Administration (RBAC Controls)

Last update: July 11, 2023

IMPORTANT
User account management is moving to the Admin Console. To start user migration, we require all Audience Manager customers to immediately take the necessary measures described in this article: Audience Manager user migration to Admin Console.
After all customers have migrated, the user management sections of this document will go away.
IMPORTANT
Before you can use RBAC, this feature must be enabled by Adobe for your organization. Please reach out to your account team to request RBAC activation, or contact Customer Care.

The options under the Administration menu let you create Audience Manager users and assign them to groups. You can also view limits (traits, segments, destinations, and models).

Enterprise customers using Audience Manager need one data management platform for all of their data, but must be able to control the visibility of the different data elements to specific business units. You can accomplish this using group permissions, also referred to as Role-Based Access Control (RBAC).

Audience Manager uses groups to assign permissions. Permissions are not assigned at the user level. Group permissions are tied to objects (traits, segments, etc.) and to actions you can perform on those objects (edit, view, etc.). These controls are also available through the Audience Manager REST APIs. See User Management, Group Management, and Permissions Management API methods.

Create Users

IMPORTANT
User account management is moving to the Admin Console. To start user migration, we require all Audience Manager customers to immediately take the necessary measures described in this article: Audience Manager user migration to Admin Console.
After all customers have migrated, the user management section of this document will go away.

  1. Click Administration > Users.

  2. Click to display the Create New User page.

  3. Under User Details, fill in the fields:

    • Username: Specify a unique username for Audience Manager.
    • First Name: Specify the user’s first name.
    • Last Name: Specify the user’s last name.
    • Email Address: Specify the user’s email address. Audience Manager does not send regular notification to users. Audience Manager administrators have access to users’ email addresses and can manually email users as needed. For example, if a user forgets their password, the email address specified in this field is used to send a temporary password and instructions to reset the password.
    • Phone Number: Specify the user’s phone number.
    • Is Admin: Specify if this user is an Audience Manager administrator. Admin users can manage users (create, edit, etc.) and groups (create, assign permissions, etc.). Non-admin users can control only their own user profiles, including editing their email addresses and resetting their own passwords. For more information, see Edit Your Account Settings.

  4. Under Login, select the desired status:

    • Active: Active users can access Audience Manager and have the permissions granted by group membership.
    • Deactivated: Deactivated users cannot access Audience Manager and do not have any permissions. If you deactivate users, their user information remains in Audience Manager and you can simple reactivate them, if necessary. If you remove users, you must re-create them if they need to use Audience Manager again in the future.
    • Expired: A user’s password is older than 90 days.
    • Pending: The user has a temporary password, either as after a password reset or as a brand new account, and they have not yet set a permanent password.
    • Locked Out: 5 incorrect login attempts will lock out a user.

  5. Under Assigned Groups, from the drop-down list, select the desired groups to which you want to assign this user.
    For more information about groups and permissions, see Create a Group.

  6. Click Save.

Create a Group

IMPORTANT
User account management is moving to the Admin Console. To start user migration, we advise all Audience Manager customers to immediately take the necessary measures described in this article: Audience Manager user migration to Admin Console.
After all customers have migrated, this section will go away.

A group is a collection of users that share access rights to destination, segment, and trait objects. You can limit groups to single objects only or give them broad access to combinations of different objects.

To create a group:

  1. Click Administration > Groups.

  2. Click to open the Group Settings page.

  3. In Group Details:

    • Name the group.
    • Provide a brief group description.

  4. In Group Members, click a user from Add Users options to add them to the group.

  5. In Group Permissions, select a trait, segment, or destination from Add Object.
    This opens a permissions window for your selected object.

  6. Select the check box for the permissions you want group members to have.

  7. (Optional) Assign Wild Card Permissions to the group.

  8. Click Save Group.

Understanding Wild Card Permissions

IMPORTANT
User account management is moving to the Admin Console. To start user migration, we advise all Audience Manager customers to immediately take the necessary measures described in this article: Audience Manager user migration to Admin Console.
After all customers have migrated, this section will go away.

Simplify group rights management with Wild Card Permissions.

Wild Card Permissions give group members automatic access to each data source associated to a segment, destination, or trait. By comparison, regular permissions only let you assign specific data sources to the one of these objects. And, when you add new data sources, group members don’t get access to those new sources.

You have to open the group permissions and assign those new data sources to the group. Wild Card Permissions let you avoid this manual data source update process. Groups with Wild Card Permissions get access to new data sources without explicit authorization.

Read below for a description of what each wildcard permission means:

Trait

  • MAP_ALL_TRAITS_TO_MODELS - Users can select traits as the baseline for models.
  • EDIT_ALL_TRAITS - Users can edit all traits set up within their company account.
  • VIEW_ALL_TRAITS - Users can view all traits set up within their company account.
  • DELETE_ALL_TRAITS - Users can delete all traits set up within their company account.
  • CREATE_ALL_ALGO_TRAITS - Users can create algorithmic traits.
  • MAP_ALL_TO_SEGMENTS - Users can add any of the traits belonging to their company to segments.
  • CREATE_ALL_TRAITS - Users can create traits.

Models

  • VIEW_MODELS - Users have permission to view models belonging to their company.

Derived Signals

  • VIEW_DERIVED_SIGNALS - Users can view all the derived signals belonging to their company.
  • CREATE_DERIVED_SIGNALS - Users can create derived signals.
  • EDIT_DERIVED_SIGNALS - Users can edit all the derived signals belonging to their company.
  • DELETE_DERIVED_SIGNALS - Users can delete any of the derived signals belonging to their company.

Destination

  • EDIT_ALL_DESTINATIONS - Users can edit all the destinations set up within their company account.
  • CREATE_DESTINATIONS - Users can create destinations.
  • VIEW_ALL_DESTINATIONS - Users can view all the destinations set up within their company account.
  • DELETE_ALL_DESTINATIONS - Users can delete all the destinations set up within their company account.

Tags

  • VIEW_TAGS - Users can do everything (view, create, edit, delete) on their Tag Containers.

Audience Lab

  • MANAGE_SEGMENT_TEST_GROUPS - Users can do everything (view, create, edit, delete) on their Audience Lab test groups.

Segment

  • CREATE_ALL_SEGMENTS - Users can create segments.
  • DELETE_ALL_SEGMENTS - Users can delete all the segments set up within their company account.
  • MAP_ALL_TO_DESTINATIONS - Users can map any of the segments belonging to their company to destinations.
  • EDIT_ALL_SEGMENTS - Users can edit all the segments set up within their company account.
  • MAP_ALL_SEGMENTS_TO_MODELS - Users can select segments as the baseline for models.
  • VIEW_ALL_SEGMENTS - Users can view all the segments set up within their company account.

Signals

  • VIEW_ALL_SIGNALS - Users can view all signals captured in Data Explorer.

Use Cases

Monitoring User Access

Role-Based Access Control can help you monitor user login status, giving you a clear picture of who can access your Audience Manager instance.

Depending on your business requirements, you can enable and disable user accounts as needed.

monitor-user-access

Ensure Access Protection for Sensitive Data Sources

You can configure Role-Based Access Control at trait, segment, and destination level, for each user group.

This capability helps you manage how your users view, create, read, write, and edit specific data sets, and even restrict users from accessing data sets that should not be available to them.

access-protection

More help on this topic

Previous pageAudience Manager User Migration to Admin Console
Next pageEdit Your Account Settings

Audience Manager


Connect with Experience League at Summit!

Get front-row access to top sessions, hands-on activities, and networking—wherever you are!

Learn more

Register now