as teammates, can exist at tenant/client-level, group-level. or a team-level.

User Roles

The following table mentions about the platform features for which default access is provided or not provided for various roles.

Feature NameOwnerFull Access UserLimited AccessRead OnlyRestricted
Profile KeyYesYesNoNoNo
Service Key/JWT TokenYesYesNoNoNo
SSO ConfigurationYesNoNoNoNo
Invite Other UsersYesYesNoNoNo
Revoke User AccessYes (Except other Owners)Yes (Except Owner)NoNoNo
Change User RolesYes (Except other Owners)Yes (Except Owner)NoNoNo
Change Tenant TimeZone or Date FormatYesNoNoNoNo
Provide Decrypt Access to Other UsersYesNoNoNoNo
Create New ServicesYesYesYesNoNo
View Existing ServicesYesYesYesYesNo
Get NumbersYesYesYesNoNo
Configure New App AssetsYesYesYesNoNo
Share App Assets with GroupsYesYesYesNoNo
Add IntegrationsYesYesYesNoNo
Access Monitoring (Audit Trail)Yes (if this add-on has been subscribed to)NoNoNoNo
Add Group(s)YesNoNoNoNo
Add Team(s)YesNoNoNoNo
Access ReportsYesYesYesYesNo
Access Debug ConsoleYesYesYesYesNo
Download Export LogsYesYesYesYesNo
Schedule Export LogsYesNoNoNoNo

The platform has users at the following hierarchy levels:

  • Tenant/Client - users at this level have access to all the assets.
    The users set up at Tenant level can switch to the group/team level to see the assets at that level. The access rights depend on the role of the user.
  • Group - each tenant/client can have multiple groups or sub-accounts.
    The sub-accounts represent various units/departments of a client. Sub-accounts are required to administer a set of users grouped by their function within the organization. This is an optional level in the hierarchy. Users at the group-level have access only to the assets created at that group-level. However, users at the group-level can switch down to the team-level to see the assets of the teams within that group. The access rights depend on the role of the user.
  • Team - a sub-account can contain multiple teams which in-turn contain team members. This is an optional level in the hierarchy.
    Users at the team-level have access only to the assets created at the team-level. They cannot see and access assets at other team-levels or at its parent group-level. The access rights depend on the role of the user.

Specific Permissions

Granular Access to Profile Key, ServiceKey, and JWT Token:

Users with the ‘Owner’ and ‘Full Access’ roles will be able to view the following UI options in the ‘Permissions’ page of the platform:

  • Profile API / Media access Key
  • Service Key / JWT Token

In case of users with the ‘Owner’ role, the above options will be enabled by default and cannot be disabled. While, users with the ‘Full Access’ role can enable or disable these options in the UI.

📘

Permission Changes

The above change also impacts all the existing users and users whose roles are changed, such that accesses will either be revoked or retained based on the new permission settings above.
For example, if a user with ‘Restricted Access’ role previously had access to either of the options above, their access will now be revoked.

The role-based changes can be tracked in the user details of Audit Logs.

Regenerate Profile Key

Users only with the ‘Owner’ role can regenerate the profile key in the Services page of the platform with the ‘Regenerate Profile Key’ option. Users with all other roles (including Support access users) will view this option in the disabled state in the platform UI.

Add Sub-accounts (Groups)

To add sub-accounts:

  1. Click Sub-accounts in the User Management menu.
297

User Management Menu

  1. Go to the Groups tab and click Add New Group.
  2. Provide a suitable Name and Description and click Save.
706

Add Group

The specified group is created.

🚧

Deleting Sub-accounts (Groups)

Deleting sub-accounts is not supported currently.

Add/Edit Teams

To add Teams:

  1. Click Sub-accounts in the User Management menu.
  2. Go to the Teams tab and click Add New Team.
  3. Provide a suitable Name and Description.
  4. Select a group in the Groped Under drop-down list box.
  5. Click Save.
700

Add Team to a Group

The specified team is created within the selected group.

🚧

Deleting Teams

Currently, the deletion of teams is not supported.

Add/Edit/Delete Teammates

To add teammates:

  1. Click Teammates in the User Management menu. You can see a list of the users at this hierarchy level.
264

Teammates

  1. Enter the Email ID of the user.
  2. Select the Role that you want to grant the user and click Invite User. For details about roles, see the User Roles section.
1061

Add Teammates

  1. Click Edit against the required user and update the role permission and data access for that user.
  2. Click Delete against the user that you want to delete and confirm the action to delete the selected user.

Switch View

You can switch from a tenant/client level to a group or team level using the Switch View menu item available in the User Management menu. If you are a user at a group-level, you can switch to the team-level.

297

Switch View Menu Item

Hierarchy-based Feature Access

The following table provides an illustration of the availability of the assets between the users across a hierarchy. 'Created at' column refers to the level at which the Entity/Asset has been created or configured.

Entity/AssetCreated AtTenant/ClientGroupTeam
UsersTenant/Client
Group
Team
ServicesTenant/Client
Group
Team
only when switched
to the team-level
AppsTenant/Client
only when shared
with the group

only when shared with the team
Group
only when shared with the team
Team
only when switched
to the team-level
IntegrationsTenant/Client
Group
Team
only when switched
to the team-level