Before you assign roles to users and groups, you need to understand how iManage Threat Manager handles access at different stages of setup, what the NRTAdmin group does, which predefined roles are available and what each permits, and why certain account restrictions exist. This page covers those foundational concepts; for the procedures themselves, see How to assign roles below.
In this section:
Role-based access behavior
Threat Manager’s access behavior differs depending on whether the iManage Work Server connection has been configured.
Before iManage Work Server is configured
When iManage Threat Manager is first set up and the iManage Work Server has not yet been configured:
The Local Admin Account is automatically granted the privileges of all roles
This allows initial setup, configuration, and testing to be completed without needing to assign roles to other users
The application operates in site loading mode, which allows application loading, configuration, and testing to be completed without needing to set up a dedicated iManage Work Server
After iManage Work Server is configured
After the iManage Work Server has been configured, the system transitions to role-based access control:
Users are imported from and authenticated through iManage Work
Users sign in using the same credentials they use to access iManage Work
Access to application features is determined by the roles assigned to each user
Risk and compliance users can sign in to iManage Threat Manager using the same credentials they use to access iManage Work
First sign-in requirement
The first user to sign in to iManage Threat Manager must be a member of the NRTAdmin group
iManage Threat Manager obtains NRTAdmin group membership information directly from iManage Work at sign-in
Members of the NRTAdmin group are automatically assigned the Configuration Manager and Role Manager roles
Through the Role Manager role, NRTAdmin members can assign users and groups to roles within iManage Threat Manager
Local Admin Account restrictions
After the iManage Work Server connection has been configured, the Local Admin Account is restricted to reduce access to privileged configuration settings:
The Local Admin Account can access only the Configuration section of the application
The Local Admin Account cannot access the following settings:
In the General tab: Default Date Range, Score Settings
In the Exclusions tab: Import Global Exclusions List, Export Global Exclusions List
These restrictions ensure that, after initial system setup and configuration, the Local Admin Account is locked out of privileged information in the Threat Manager application.
IMPORTANT: Users without roles assigned
If a user without any assigned roles signs into iManage Threat Manager:
The user can access the application interface
The user cannot access any functionality
Roles in iManage Threat Manager
iManage Threat Manager includes the following predefined roles that determine what tasks users can perform:
Role | Description |
|---|---|
Configuration Manager |
|
Integrations Manager |
|
Investigator |
Users with this role can:
|
Role Manager |
|
Rule Editor |
|
NRTAdmin group
The NRTAdmin group provides elevated administrative access to iManage Threat Manager.
Automatic role assignment
Members of the NRTAdmin group are automatically assigned the Configuration Manager and Role Manager roles when they sign in
This assignment is based on membership information retrieved from iManage Work at sign-in, not from the Threat Manager database
Session behavior
After sign-in, group membership remains in effect for the duration of the session
Membership is refreshed at the next sign-in
CAUTION: If a user is removed from the NRTAdmin group in iManage Work, the change is not reflected immediately in Threat Manager:
The user retains their access and assigned roles—specifically the Configuration Manager role—until they sign out or their session expires.
By default, sessions renew automatically after 1 hour and expire after 24 hours.
How to assign roles
Roles can be assigned to users and groups to control access to application features. You can assign:
A single user or group multiple roles at one time
A single role to multiple users or groups at one time
Additional roles to yourself using the same procedure as adding roles to another user
A user can have multiple roles. In most cases, compliance officers belong to both Rule Editor and Investigator roles to allow them to create rules and perform investigations. However, in some firms, segregation may be required between rule creators and those performing forensic investigations.
To assign roles, refer to the procedures in the following sections:
To assign roles to a user: see Task: Add roles to a user
To assign roles to a group: see Task: Add roles to a group
To assign users or groups to a role: see Task: Add users or groups to a role