In this chapter we will demonstrate general use cases of how to work with roles. We will create 3 contentACCESS users with the following roles/permissions:

1. System administrator (name: “SysAdmin”) with the default “system administrator” role
2. Tenant administrator (name: “TAAdmin”) of all tenants without a right to edit/delete the jobs, repository items and schedulers and to manage the processed (archived) data.
3. Email archive user (name: “EAUser”) of TECH-ARROW tenants with rights to view all archive mailboxes, but with limited permissions to work with archive mailboxes (recover, export allowed on specific mailboxes of the selected tenant only).

A) Prepare roles for your future users first:

1. For the System administrator the default role is already created, so here this step can be skipped.
   
2. For the second user the role must be created so open the Roles page, click +new role and set the following in the Role details window:

   Role display name: optional (“2nd_user_role” in this use case)
   Manage system permission: “Not allowed”
   Manage tenants: “All allowed” – so the associated user will have permissions to manage all tenants
   Manage users and roles: “All allowed” – without this permissions user and role creation, association is not allowed
   Under section Tenants: set the “Add job” “Add repository item” and “Add scheduler” to “All allowed” – the user will be able to create these objects for every tenant, but set the Edit and Delete of the same objects to “Not allowed” – the user won’t be allowed to edit/delete these objects
   Under each Plugin section select option “Not allowed” – the user won’t be able to view and/or manage the processed data.

   Save your changes and the role will be added to the Roles grid.

   
3. For the third user the role must be prepared, too. Create a new role and define the following settings in the Role details window:

   Role display name: optional (“3rd_user_role” in this use case)
   Tenant dropdown list at the bottom of the window: select “TECH-ARROW”
   Everything must be set to “Not allowed” except of the Plugin.EmailArchive section, where:
   View mailboxes, Preview and View all public folders are “All allowed”
   Export, Manual recovery are “Specific allowed” – i.e. only specific mailboxes can be recovered and /or exported from contentWEB. The exact mailboxes will be set later on the Assign specific permissions page.

   Save your changes.

   

B) Create your users and assign roles to them

Now the roles for all three users are ready. We just have to create users and assign the roles to them, and to set specific permissions for our 3rd (Email Archive) user. In these use cases we will create users with Forms provider. Go to Users page (System => Security => Users) and click “create or invite user”.

1. Create a system administrator, set his credentials and assign the default “system administrator” role to him. Save the user.
   
2. Create your TAAdmin tenant administrator user and assign “2nd_user_role” to him. Select “All tenants” from the tenants dropdown list. The Add job, scheduler, repository item, Manage tenants and Manage users and roles permissions will be assigned for the user on all tenants. Other permissions that we set to not allowed won’t be granted for the user. Save your user and use it.
   
3. Create your EAuser email archive standard user and assign “3rd_user_role” to him.“TECH-ARROW” will be automatically selected in tenants dropdown list, as this role was created for this specific tenant only.
   In the details part of the window you can see the global permissions allowed for the user on this TECH-ARROW tenant – the user is able to view all archive mailboxes and public folders and also to use the email archive’s preview function in contentWEB.
   

The role assigned to the EAUser has also specific email archive recovery and export permissions on the TECH-ARROW tenant. As there are specific permissions defined in the role, the admin is automatically redirected to the Assign specific permissions page, were he can set the mailboxes that the EAUser will be able to recover and export. In this use case this permission is granted on mary.harper’s and jack.bolton’s mailboxes. Save your changes and use your EAUser.