Assign roles to a group


Prerequisites

The following permissions:

  • Directory > Group > Add
  • Directory > Group > Edit
  • Authorization > Grant > Add
  • Authorization > Role > View

Using the Roles tab for a group, administrators can grant a role to all members of a group, and assign divisions to that role. These divisions dictate which configuration objects that the role can access.

For background information about divisions and how to create them, see Divisions overview.

By assigning Roles to a Group, all members associated with the Group are granted the permissions associated with the assigned role. All new members added to the group inherit the same roles and permissions. If members are removed from a group, those users lose the roles and permissions associated with the group. Additionally, roles inherited by members of a group are non-editable in the users roles section. The group those permissions are inherited from is shown. Divisions cannot be edited. The role cannot be removed from the user except by removing the role from the group or removing the user from the group.

  • To grant a role and its divisions to a list of people, create a group.
  • To grant users who have the same role the access to different configuration objects, create multiple groups.

In this figure, all members of “Example Group” have permissions of “A Demo Role.” However, that role only applies to configuration objects in Australia and Canada divisions.

Assign a role to group

  1. Select the Groups tab.
  2. Search for the role that you want to add to the group.
  3. Select the division to associate with the group to add access controls.

Example Use Case

Suppose that your organization has outbound call centers in New York and California. You want to prevent outbound administrators from administering campaigns outside their own locale. An admin in California does not need access to New York’s campaigns. An admin in New York does not need access to California’s campaigns.

All outbound dialing administrators play the same role (Outbound Admin), but administrators in each call center only need access to their own configuration objects.

Step 1: Define each call center as a division having its own set of configuration objects

Divisions define a set of configuration objects—specific queues, users, flows, campaigns, management units, contact lists, and do-not-contact lists. Divisions do not define who can use those objects.


  1. Click Admin.
  2. Under People & Permissions, click Divisions.
  3. Click Create Division.
  4. Name the division CA Call Center.
  5. Click Save. The new division opens to the Settings tab.
  6. (Optional) Add a more detailed description to the division and then click Save.
  7. The next step is to move configuration objects to the division. Click the Campaigns tab.
  8. In the Add new campaign box, begin typing the first few letters of the campaign name and then select it from the list. PureCloud adds the campaign to the division. Select only California call center campaigns.
  9. Repeat step h for each additional campaign you want to add.


  1. Click Admin.
  2. Under People & Permissions, click Divisions.
  3. Click Create Division.
  4. Name the division NY Call Center.
  5. Click Save. The new division opens to the Settings tab.
  6. (Optional) Add a more detailed description to the division and then click Save.
  7. Next, move configuration objects to the division. Click the Campaigns tab.
  8. In the Add new campaign box, begin typing the first few letters of the campaign name and then select it from the list. PureCloud adds the campaign to the division. Select only New York call center campaigns.
  9. Repeat step h for each additional campaign you want to add.


Step 2: For each call center, define a group of its outbound administrators

To identify where outbound dialing administrators work, create groups named CA Dialer Admins and NY Dialer Admins.


  1. Click Admin.
  2. Under Directory, click Groups.
  3. Click Add Group.
  4. Type CA Dialer Admins in the Name box.
  5. Optionally change the group’s visibility from Public to Members Only, or Owners only.
  6. Click Save. After a few seconds, a profile page for the group appears. The Membership tab is selected by default.
  7. Click Edit.

  8. Click the Individuals tab.

  9. Type all or part of a California administrator’s name in the Add Person box. Then select a person from the list of results. The system adds the selected person to the list of individuals who belong to this group.
  10. To add more administrators to the group, repeat the previous step until it contains all outbound dialing administrators for the call center.
  11. Click Save.


  1. Click Admin.
  2. Under Directory, click Groups.
  3. Click Add Group.
  4. Type NY Dialer Admins in the Name box.
  5. Optionally change the group’s visibility from Public to Members Only, or Owners only.
  6. Click Save. After a few seconds, a profile page for the group appears. The Membership tab is selected by default.
  7. Click Edit.

  8. Click the Individuals tab.

  9. Type all or part of a New York administrator’s name in the Add Person box. Then select a person from the list of results. The system adds the selected person to the list of individuals who belong to this group.
  10. To add more administrators to the group, repeat the previous step until it contains all outbound dialing administrators for the call center.
  11. Click Save.


Step 3: Assign a role and division to each group

Assign the “Outbound Admin” role to both groups, but assign a different division to that role in each group. This process ensures that administrators cannot access any campaigns except their own.

Note: You cannot assign roles to a group with membership rules.

Enable Rules must be On to permit the assignment of roles to the group. In addition, the group may not have associated rules. If the group has membership rules, a warning appears: “Membership rules cannot be combined with group rules assignment. Disable role assignment to access membership rules.” If you continue, you lose all rules associated with the group. For security purposes, this restriction prevents rules from automatically adding members to a group that in turn gives members access to permissions that someone did not specifically grant.

Members of a group receive the permissions assigned to roles, with granular divisions that determine which configuration objects members of that group can access. Members of different groups may inherit the same role (Outbound Admin for example). However, the divisions assigned to each group define the resources (such as campaigns) that each group can access.


Assign to the CA Dialer Admins group, the Outbound Admin role, and the CA Call Center division. This step gives all members of the CA Dialer Admin group authorization to administer outbound campaigns, but only for campaigns in the CA Call Center division.

Complete these steps:

  1. Click Admin.
  2. Under Directory, click Groups.
  3. Type CA Dialer Admins in the search box.
  4. To edit the group, click CA Dialer Admins.
  5. Select the Roles tab.
  6. Set Enable Roles to On.
  7. Click Assign Roles.
  8. Click Next to locate the Outbound Admin role.
  9. Enable the Selection switch for the Outbound Admin role.

  10. Type CA in the Divisions box. Then select CA Call Center from the result list.
  11. Click x to remove the Home division.
  12. Click Save.


Assign to the NY Dialer Admins group, the Outbound Admin role, and the NY Call Center division. This step gives all members of the NY Dialer Admins group, authorization to administer outbound campaigns, but only for campaigns in the NY Call Center division.

Complete these steps:

  1. Click Admin.
  2. Under Directory, click Groups.
  3. Type NY Dialer Admins in the search box.
  4. To edit the group, click NY Dialer Admins.
  5. Select the Roles tab.
  6. Click Enable Roles.
  7. Click Assign Roles.
  8. Click Next to locate the Outbound Admin role.
  9. Enable the Selection switch for the Outbound Admin role.
  10. Type NY in the Divisions box. Then select NY Call Center from the result list.
  11. Click x to remove the Home division.
  12. Click Save.



What to do after new configuration objects are created

When an administrator adds a new configuration object, the system automatically assigns it to the Home division. To limit access to the object, move it to a different division. For more information, see Move objects from one division to another and Move objects from one division to another.

However, in the case of outbound dialing campaigns, the Outbound Admin can assign a division directly in the campaign configuration. If the campaign entry includes division assignment, then the division automatically updates.

Outbound dialing administrators can select only those divisions of which they are a part.