Business Roles represent an easy way to create and manage sets of standard roles and groups. With Business Roles you can achieve a uniform and easily manageable access policy.

For example, in the image below you can see a Business Role containing several admin roles for LPGs and a regional user group – all this can be assigned to one or more users in just a one step. If these admins should have more responsibilities, it needs to be changed in only one place – here in the Business Role definition.

 In a newly created partition, there is a default business role called 'All Roles' which contains all the existing roles. Assigning this role to a newly created user saves you time that you would have to otherwise spend on assigning dozens of user roles. It also helps eliminate a security issue – by assigning this role to new users you can give them time-limited access to all features (e.g., for the duration of a training) and when this time period is over you can disable this business role for them and assign them only those user roles that they need for their work. 

Setup

1. Create a new Business Role using the Add  icon. (The unique name of a Business Role cannot be changed after creation.)
2. In the two right panes select which groups or roles belong to this Business Role. 

3. Assign this Business Role to a user. 
   Business Roles can be assigned in parallel to groups and roles. The effective access of a user is the superset of all directly assigned roles/groups and roles/groups coming from the business roles.

Restrictions

Number of Licenses

Pricefx licenses (optionally) limit the number of users per application module. This is controlled by the assigned roles (every role has a module assignment). A Business Role cannot be assigned to a user if the user would get access to a new module and that would exceed the number of available licenses.

Adding Role to Existing Business Role

Generally, roles/groups can be added to a Business Role (or removed from it) also after creation. This permission change becomes active for all users that have this Business Role assigned. However due to the licensing implications, a role can only be added to a Business Role if at least one of these conditions is met:

• The added role is of a module that is already assigned to the Business Role (via another role of same module).
• If the added role is of a module that is not yet assigned to the Business Role then there must be no user limit for this module.
• No users are assigned to this Business Role.

Assigning Admin Roles

The privilege escalation rules apply to assignment of Business Roles too:

• General Admin has no limitations.
• Other user admins can only assign a Business Role that contains only un-privileged roles or only privileged roles that the assigning user has.