Roles

NOTE:

To perform operations on this page, the user signed in to Control Center must be a member of the NRTADMIN group.

The following topics are available:

Introduction

iManage Work uses role-based access control. Each user's ability to perform actions in iManage Work is based on the user's function within the organization. This is accomplished through two mechanisms: Privileges and roles.

Privileges

A privilege is a permission to perform specific tasks. For a complete list of iManage Work system privileges, see Library privilege descriptions.

Privileges are predefined by the system and cannot be created or deleted. They can be only granted or denied.

When defining privileges for users, follow the principle of most restrictive access. Grant only the minimum necessary to users of that function to perform their job tasks.

Roles

A role is a defined set of privileges.

  • Roles may be created or deleted as needed.

  • A user must have one role assigned to them.

  • If no role is assigned to a user at the time they are created or imported, they will automatically be assigned the role of DEFAULT or DEFAULT EXTERNAL.

  • Users can be reassigned roles at any time.

  • A privilege within a role may be granted or revoked at any time.

Roles and iManage Control Center access

A user's level of access to iManage Control Center is automatically determined at sign in by the user's role. The controls applicable to the user are enabled. Controls not applicable to the user will not be visible or actionable.

iManage Control Center is intended for iManage system administrators. iManage system administrators with tier access (tier 1, tier 2, NRTADMIN ) will have their applicable controls visible.

Searching for roles

On the ribbon bar, you see the following Search option. Use this feature to search by role name.

Figure: Search field

images/download/attachments/117480164/Screen_Shot_2019-02-26_at_12.22.26_PM.png

Creating a library role

To create a role that applies to a specific iManage Work library:

  1. Navigate to Access > Roles.

  2. At the top of the Roles page, select the Work library in which this role should be created, then select images/download/thumbnails/117480164/image2021-1-29_11-7-7.png .

    The Create Role dialog box appears.

  3. Enter a Role Name, Description, and select if this is an External Role. The role name is required and must be unique among the other role names.

  4. Select which privileges should be enabled for this role. See Library privilege descriptions for more details.

  5. Select images/download/thumbnails/117480164/Screen_Shot_2019-01-08_at_6.44.11_PM.png to create the new role.

Library privilege descriptions

The following table describes each library privilege.

Privilege

Description

Profile

Role Name
(Mandatory)

Name for the role. It must be unique among all roles names for that library. The value cannot be changed later.

Minimum length: 1
Maximum length: 254
Spaces allowed: No
Unicode allowed: Yes
Special Characters allowed: No, except underscore (_) and hyphen (-).

Description

This is additional information about this role. This is descriptive and does not need to be formatted and is not validated.

Minimum length: 0
Maximum length: 254
Spaces allowed: Yes
Unicode allowed: Yes
Special Characters allowed: Yes

External Role

Indicates if the role is for external users. If set to Yes, this role can only be assigned to External users.

An external user has no default security access and must later be assigned explicit access for their tasks. For example, an external user may be a customer who requires temporary access, a part-time contractor, vendor or partner.

Work application privileges

Allowed Actions

System Access

Indicates if the role has read-only access to iManage Work documents and containers. This setting enables or disables all the other privileges for Documents, Workspaces, and Folders on this page.

Yes (checked): restricts the user to read-only access to documents, folders and workspaces.

No (unchecked): provides full access to documents and containers, subject to other security settings.

Document

Import/Create

Allow users to import documents and emails.

Without this privilege, users cannot import or add content to iManage Work.

Checkout Documents

Allow users to check out documents to prevent other users from editing the document.

Without this privilege, the Checkout context menu option is disabled.

images/download/attachments/117480164/checkout.png

Unlock Documents

Allow users to unlock their own documents that they have checked out. Any changes to the checked out document will not be saved to iManage Work, though the changes will remain on the user's local system.

Administrators (members of the NRTADMIN group) have the privilege to unlock any user's locked document.

Delete

Allow users to delete documents and emails.

Without this privilege, users cannot delete any documents or emails within iManage Work, even those to which they have full access, and the Move to Trash context menu option is disabled.

images/download/attachments/117480164/image2020-12-16_17-18-49.png

See also the User Trash setting in Settings > Global to enable or disable the Trash feature. This feature allows users to recover items they have deleted (moved to trash).

View for NRTADMINs

Allow users who belong to the NRTADMIN group to view the contents of, or download, other users' private documents and emails. Private documents and emails are those that have Default Security set to "Private".

  • To allow an NRTADMIN user to view private documents, add the user to a role that has this privilege set to Yes. This is the default setting.

  • To prevent an NRTADMIN user assigned to a specific role from viewing private documents, select No for this privilege.

Workspace

Create Workspaces

Allow users to create new workspaces.

Create Public Workspaces

Allow users to create public workspaces.

Delete Workspaces

Allow users to delete workspaces.

Upon deletion, the workspace and all containers within it are deleted and cannot be recovered. All documents and emails within the workspace are moved to Trash (if enabled; see Settings > Global). If Trash is not enabled, the contents of the workspace are also deleted and cannot be recovered, except from a system backup.

If the workspace contains any documents or emails, the user must also have the Contents > Delete privilege listed above in order to delete the workspace.

NOTE: If the workspace is empty (it contains only empty containers, with no documents or emails), the user is not required to have the the Contents > Delete privilege.

Custom Metadata Management

Allow users to add new values to the custom properties custom1-custom12 and custom29-custom30 while creating workspaces.

Folder

Create Public Folder

Create a new public folder. The user can still create private folders or subfolders with security inherited from the parent folder.

Create Public Searches

Save public searches and mark them as public.

Control Center Privileges

Control Center Access

Allow or restrict access and privileges in iManage Control Center for an iManage Work library:

  • Tier 1:

    • Content Assistance: Documents: Check access, review history, unlock documents, search documents, restore documents

    • Workspace: Check access, search workspaces

    • Trustee Assistance: Unlock users, reset passwords

  • Tier 2:

    • Manage Trustees: Manage Users & Groups (internal and external)

    • Manage Custom Metadata: Manage custom tables Custom1-12 and 29-30 Manage System

    • Metadata/Configurations: Manage Applications, Types & Class or Subclass, Captions, User preferences and so on

    • Template Management: Manage template definitions

  • None

    • No administrative privileges are assigned.

For a complete list of privileges for each tier, see Understanding tiers.

NRTADMIN access is granted by adding the user to the group NRTADMIN. For a selected library, use Access > Users > Add to Group, and select NRTADMIN. Only an NRTADMIN can create other NRTADMINs.

An NRTADMIN automatically has full NRTADMIN privileges and supersedes any current-assigned privileges or roles. NRTADMIN privileges apply only for library-management level operations, and only for a selected library. Users can be an NRTADMIN for multiple libraries, but they must be added individually to each library.

Legacy application privileges

Work client privileges

Allow Full-Text Searches

Allow users to perform full-text searches in iManage classic clients.

Search Using Web

Allow users to perform searches in legacy Work Web.

Admin privileges

Use iManage Import

Allow access to use the bulk Document Import tool.

The NRTADMIN group has this permission by default.

Use iManage Work Monitor

Allow access to use the iManage Monitor to track library transactions.

The NRTADMIN group has this permission by default.

Use iManage Work Administration

Allow access to the users in INTERNAL_ADMIN, INTERNAL_USERADMIN, EXTERNAL_ADMIN, and EXTERNAL_USERADMIN groups in iManage Work Web client to manage users, groups and roles.

NRTADMIN group has this permission by default.

Assigning a role to a user

To assign a role to a user:

  1. Navigate to Access > Roles.

  2. Select any role.

  3. Select the Users tab.

  4. Select Assign to Users. The Assign to Users dialog box displays.

  5. Use the search field to find users by their user name, Id, or email address, then use the check boxes to select users.

  6. Select Add. This adds the selected list of users to the role.

Viewing role details

Use this to see the status of each of the role's privileges.

  1. Navigate to Access > Roles.

  2. Select View using one of the following options:
    Ribbon bar: Select a role to see this option on the ribbon bar.
    Kebab menu: Select the

    images/download/thumbnails/117480164/elipse.png

    icon adjacent to each role to see this option.
    Context menu: Right-click a role to see this option.

  3. The details screen displays. See also Editing roles.

Editing roles

To change any privileges within a role.

  1. Navigate to Access > Roles.

  2. At the top of the Roles page, select the Work library in which this role exists.

  3. Select the images/download/thumbnails/117480164/elipse.png icon adjacent to the role you wish to edit, then select Edit. The details screen displays.

  4. Modify the settings as needed. See Library privilege descriptions

    for more information about the individual privileges.

  5. Select Save.

Duplicating a role

You can use an existing role as the basis for creating a new one. After duplicating a role, modify the privileges as needed; see Editing roles.

To create a copy of the existing role:

  1. Navigate to Access > Roles, and locate the role to be duplicated.

  2. Select Duplicate using one of the following options:
    Ribbon bar: Select a role to see this option on the ribbon bar.
    Kebab menu: Select the

    images/download/thumbnails/117480164/elipse.png

    icon adjacent to each role to see this option.
    Context menu: Right-click a role to see this option.

  3. Enter a Role Name and Description. The role name is required and must be unique among the other role names. The description is optional, but recommended, and is a friendly description about the role.

  4. Select Duplicate. A copy of the selected role gets created.

Deleting a role

Use the following steps to delete an existing role.

  1. Navigate to Access > Roles, and locate the role to be deleted.

  2. Select Delete using one of the following options:
    Ribbon bar: Select a role to see this option on the ribbon bar.
    Kebab menu: Select the

    images/download/thumbnails/117480164/elipse.png

    icon adjacent to each role to see this option.
    Context menu: Right-click a role to see this option.

  3. A Delete confirmation box appears. Select Delete again to confirm the deletion.

NOTE:

The following roles cannot be deleted: DEFAULT and DEFAULT EXTERNAL. These are permanent roles used as the default if a user is not otherwise assigned a role.

Understanding tiers

Tiers are predefined sets of privileges for iManage Work system administrators when performing activities in Control Center, and are assigned per iManage Work library.

There are three tiers, each designed to provide specific assistance to users.

  • Tier 1: Basic product support or help desk features.

  • Tier 2: Advanced product support or help desk features.

  • NRTADMIN: NRTADMIN is considered an iManage Work system administrator and includes the most complete access to all features.

Individual privileges within a tier set cannot be modified. For example, the Trash Permanently delete privilege cannot be added to the tier 1 set, nor could a user be granted only the Trash Permanently delete privilege. In the same way, NRTADMIN cannot have the Trash Permanently delete privilege removed from its set.

The following table lists the privilege set for each tier.

Table: Tier privileges

Feature

Tier 1

Tier 2

NRTADMIN

Users

Create

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Lock/Unlock

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Reset Password

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Groups

Create library groups

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Disable

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Copy

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Add members

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Roles

Create library roles

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Add users

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Manage user privileges

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Documents

Search

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Check effective access

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

History

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Workspaces

Search

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Check effective access

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Trash

Restore

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Permanently delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Custom Fields

Add/Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Disable

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Classes / Subclasses

Add

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

File Types

Add

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Captions

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Templates

Add

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Copy

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Forms

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Global

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Applications

Add

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Web Client

General

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Features

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Access

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Web Views

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Web Filters

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

Web Context Menus

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

images/download/thumbnails/117480164/check.png

iOS

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Add server

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Download

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Office

Create category

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Delete category

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Download category

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Refile

View

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Configure and Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

File Handlers

Upload New

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Edit

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Delete

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png

Enable/Disable

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/error.png

images/download/thumbnails/117480164/check.png