How to configure Admin Role

The Admin Role gives full Administrative Access to the au2mator Self-Service Portal. You do not assign it per User — you link one Active Directory or Entra ID Group to au2mator, and every Member of that Group becomes an au2mator Admin.

TABLE OF CONTENTS

• Introduction
• Step 1: Open the Authorization Settings
• Step 2: Select the Admin Group
• How au2mator resolves a User Role
• Recover Access if you lock yourself out

Introduction

An au2mator Admin sees and manages the whole Portal: every Service, every Service Group, all Settings and all Automation Resources. There is exactly one Admin Group for the Portal, and Membership is evaluated against your Directory every time a User starts a Session — so adding someone to the Group in Active Directory or Entra ID is enough, no extra Step inside au2mator is needed.

Need to delegate Admin Rights for only some Service Groups instead of the whole Portal? See our Scoped Admin Roles Article

Looking for the Asset Management Roles (Asset Admin, Editor, Reader)? See our Roles & Permissions Article in the Asset Management Category

Step 1: Open the Authorization Settings

Log in to the au2mator Self-Service Portal as an Admin and open Settings > Authorization. The Admin Group Card is the first Card on that Page.

Only an existing Admin can open this Page. Right after Installation, the Admin Group is the one you picked in the Setup Wizard.

Step 2: Select the Admin Group

Start typing in the Admin Group Card. au2mator searches your connected Directory and lists the matching Security Groups. Groups from a Domain are shown as the Domain in Brackets followed by the Group Name, so you can tell Groups with the same Name in different Domains apart.

Pick the Group you want and confirm the Dialog that appears. au2mator saves the new Admin Group immediately and confirms with a Success Message.

Change at your own Risk. Make sure the correct Users are already Members of the new Group before you switch — if you select a Group you are not a Member of, you lose Admin Access yourself as soon as your Session is re-evaluated.

Members of nested Groups are only recognised when the Recursive AD Group check Setting is enabled — see our Authorization (Settings) Article

How au2mator resolves a User Role

When a User starts a Session, au2mator checks the configured Groups in a fixed Order and the first Match wins:

• Admin Group
  • Full Administrator of the whole Portal.

• Asset Admin Group
  • Administers Asset Management only.

• Asset Editor Group
  • Edits Assets, without the Asset Administration.

• Asset Reader Group
  • Read-only Access to Assets.

• Normal User
  • No Match in any of the Groups above.

A full Admin is exclusive: if a User matches the Admin Group, au2mator stops there and does not combine it with any Scoped Admin Role. All other Roles can be combined with one or more Scoped Admin Roles.

A User who is a Member of several of these Groups always gets the highest Role in this List, never a Mixture of them

Recover Access if you lock yourself out

The Admin Group is stored as a Setting in the au2mator Database, not in a Configuration File. That is why a Change takes effect right away for new Sessions and why it is kept across Updates.

If nobody is a Member of the configured Group any more, no one can open the Authorization Page, and the Setting can no longer be corrected from inside the Portal. It then has to be put right directly in the au2mator Database.

Please do not edit the Database on your own — contact au2mator Support and we will correct the Admin Group Setting with you.

After changing the Admin Group, affected Users have to sign in again before the new Role takes effect