How can we help?

Articles in this section

See more

Automatically Revoking Roles When a PSA Type Changes

David Falkenberg
  • Updated

By default, CloudRadial UCP never takes a role away because of something that changed in your PSA. If a contact's type changes, the roles that type gave them stay. There is a setting that changes that - it deletes those role assignments instead - and because it deletes access, it is off until you turn it on.

This article covers what it removes, what it does not touch, and what to check before you enable it.

What Happens By Default

With the setting off - which is how every portal starts - a role granted by a type mapping survives the contact no longer matching that type. What changes is the label, not the access: the assignment is reclassified from Type Mapping to Direct, exactly as though an administrator had granted it by hand.

That has a consequence worth understanding, because it is the reason this setting exists. Once an assignment becomes Direct, no type mapping manages it any more. It will not be cleaned up by a later sync, and it will not be removed by a different mapping's Remove from other role assignments? setting unless that mapping happens to run against the same user. Over time, a portal where people change roles often accumulates Direct assignments that nobody decided to make.

The trade is deliberate. The default protects you from a PSA-side mistake quietly removing someone's access. The cost is that cleanup is yours to do.

What the Setting Changes

The setting is Automatically revoke roles when a contact's type no longer matches the PSA, on Partner > Settings > Type Mappings, in a Type Mapping Settings block above the mappings grid.

The Type Mapping Settings block above the grid, showing the Automatically revoke roles when a contact's type no longer matches the PSA checkbox in its default unticked state, with its hint text

With it on, a role assignment that a type mapping granted is deleted when that type no longer justifies it, rather than being relabelled Direct. The user loses the access at the next sync.

It is a single partner-level setting. It applies to every type mapping and every client in your portal - you cannot enable it for one mapping or one client. It is available on ConnectWise, Autotask, HaloPSA, Kaseya BMS and Syncro.

Exactly What It Removes

It removes role assignments whose source is a type mapping, which the contact's current types no longer justify, scoped to the user's own company.

All three conditions have to hold. In practice that means:

  • A role granted by type Power User is deleted when the contact stops being a Power User in the PSA.
  • A role granted by type Power User is deleted when you remove that role from the Power User mapping.
  • A role granted by type Power User is deleted when you uncheck Sync with CloudRadial? on the Power User mapping, because an unsynced mapping grants nothing.
  • Everything a type mapping granted is deleted when the contact's type field is cleared in the PSA, or the contact stops matching any synced mapping at all.

And one case that often surprises people the other way:

  • If a user matched two types that both granted the same role, and they stop matching only one of them, the role stays. Each grant is tracked against the type that made it, so the remaining type still justifies it. Only when the last type that grants a role stops matching is the role removed.

What It Never Touches

The setting only ever deletes assignments that a type mapping created. It leaves alone:

  • Roles assigned by hand. Anything showing as Direct is untouched, including a role that used to come from a type mapping and was relabelled Direct while the setting was off.
  • Roles inherited from a user group (a legacy feature).
  • Microsoft 365 group roles.
  • Partner-level roles, and any role scoped to a different company than the user's own.

It also does nothing at all to a contact it cannot confidently identify: a PSA contact with no usable PSA identifier, a contact with no matching CloudRadial user, a deleted user, or a partner administrator.

This is not the same list as the one on Remove from other role assignments? on an individual mapping. That setting exists to clear Direct assignments; this one never does. They are separate controls and it is worth keeping them separate in your head.

When It Runs

Nothing happens when you tick the box. The setting takes effect at the next PSA sync, and it acts on what that sync finds - not on the state of your portal at the moment you enabled it.

That matters if you are mid-way through a PSA change. If contacts are currently in an intermediate state, or a bulk edit is half-applied, the sync after you turn this on will treat that intermediate state as the truth and remove accordingly.

Before You Turn It On

The setting is safe to enable, but it is not reversible in the sense that matters: turning it back off does not restore roles that were already deleted. Two things are worth doing first.

Find out what it would actually remove. Every role assignment carries an Attribution that says where it came from. Open a representative sample of users under Partner > Clients > Users > [user] > Role Assignments and look for roles attributed to a type mapping on users whose PSA type you know has drifted. Those are exactly the assignments this setting will delete. See Where a User's Roles Came From.

Understand the first sync. Role assignments made before this feature existed do not record which type granted them. On the first sync after you enable the setting, each of those older assignments is either adopted - stamped with a type that currently grants it - or, if no currently-matched type grants that role, deleted. So the first run can remove more than you expect, and it is the only run that behaves this way. Every sync after that only acts on changes.

If you have a client whose PSA type data you do not trust, fix that first. This setting turns PSA data quality into portal access.

Turning It On

  1. Go to Partner > Settings > Type Mappings.
  2. In the Type Mapping Settings block above the grid, tick Automatically revoke roles when a contact's type no longer matches the PSA.
  3. A confirmation appears explaining that roles which would previously have been downgraded to Direct will now be deleted. Confirm it.

The setting saves immediately on confirmation - there is no separate Save on this block. If you cancel the confirmation, the checkbox returns to where it was.

You need Edit permission on Partner Settings.

Turning It Back Off

Unticking the box returns you to the default: from the next sync onwards, a role that stops being justified is relabelled Direct instead of being deleted. You are asked to confirm this direction too.

It does not restore anything already removed. Role assignments deleted while the setting was on are gone, and have to be reassigned by hand or re-granted by putting the contact back into a matching type in your PSA.

Related

If you are still having trouble, we're here to help!

Submit a ticket here for assistance, and don't forget to check our status page to ensure there are no outages in your area.

Related articles

Comments

0 comments

Article is closed for comments.