Security roles enable you to tailor specific permissions for users loaded into your CloudRadial tenant. Permissions affect the overall visibility and general functionality of every feature within your portal.
This article explains how to create and manage an Account Manager role using CloudRadial's Security Roles and Role Assignments feature, providing flexible management capabilities with minimal security risk across multiple companies.
Table of Contents
- Prerequisites
- Use Case Overview
- Creating an Account Manager Role
- Assigning the Role to Users
- Using the Account Manager Role
- Important Considerations
Prerequisites
Before following these instructions, ensure that you meet these prerequisites to ensure a smooth experience:
- You have top-level access to the CloudRadial CSA portal (not applicable to Portal 365)
- You have administrator permissions to create roles and assignments
- You have a basic understanding of user management and company structure
At a minimum, you should familiarize yourself with security roles before following this article.
Use Case Overview
The Account Manager role is designed to provide limited company access with enhanced management capabilities while maintaining security boundaries. This role allows users to:
- Access and manage specific assigned companies
- Modify content within assigned companies
- Create new companies within the tenant (if permissions allow)
- Impersonate generic administrators to manage client companies
- Maintain limited permissions to prevent tenant-wide changes
Key benefits of this role include:
- Limited Access: Restrict access to specific companies rather than tenant-wide permissions
- Flexible Management: Provide necessary tools for effective client management
- Scalable Assignment: Multiple methods for assigning company access
- Security-Focused: Minimal security risk while enabling management capabilities
Creating an Account Manager Role
Step 1: Create the Role
- Navigate to Partner > Security in your CloudRadial portal
- Click on the Roles tab at the top right
- Click Add Role to create a new role
- Configure the role settings:
- Role Name: Account Manager (or your preferred naming convention)
- Description: "Provides management access to assigned companies with limited tenant permissions." (or your preferred description)
- Default Role: Leave unchecked (this should not be a default role)
Step 2: Configure Permissions
For an Account Manager role, configure the following permissions:
User Permissions:
- Impersonate Users: Optional (not typically required for account management)
- Impersonate Administrator: Enable (required for jumping into other companies)
-
Impersonate Administrator with All Features: Optional (enables access to disabled features in a company's feature set for staging purposes)
Note: The "Company Administrator" role is actually the key trigger that allows account managers to access and manage other companies. At minimum, one of the administrator impersonation options should be enabled.
Module Permissions: Configure based on your specific use case requirements:
- Clients: Full access (required to view and manage client list, but can be as low as View access)
- Assessments: Read access (for visibility into assessment data)
- Planner: Read access (for planning visibility)
- Reports: Read access (for reporting capabilities)
- All other modules: No additional access (roles stack with existing user permissions)
Important: CloudRadial roles are additive. The account manager will retain their basic user role permissions plus these additional Account Manager permissions. You only need to specify the extra permissions required beyond their base user access.
Step 3: Save the Role
Click Save to create the role.
The new Account Manager role is now available for assignment and provides the foundation for flexible company management.
Assigning the Role to Users
Once you have created the Account Manager role, you'll need to assign it to specific users with the appropriate company scope. CloudRadial offers multiple scope options for different management scenarios:
Single Company Access
For account managers responsible for one specific company:
- Navigate to Partner > Security
- Click on the Role Assignments tab (you'll land there by default)
- Click Add Role Assignment
- Configure the assignment:
- Scope Type: Select Company
- Company: Choose the specific company (e.g., "Brown Brothers Bottling")
- Role: Select Account Manager
- User: Select the target user (e.g., "Russell Johnson")
- Click Save
Result: The account manager will have management access to only the specified company while maintaining limited tenant access.
Global Access (All Clients)
For account managers who need access to all client companies:
- Navigate to Partner > Security
- Click on the Role Assignments tab
- Click Add Role Assignment
- Configure the assignment:
- Scope Type: Select Partner (global scope)
- Role: Select Account Manager
- User: Select the target user
- Click Save
Result: The account manager will have management access to all client companies in the tenant while maintaining limited partner-level permissions.
Multiple Specific Companies
For account managers responsible for several specific companies:
- Repeat the Single Company process for each additional company
- Create separate role assignments for each company:
- Brown Brothers Bottling
- Digital Efforts
- Dental Office
- (Additional companies as needed)
Process:
- Keep adding role assignments at the company scope level
- Select each company one by one
- Assign the same Account Manager role and user for each
Result: The account manager will have access to only the specifically assigned companies.
Company Groups (CSA Enterprise Feature)
For CloudRadial CSA Enterprise Partners, Company Groups provide the most scalable approach:
- Navigate to Partner > Security
- Click on the Role Assignments tab
- Click Add Role Assignment
- Configure the assignment:
- Scope Type: Select Company Group
- Company Group: Choose your pre-configured group of companies (e.g., "Management Group A")
- Role: Select Account Manager
- User: Select the target user
- Click Save
Enterprise Benefits:
- Company Groups: Assign access to pre-organized company collections (e.g., "Medical Companies," "Regional Group A"). You can then add companies to this group and have the account manager automatically begin to see these companies in their list.
- User Groups: Assign roles to user groups for automatic inheritance (e.g., "All product team members get Management Group A access")
- Scalability: Add/remove companies or users from groups without modifying individual role assignments
- Flexibility: Mix and match group-based and individual assignments as needed
Using the Account Manager Role
Once the role is assigned and active, account managers will have enhanced capabilities:
Available Features
Partner Tab Access: Account managers should gain access to the Partner tab with limited visibility to:
- Clients List: View assigned companies only
- Planner: See planning data for assigned companies
- Reports: Access reporting data for assigned companies
- Global Assessments: View assessment data for assigned companies
Company Management: Within assigned companies, account managers can:
- Impersonate Administrator: Click the three-dot menu next to a company and select "Impersonate Administrator."
- Full Company Access: Once impersonating, they have administrative access within that specific company
- Content Management: Create courses, modify tickets, stage features like the planner
- Feature Staging: Enable/configure features even if they're disabled in the standard portal view
Workflow Example of an Account Manager
- Access Clients: Navigate to Partner > Clients to see assigned companies
- Select Company: Choose the target company from the restricted list
- Impersonate: Click the three-dot menu and select "Impersonate Administrator"
- Manage: Perform administrative tasks within the company context
- Return: Exit impersonation to return to the account manager view
Important Considerations
Access Levels
- Account managers maintain their base user permissions with additional company management access
- Company access is strictly limited to the assigned scope (single, multiple, global, or group-based)
- Administrative capabilities are only available within assigned companies
- Tenant-level settings and configurations remain protected
Security Notes
- Partner Company Limitation: This feature is designed for users within your own partner company - you cannot assign cross-company account management roles
- Scope Restrictions: Account managers cannot access companies outside their assigned scope
- Administrative Boundaries: Impersonation capabilities are limited to assigned companies only
- Permission Stacking: Most permissive role permissions apply when multiple roles are assigned
Scaling Role Assignments
- Multiple role assignments can be stacked for broader access
- Company Groups (Enterprise) allow efficient management at scale
- No limit to the number of role assignments per user
Comments
0 comments
Article is closed for comments.