Identity and Access Management

The Identity and Access Management (IAM) functionality lets you have the ability to control user access rights to view and make changes in specific parts of Bloomreach.

📘

See Identity and Access Management (Discovery) for a list of default roles for Discovery.

User Interface

The user management UI allows for creation, modification, and deletion of users and contains admin roles to assign and revoke permissions to users. Typically, these UI features will be managed by an admin who is either a business user or an IT admin at your organization. The admin will be the one who has access to the user management UI and can make changes to users.

The UI allows for the following:

  1. Creation of new users
  2. Management of user data
  3. Resetting of passwords
  4. Role assignment
  5. Deletion of users

Add a New User

  1. Navigate to Setup in the left nav
  2. Click on User management
  3. Click on the Add New User button
  4. Fill in the user's information, including e-mail address, and select their site access and roles
  5. Click on Add New User to complete the process

Manage an Existing User

  1. Navigate to Setup in the left nav
  2. Click on User management
  3. Click on the Manage dropdown in the Action column
  4. In the dropdown, you will see three choices:
    1. Manage User: change or remove assigned roles and site access
    2. Resend Invitation Email: reset the password for the user and send a password reset e-mail automatically to the e-mail address listed for that given user
    3. Delete User: remove the user completely from access to Bloomreach. This action is not reversible.

Default Roles for Content

The following default roles for Content are supported in IAM. These are the roles that an IAM admin can assign to Users. You will only see the roles that are reflective of the Bloomreach products you have integrated on. For example, if you are not integrating Insights and are not an Insights customer, you will not see the "Insights User" role and will not be able to assign this role to anybody. 

Role

Role Definition

Content Author

A Content Author has access to the following apps:

  • Experience manager
  • Projects
  • Content
  • Document search
  • Audiences → Content audiences

  • The Content Author role grants the following privileges:
  • Create and modify folders
  • Create and modify documents and experience pages. The user can create documents for the 'core' branch and for regular (non-developer) projects. The user cannot create documents for developer branches.
  • Browse regular projects in the Projects and Experience manager apps.
  • Add, delete, and change component items of experience pages in the Experience manager for core and regular projects
  • Upload and modify images
  • Upload and modify assets
  • Request publication of documents and experience pages
  • Request taking offline of documents and experience pages
  • View campaigns and segmentations in the Content audiences app
  • Edit a Channel to create component variants for segmentations for a certain project
  • Have an overview of all Engagement projects
  • View all campaigns and segments of a certain Engagement project
  • Content Editor

    A Content Editor has access to the following apps:

  • Experience manager
  • Projects
  • Content
  • Document search
  • Audiences → Content audiences

  • The Content Editor role grants the following privileges:
  • All privileges of the Content Author role
  • Approve or reject publication requests
  • Approve or reject take offline requests
  • Publish documents and experience pages directly
  • Take documents and experience pages offline directly
  • Approve or reject items in a project under review
  • Add comments in projects
  • Start or cancel a project review
  • Site Editor

    A Site Editor has access to the following apps:

  • Experience manager
  • Projects
  • Content
  • Document search
  • Audiences → Content audiences

  • The Site Editor role grants the following privileges:
  • All privileges of the Content Editor role
  • Modify menus and shared containers in the Experience manager
  • Manage channel settings
  • Publish their own channel changes to live
  • View, create, modify, and delete campaigns in the Content audiences app
  • Reorder segmentations in the Content audiences app
  • Edit a Channel to create component variants for segmentations for a certain project
  • Have an overview of all Engagement projects
  • View all campaigns and segments of a certain Engagement project

  • Note that a Site Editor cannot merge (reintegrate) an approved project.

    Site Admin

    A Site Admin has access to the following apps:

  • Experience manager
  • Projects
  • Content
  • Document search
  • Audiences → Content audiences

  • The Site Admin role grants the following privileges:
  • All privileges of the Site Editor role
  • Create new channels
  • Create new developer and regular (non-developer) projects
  • Add a channel to a project
  • Update projects (pulling in 'core' changes)
  • Merge reviewed (and approved) projects
  • Edit allowed content types in folders
  • Unlock document in use by another user
  • Add Engagement project integrations to manage different sets of campaigns, segments, and segmentations
  • Create Engagement projects to import campaigns and segmentations that belong to these projects
  • View and delete Engagement projects to manage their previously imported campaigns and segmentations
  • Have the 'base64' encoding of the authorization header be done automatically
  • Edit a Channel to create component variants for segmentations for a certain project
  • Have an overview of all Engagement projects
  • View all campaigns and segments of a certain Engagement project
  • Site Developer

    A Site Developer has access to the following apps:

  • Experience manager
  • Projects
  • Content
  • Document search
  • Audiences → Content audiences
  • Setup → brXM API token management

    The Site Developer role grants the following privileges:
  • All privileges of the Content Author role with the difference that Site Developer role gives the privilege to only create documents within a developer project (and not within 'core')
  • Add, delete, and change the component items of experience pages in the Experience manager within developer projects *.
  • Create new developer projects (note that regular projects are not visible to a Site Developer, neither in Projects nor in the Experience manager project dropdown)
  • Modify document types within a developer project which includes document types.
  • Add channel to a project
  • Update developer projects (note that the Site Developer role does not provide the privilege to merge a project since that would change live production website)
  • Approve or reject items in a developer project under review
  • Add comments in developer projects
  • Start or cancel a developer project review
  • Invoke Management API REST calls
  • Edit allowed content types in folders
  • Edit a Channel to create component variants for segmentations for a certain project
  • Have an overview of all Engagement projects
  • View all campaigns and segments of a certain Engagement project


  • Note that a Site Developer is not able to directly modify the live production website. The Site Developer role also does not give read access to regular (non-development) projects. All modifications by a Site Developer must be made within a developer project.

    * Due to a bug, Site Developers are currently able to add, delete, and change the component items of experience pages in the Experience manager within core. This will be fixed in a future release.

    IAM Site Hierarchy 

    Bloomreach customer hierarchy is Parent Organization → Account → Site. 

    A user can be assigned a role at any node in this hierarchy: they can be assigned a role at the Parent Organization node, the Account node, or the Site node.  If a role is given to a node at a higher level, it is propagated to all levels below it. For example, if user A was assigned the "Insights User" role at the Organization node, they would also be an "Insights User" at the Site node. However, if they were assigned "Insights User" at the Site node, they would have the "Insights User" role at the Organization node.

    Most customers will choose to assign users roles at the Account node. If the customer has a multisite account, they may choose to give users permission at the Organization level (for wider permissions) or at the Site level (for more scoped permissions). 

    The following are more detailed descriptions of the concepts in IAM. 

    Organization also known as Parent Organization

    Parent organization is a top node of the Bloomreach customer hierarchy of:

    Parent Organization → Account → Site.

    Each customer has a Parent Organization. A Parent organization can contain multiple Accounts and each account can contain multiple Sites.

    It is important to note that Users exist at an Organization level. Because of this, the IAM Admin role only exists at an organization node in the hierarchy and users can only be managed at the Organization level.

    Account

    An Account is made up of a group of Sites under the same Organizaiton. Roles can be assigned at the Account level.

    Site

    A Site is the lowest node of the customer hierarchy. Roles can be assigned at the Site level.


    Did this page help you?