Tenant workgroups

Workgroups are used to control users' access to functions and configuration settings in the tenant (most of these functions are application-specific while a few are common to all of the Planning Space applications).

You can add or remove user accounts from membership of a workgroup using the Workgroups interface.

The effects of belonging to a workgroup are determined by the roles that a workgroup is allowed to use. These role permissions are set in the Tenant roles management interface.

Three workgroups are created by default for a new tenant:

• Administrators: this workgroup has access to all functions and all configuration settings for the tenant. By default, only Administrators can create or manage the user accounts, workgroups and roles of the tenant (but these roles can also be assigned to new workgroups). An initial administrator user with login ID 'Administrator' and password 'Administrator' is always created when a new tenant is created, and this is the only initial means for tenant administration.
• Everyone: all users are automatically members of this workgroup. By modifying the roles which Everyone is assigned to, you can control which features of the Planning Space applications are made 'public' and available to all users.
• SecurityAdministrators: this workgroup is granted the role 'Security/Security'. By default it does not have any user members. (The workgroup name can be modified.)

The Workgroups management interface can be accessed in the Planning Space Web interface. Click the Apps Grid menu button at the top left and select Security, then click the Workgroups button at the left-hand side.

Alternatively, to access workgroup management in Planning Space Desktop, click Security in the Navigation menu, and Workgroups in the Security top menu.

Note: You can only access this screen if you are logged in as an Administrator user. or if you are using a user account which is granted the role 'Security/Security'.

You will see the names and descriptions of the existing workgroups for the tenant.

Create a new workgroup

Click the New workgroup button to create a new workgroup:

In the edit pane, type in a name, a short description, and an optional comment. Workgroup names can only contain alphanumeric characters, underscores (no spaces), and full stops; names can be up to 128 characters and must start with a letter.

Users tab: Use the tick boxes next to the user account names to set the initial user membership of the workgroup.

Roles tab: Set the roles that this workgroup is allowed or denied..

Click the Save button to create the new workgroup.

Alternatively, you can make a new workgroup as a copy of an existing workgroup by selecting one workgroup and clicking the Copy workgroup button.

'External Group' setting

The External Group field is used in the configuration of automatic provisioning of tenant user accounts. See Automatic provisioning of tenant user accounts.

'License Profile Workgroup' setting

The License Profile Workgroup check box is used to mark a workgroup for use with License Profiles (which can be used to control and prioritize users' access to Planning Space product licenses). See License profiles for details.

Edit a workgroup

To edit the settings for an existing workgroup, click a workgroup name to open its edit pane. For example:

The workgroup that is being edited will be highlighted in blue. Click the X button at the top right corner to close the edit pane.

Workgroup names can be changed at any time, except for the 'Administrators' and 'Everyone' workgroups.

You can also edit the Description.

Users tab: Use the tick boxes next to the user account names to add or remove user members of the workgroup.

Roles tab: Modify which roles this workgroup is allowed or denied (see Tenant roles).

There are two control buttons, which become activated when you have made an edit. Click the Save button to save the changes that you have made. Click the Discard changes button to undo any unsaved changes.

User membership editing

The Invert Selections button appears in the Users tab in the edit pane. Clicking this button performs an inversion between selected and unselected users (this is useful, for example, in the case of switching Dataflow document permissions between a specified list of allowed users and a list of denied users).

The Copy from workgroup... button can be used to set user membership based on the settings in other workgroups. Clicking the button opens a panel showing a list of workgroups (use the Search field to filter workgroups by name sub-string matching). Select one or more workgroups; a list of user accounts will appear. The dropdown selector switches between All selected workgroups (logical AND), which means that users will only be selected when they are members of all of the selected workgroups, and Any selected workgroups (logical OR), which means that users will be selected when they are a member of one or more of the selected workgroups.

Assign entity-level permissions for a workgroup

It is possible to edit the entity-level permissions for hierachies (Dataflow) and regimes (Economics and Financials).

Click a workgroup name to open its edit pane, and select the Assign Permissions tab:

See Access permissions (entity-level) for hierarchies and regimes for explanation of the entity-level permissions.

Delete a workgroup

To delete a workgroup: click a workgroup name and click the Delete button .

Then click Delete in the confirmation dialog.

'Export as CSV' workgroup data

Click the Export as CSV button to export a file that contains the details of all of the workgroups, and their Allowed and Denied roles.

The role names are prepended by the application name (e.g., 'PlanningSpace Dataflow-Manage Data'). The same role name may be used for more than one application.