Introduction

iManage Work uses role-based access control. Each user's ability to perform actions in iManage Work is based on the user's function within the organization. This is accomplished through two mechanisms: Privileges and roles.

Privileges

A privilege is a permission to perform specific tasks. For a complete list of iManage Work system privileges, refer to Library privilege descriptions and Global privilege descriptions.

Privileges are predefined by the system and can't be created or deleted. They can only be granted or denied.

When defining privileges for users, follow the principle of most restrictive access. Grant only the minimum necessary to users of that function to perform their job tasks.

Roles

A role lets you group together a set of privileges. When you create a role, you then assign one or more users to the role.

• Roles may be created or deleted as needed.

• A user must have one role assigned to them.

• If no role is assigned to a user at the time they're created or imported, they'll automatically be assigned the role of DEFAULT or DEFAULT EXTERNAL. 

• Users can be reassigned roles at any time.

• A privilege within a role may be granted or revoked at any time.

Roles don't define access to content. For that, refer to Security Access Levels. 

For more information, refer to Privileges, Roles, and Groups.

Understanding global and library-level roles

iManage Control Center lets you create and manage roles globally (across all libraries), or per library. The Roles menu allows you to select the following options:

• Global Management: Use this option to view, create, and manage global roles. Global roles are created and managed independently of any iManage Work library, and changes made to the global role are updated at the global level, and not individually ‌within each library. This is useful for managing privileges for administrative users that access Control Center. Global roles have unique privileges: refer to Global privilege descriptions.
  
  A user may be assigned to more than one global role. For more information, refer to Creating a global role.
  

• Library Management: Use this option to view, create, and manage library roles. Library roles are created within, and are specific to, each iManage Work library. A library role is assigned to each user. A user must be assigned to at least one library role. If a library role isn't explicitly assigned to a user, the user is automatically assigned to either the DEFAULT or DEFAULT_EXTERNAL role, based on whether they've been defined as an internal or external user in their user profile.
  
  Selecting this option displays a secondary menu where you must select an individual Work library. Library roles have unique privileges: Refer to Library privilege descriptions.
  

  Figure: Library menu

  

  A user may only have one library role per library. For more information, refer to Creating a library role.

Roles and iManage Control Center access

The level of access a user has to iManage Control Center is automatically determined at sign-in by the role of that user. The controls applicable to the user are enabled; controls not applicable to the user won't be visible or actionable.

iManage Control Center is intended for iManage system administrators. iManage system administrators assigned to the specific Global role along with the NRTADMIN group or with Tier 1 or Tier 2 access will have their applicable controls visible.

Searching for roles

On the ribbon bar, you see the following Search option. Use this feature to search by role name.

Creating a global role

Global roles control access for administrative activities within Control Center are independent of any iManage Work library, such as administering global users, global groups and global roles, encryption keys, and upcoming features.

A user isn't required to be assigned to a global role. There's no default global role.

To create a global role:

1. Browse to Access > Roles.

2. At the top of the Roles page, select Global Management, then select + Create Global Role. The Create Role dialog appears.

3. Enter a Role Name, and Description. The role name is required and must be unique among the other role names. 

4. Select which privileges should be enabled for this role. For more details, refer to Global privilege descriptions.

5. Select Create.

Global privilege descriptions

The following table describes each global privilege.

Privileges

Select each of the privileges to enable for the role.

Creating a library role

To create a role that applies to a specific iManage Work library:

1. Browse to Access > Roles.

2. At the top of the Users page, select Library-level Management, then select + Create Role. The Create Role dialog appears.

3. Enter a Role Name, Description, and select if this is an External Role. The role name is required and must be unique among the other role names. 

4. Select which privileges should be enabled for this role. For more details, refer to Library privilege descriptions.

5. Select Create to create the new role.

Library privilege descriptions

The following table describes each library privilege.

Assigning a role to a user

To assign a role to a user:

1. Browse to Access > Roles.

2. Select any role.

3. Select the Users tab.

4. Select Assign to Users. The Assign to Users dialog displays.

5. Use the search field to find users by their user name, ID, or email address, then use the check boxes to select users.

6. Select Add. This adds the selected list of users to the role.

Viewing role details

Use this to see the status of each of the role's privileges.

1. Browse to Access > Roles.

2. Select View using one of the following options:
     Ribbon bar: Select a role to see this option on the ribbon bar.
     Kebab menu: Select the 

   
    icon next to each role to see this option.
     Context menu: Right-click a role to see this option.

3.  The details screen displays. Also refer to Editing roles.

Editing roles

To change any privileges within a role.

1. Browse to Access > Roles.

2. To edit a global role that applies across all iManage Work libraries, at the top of the Roles page, select Global Management. To edit a role within an iManage Work library, select Library-level Management, then select the library in which the role exists.

3. Select the 

   
    icon next to the role you wish to edit, then select Edit. The details screen displays.

4. Modify the settings as needed. Refer to Library privilege descriptions and Global privilege descriptions for more information about the individual privileges.

5. Select Save.

Duplicating a role

You can use an existing role as the basis for creating a new one. After duplicating a role, modify the privileges as needed; refer to Editing roles.

To create a copy of the existing role:

1. Browse to Access > Roles, and locate the role to be duplicated.

2. Select Duplicate using one of the following options:
     Ribbon bar: Select a role to see this option on the ribbon bar.
     Kebab menu: Select the 

   
    icon next to each role to see this option.
     Context menu: Right-click a role to see this option.

3. Enter a Role Name and Description. The role name is required and must be unique among the other role names. The description is optional, but recommended, and is a friendly description about the role.

4. Select Duplicate. A copy of the selected role gets created.

Deleting a role

Use the following steps to delete an existing role.

1. Browse to Access > Roles, and locate the role to be deleted.

2. Select Delete using one of the following options:
     Ribbon bar: Select a role to see this option on the ribbon bar.
     Kebab menu: Select the 

   
    icon next to each role to see this option.
     Context menu: Right-click a role to see this option.

3. A Delete confirmation appears. Select Delete again to confirm the deletion.

Understanding tiers

Tiers are predefined sets of privileges for iManage Work system administrators when performing activities in Control Center, and are assigned per iManage Work library. 

There are two tiers, each designed to provide specific assistance to users.

• Tier 1: Basic product support or help desk features.

• Tier 2: Advanced product support or help desk features.

In addition, the NRTADMIN group is considered an iManage Work system administrator. This group includes the most complete access to all features.

Individual privileges within a tier set can't be modified. For example, the Trash Permanently delete privilege can't be added to the tier 1 set, nor can a user be granted only the Trash Permanently delete privilege. In the same way, the NRTADMIN group can't have the Trash Permanently delete privilege removed.

For more information about Tier 1 and Tier 2 privileges, refer to Library privilege descriptions. For additional information about the NRTADMIN group, refer to Creating an NRTADMIN User and Groups.

The following table lists the privilege set for each tier. Though not considered a tier, the NRTADMIN group is included in the table to show the privileges available to members of this group.

 Table: Tier privileges

¹ Users with Tier 1 or Tier 2 privileges can only lock/unlock users or reset user passwords on a Global level and only if they're assigned to a Global Role that has the User Management privilege.