Managing Study User Accounts & Role Assignment

This article describes how to manage a Vault CDMS user’s access to Studies and study-related data.

Cross-Vault & Cross-Domain Users

In Vault, user accounts exist within a single domain. One user may not have access to every vault on a domain. Cross-vault users have access to multiple vaults on a single domain. Cross-domain users have access to multiple vaults on different domains. You can add users from other vaults on your domain, or users from other domains, to your Study from Tools > System Tools > Users.

These users can use a single set of login credentials to log in to any vault they have access to, regardless of domain. Cross-domain users log into their home domain, but the session is Vault specific. The My Vaults page, if enabled, is served from the cross-domain user’s Vault on their home domain.

Veeva Learning Integration

Vault CDMS has an integration with Veeva Learning’s Absorb learning management system, which your organization can use to prevent users from accessing study-related records before completing their assigned training curriculum. Learn more about how to use the integration.

If the integration is not enabled in your Study, you can simply enable and disable Study Access for your users.

If the integration is enabled for your Study, you have some additional options when creating and editing Users. The Study Access field is bundled with a new LMS Training Status field to roll up to Has Access. A user will have study access (Has Access set to Yes) if one of these two conditions is met:

• The User has completed all assigned training (their LMS Training Status is Trained).
• The User has Study Access set to Enabled and Ignore LMS Status, Assume Trained selected.

When a user has access to multiple studies, Vault automatically combines the training requirements across those studies. A user will only need to complete each curriculum once, not once per study.

The Ignore LMS Status, Assume Trained checkbox allows you to override the user’s training status, so that they may access the Study without completing their training. This is useful when your organization is first enabling the Veeva Learning Integration and does not want to lock existing users out of a Study.

Roles Limited by Environment Type

Because Studio is read-only in non-development environments (TST, training, and production), Vault includes a standard Study Role, CDMS Study Designer Read Only, that provides read only access to Studio. The CDMS Study Designer role provides complete access to Studio for users to design their study, typically in a development environment. In most cases, the following roles cannot be assigned to users in a production environment:

• CDMS Super User
• CDMS Study Designer
• CDMS Librarian

We recommend that these roles be assigned with study-specific access.

Roles Requiring All Sites Access

Certain roles require All Sites access. In the current release, the current standard Study Roles require All Sites access:

• CDMS API Read Write
• CDMS Clinical Coder
• CDMS Clinical Coder Administrator
• CDMS Clinical Coder Manager
• CDMS Super User
• CDMS User Administrator
• CDMS Study Designer
• CDMS Librarian
• CDMS Safety Administrator

Create the User’s Account

To create a new user:

1. Navigate to Tools > System Tools > Users.
2. Click + New User to create a new user.
3. Enter a First Name and a Last Name.
4. Enter a User Name. The user will use this value (with @domain.com appended) to log into Vault, for example, entering “cordelia.hunter” would have the user log in with the user name “cordelia.hunter@verteopharma.com”.
5. Enter the user’s Email.
6. Optional: Enter a Federated ID. If your organization is using Single Sign-On (SSO), Federated ID may be required for this user to be able to log in with SSO.
7. Select a Security Policy.
8. Optional: If you want to assign this user as the designated Principal Investigator for a Site during site creation, select Yes for Add as Principal Investigator. Otherwise, leave this set to No. Adding a user as a Principal Investigator allows them to be selected as the Principal Investigator for a site during site creation. A user can be a principal investigator (via job title or study role assignment) without having this field set to “Yes”. This field applies only to the Principal Investigator field on the Site record.
9. Optional: Enter a Title and Company. These fields are only informational, there isn’t any functionality tied to these values.
10. Select the user’s Language. This is the language that Vault displays UI text in.
11. Select a Locale. This informs the number and date formats that Vault uses to display numbers and dates to this user.
12. Select a Timezone.
13. Select an Activation Date. The User won’t be able to access the vault until this date.
14. By default, Vault sends the Welcome Email on the chosen Activation Date. If you want to send the Welcome Email upon save, select No for Send Welcome Email on Activation Date. Otherwise, leave this set to Yes.
15. Click Save.

To add an existing domain user to the current vault:

1. Navigate to Tools > System Tools > Users.
2. From the + New User menu, select + Add Existing User.
3. Enter the user’s User Name. This must be an exact match.
4. Click Add User.

Set the User's Study Access 21R1 & Earlier

1. If you aren’t already in Edit mode, click Edit.
2. Scroll to the Study Access section.
3. If your Study isn’t listed in the Accessible Studies list:
   1. Click + Add Studies.
   2. Use the shuttle menu to move your Study from Available Studies to Accessible Studies.
   3. Click Save.
4. Select your Study in the Accessible Studies list.
5. Optional: To provide this user access (via the same role) to all environments and sites, select Yes for Grant Access to All Environments and Sites. Leave this set to No to set access to specific environments and sites.
6. For each Environment, complete the following steps:
   1. Select Grant Access to allow the user to access this environment.
   2. Select a Study Role to assign this user.
   3. To assign a user access to all study sites, select Access All Sites.
   4. If you didn’t give the user all site access: Allow access to all Sites in a Study Country by selecting a Country for Country Access, or allow access to one or more chosen Sites by selecting specific Sites in Site Access.
   5. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
7. Click Save.

Set the User's Study Access 21R2 & Later

With the 21R2 release, we introduced a new security model, multi-role security. With multi-role security, a user can have multiple Study Roles in a study or in a vault with a single account and without a custom Security Profile. If your vault was created after the 21R2 release (August 2021), your vault is using this security model automatically. If your vault was created prior to the 21R2 release, you must upgrade to this model. If you haven’t upgraded, your vault is still using Role by Study. Contact your Veeva Services representative to discuss upgrading. See Set the User’s Study Access (21R1 & Earlier) for instructions to set a user’s study access in Role by Study.

With multi-role security, you can assign a User a Study Role across all Studies in the vault, across all Environments in a Study, or to one or more Environments in a Study. A user can have up to fifteen (15) Study Roles in a single vault. For example, a user may be a lead data manager, but that user can also be assigned a CRA role to preview the study as a CRA would view it in the Review tab.

Across All Studies

To assign a user a Study Role or multiple Study Roles across all Studies in the vault:

1. Navigate to the User in Tools > System Tools > Users.
2. If you aren’t already in Edit mode, click Edit.
3. Scroll to the Study Access section.

4. Select Yes for Grant Access to All Studies.

5. Click into the Grant Access table cell for the All Studies row to show the checkbox.
6. Select the Grant Access checkbox to grant the user access to all studies with the Study Role you will choose in step 7.

7. Select the Study Role you want to grant this user from the Role drop-down.

8. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
9. Hover over the All Environments column to show the Actions menu.

10. From the** Actions** menu, select + New Role. This adds a row to the table.

11. In the new row, select a Role.
12. Repeat steps 5 through 11 until you’ve assigned this User all of their Study Roles.
13. Click Save.

Unassign a Study Role from All Studies

To remove a row and unassign a Study Role from that User, select Remove from the Actions menu in that role’s row.

Across All Environments in a Study

You can also assign a user multiple roles across all Environments in a Study. To assign a user across all environments:

1. If you aren’t already in Edit mode, click Edit.
2. Scroll to the Study Access section.
3. If your Study isn’t listed in the Accessible Studies list:
   • Click + Add Studies.
   • Use the shuttle buttons to move your Study from Available Studies to Accessible Studies.
   • Click Save.
4. Select your Study in the Accessible Studies list.

5. Select Yes for Grant Access to All Environments and Sites.

6. Select a Study Role from the Roles drop-down.
7. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
8. Hover over the Environments column to show the Actions menu.

9. From the** Actions** menu, select + New Role. This adds a row to the table.

10. In the new row, select a Study Role from the Roles drop-down.
11. Click Save.

Unassign a Study Role from the Study

To remove a row and unassign a role, select Remove from the Actions menu.

Environment by Environment

1. If you aren’t already in Edit mode, click Edit.
2. Scroll to the Study Access section.
3. If your Study isn’t listed in the Accessible Studies list:
   • Click + Add Studies.
   • Use the shuttle buttons to move your Study from Available Studies to Accessible Studies.
   • Click Save.
4. Select your Study in the Accessible Studies list.
5. Select No for Grant Access to All Environments and Sites.
6. Locate the row of the Environment that you want to grant access to.
7. Select the Grant Access checkbox to allow the user to access this environment.
8. Select a Study Role from the Roles drop-down to assign this user.
9. To assign a user access to all Sites in the Environment, select Access All Sites.
10. If you didn’t give the user all site access:
    • Allow access to all Sites in a Study Country by selecting a Country for Country Access.
    • Allow access to one or more chosen Sites by selecting specific Sites in Site Access.
11. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
12. To copy access and role assignment to another Environment:
    • Hover over the Environment that you want to copy from to show the Actions menu.

    • From the Actions menu, select Copy to Environment.

    • In the Copy From Environment dialog, select the Environment checkboxes that you want have copy the access of the source Environment.

    • Click Copy.
13. Click Save.

Unassign a Study Role from an Environment

To remove a row and unassign a role, select Clear from the Actions menu.

How to Remove Study Access

You can remove access on a study-by-study basis. This unassigns any Study Roles for that user across all Environments in that Study. To remove study access for an entire Study:

1. If you aren’t already in Edit mode, click Edit.
2. Scroll to the Study Access section.
3. Select your Study in the Accessible Studies list.

4. Click Remove Study Access.

5. Click Save.

Editing Existing Users

You can edit existing study users from EDC Tools > Users.

To edit a User:

1. Navigate to Tools > System Tools > Users.
2. Click the Last Name of the user you want to edit.
3. Click Edit.
4. Make any changes.
5. Click Save.

Any changes to user access are effective immediately.

Importing Study Users

You can also create users in your Study in bulk by importing them as User records from a CSV (.csv) or Excel ™ (.xlxs) file.

Creating the Import File

You can create an import CSV file using this template:

  Download the Template CSV

1. Download the template and open it in your preferred editor.
2. Add a row for each User you want to add to your Study.
3. Save your file.

File Restrictions

The following restrictions apply to the CSV file:

• CSV file must be smaller than 20mb.
• Use CSV UTF-8 encoding, or don’t use any special characters.

Required Columns

The following columns are required in your import file:

Column	Description	Example Value	Required
User Name	Enter the user’s User Name. The User Name is used for login.	user.name@domain.com, john.smith@verteopharma.com
Email	Enter the user’s email address.	user.name@email.com
Title	Enter the user’s Title. This is informational and doesn’t affect the user’s ability to access the application.	Principal Investigator
Last Name	Enter the user’s last name.	Smith
First Name	Enter the user’s first name.	John
Company	Enter the name of the user’s company or organization. This is informational and doesn’t affect the user’s ability to access the application.	Verteo Pharma
Federated ID	If your organization is using Single Sign-on (SSO) for authentication, enter the user’s Federated ID. Vault uses Federated ID to map enterprise user names to Vault user names for SSO. Otherwise, leave this column blank.	user.name@enterprise-domain.com
Language	Enter the user’s Language, using the language tag. See a list of languages and their appropriate entry formats here.	en
Locale	Enter the user’s Locale, using the locale tag. Available locales are limited by the selected Language. See a list of locales by language and their appropriate entry formats here.	en_US
Timezone	Enter the user’s Timezone. This column requires a special format. See a list of timezones and their appropriate entry format here.	(GMT-08:00) Pacific Standard Time (America/Los_Angeles)
Security Policy	If your organization is using SSO, enter the Name of the Security Policy for your SSO solution. Otherwise, enter Basic to use Vault authentication.	Basic
Cross Study Role	If this User is to have access to all Studies in the vault with the same Study Role, enter that Study Role here. Otherwise, leave this column blank to assign access to a specific Study. You can view a list of Study Roles from Tools > System Tools > Role Management.	CDMS Principal Investigator
Activation Date	Enter the Activation Date for the user. This is the date the user will receive their welcome email (if selected) and access to the Study. If you’re updating an existing User, note that you can only change the Activation Date if the user has not yet been activated. You can’t change the Activation Date for an active user.	2/26/21
Send Welcome Email	Enter “Yes” to send the user a Welcome Email on the Activation Date or immediately if no Activation Date was provided. Otherwise, enter “No” to skip sending the Welcome Email.	Yes
Add as Principal Investigator	Enter “Yes” to allow this user to be selected as the principal investigator for a site during site creation. Otherwise, enter “No”. Adding a user as a Principal Investigator allows them to be selected as the Principal Investigator for a site during site creation. A user can be a principal investigator (via job title or study role assignment) without having this field set to “Yes”. This field applies only to the Principal Investigator field on the Site record.	Yes
Study	Enter the Study that you want the user to access. This is the study’s name without any environment appended to it (for example, “Cholecap”, not “Cholecap_DEV1”). If you assigned the user a Cross Study Role, leave this column blank.	Cholecap
Study Environment	Enter the Study Environments (comma-separated) that you want the user to access. If you assigned the user a Cross Study Role, or if you set Access to All Environments to Yes, leave this column blank.	Cholecap_DEV1, Cholecap_UAT1, Cholecap
Access to All Environments	Enter “Yes” to allow the user to access all Study Environments for a Study with the same Study Role. Otherwise, enter “No”. If you assigned the user a Cross Study Role, leave this column blank.	No
Study Role	Enter the Study Role that you want to assign the user in the selected environments. If you assigned the user a Cross Study Role, leave this column blank.	CDMS Principal Investigator
Access to All Sites	Enter “Yes” to allow the user to access all Sites in the Study. Otherwise, enter “No” to assign access to specific sites (in the Site Access column).	No
Study Access	Enter “Enabled” to allow the user to access the Study right away. Otherwise, enter “Disabled”.	Enabled
Country Access	Enter Study Countries (comma-separated) that you want to allow the user to access. Granting access to a Study Country grants access to all Sites within that country. If you set Access to All Sites to Yes, leave this column blank.	United States
Site Access	Enter Sites (comma-separated) that you want to allow the user to access. If you set Access to All Sites to Yes, leave this column blank. If you entered countries in the Country Access column, leave this column blank.	01-101, 01-102
Ignore LMS Status	Enter “Yes” to override the user’s training status, so that they may access the Study without completing their training. Otherwise, enter “No” to require the user to complete training before accessing the Study.	No
Domain Administrator	Note that only domain administrators can manage other domain administrators. If you are not a domain administrator, leave this blank. Enter “Yes” to make the user a Domain Administrator.	Yes
Service Availability Notifications	Enter “Yes” to set the user’s preference to receive Service Availability Notififcations. Set to “No” to have the user not receive these notifications.	Yes
Product Announcement Emails	Enter “Yes” to set the user’s preference to receive Product Announcement Emails. Set to “No” to have the user not receive these announcements.	Yes
Status	Enter “Inactive” to set an existing user’s Status to Inactive. This field can only be used to inactivate active users. Use the System Tools UI to activate inactive users.	Active

Vault automatically populates the License Type (Full User) and the Generate temporary password and notify user (selected) fields for each new User upon successful import.

For cross-domain and cross-vault users, you only need to populate the following columns:

• User name
• Study Role
• Site Access
• Country Access

Vault ignores any other user details, because changes outside these columns must be made in the user’s home vault or domain.

Importing the File

To import the file:

1. Navigate to Tools > System Tools > Users.

2. Click Import From File.

3. Click Select a file.
4. Browse to and select your import file.
5. Vault uploads the file and validates your new User records. Validation results display in the Preview area. (See possible validation errors below.)
6. Optional: If your import file contains any validation errors, edit the file to resolve them. Then click Change File to re-upload your import file.
7. Once all of your new User records are ready for import, click Import. Vault begins a job to import and create all of your new User records. Vault sends you an email notification when the job is complete.
8. Click Job History or Back to Study.

Import Statuses

There are three possible statuses for a new User record as you prepare it for import:

Status	Explanation
Error	There is at least one error on this row. Errors indicate missing or invalid values.
Warning	There is at least one warning on this row. Warnings indicate conflicts with existing User records.
Ready for Import	This User record is complete and can be successfully imported into the vault.

Validation Errors

The table below lists possible validation errors and their resolutions:

Error	Field	Explanation	Steps to Resolve
{Field} is required	All	This field is required.	Provide a value for this field and re-upload your import file.
Inactive User	All	The cross-domain user is marked Inactive in their home domain.	Remove the inactive cross-domain user’s row from your CSV and re-upload your import file.
Insufficient access to create Cross Domain User	All	You do not have the Admin: Security: Users: Add Cross-Domain Users permission, which is required to create cross-domain users.	Remove the cross-domain user’s row from your CSV and re-upload your import file.
Evironment does not exist	Study Environment	The Study Environment provided doesn’t exist.	Verify that you entered the Study Environment correctly, correct any errors, and re-upload your import file.
Invalid Study Environment	Study Environment	The Study Environment provided doesn’t exist, or, if Access to All Environments is set to No, no Study Environments were provided.	Update the Study Environment and re-upload your import file.
Invalid Email Format	Email	The email provided is in an invalid format.	Verify that the email address is correct and that it is in the someone@example.com format. Remove any special characters and re-upload your import file.
Invalid User Name	User Name	The user name provided is in an invalid format, or Vault couldn’t locate a cross-domain user with the user name included in the import file.	Remove any special characters (@ ( ) [ ] . : ; < >), correct the cross-domain user’s user name, and re-upload your import file.
Invalid Timezone	Timezone	The Timezone provided is in an invalid format.	Enter a supported Timezone in the appropriate format and re-upload your import file. See a list of appropriate entry formats here.
Invalid Locale	Locale	The Locale provided does not exist in this vault, or it is not valid for the selected language.	Enter a supported Locale and re-upload your import file. See a list of appropriate entry formats here.
Invalid Language	Language	The Language provided is not supported.	Enter a supported Language and re-upload your import file. See a list of appropriate entry formats here.
Invalid Status	Study Status	The Study Status provided is not an option for this field.	Enter either “Enabled” or “Disabled” and re-upload your import file.
Invalid Security Policy	Security Policy	The Security Policy provided is not an option for this field.	Enter “Basic” and re-upload your import file.
Invalid Application Role	Cross Study Role, Study Role	The Study Role provided doesn’t exist in this vault or is spelled incorrectly.	Enter a valid Study Role (formerly known as Application Role) and re-upload your import file. You can view a list of Study Roles from the Add User dialog in System Tools > Users or from Admin > Users & Groups > Application Roles.
Invalid Site	Site Access	The Site provided does not exist in the Study or is spelled incorrectly. You also can’t list all Sites. Provide the user with All Site Access to give access to all Sites in the Study.	Enter a valid Site or list of Sites for your Study and re-upload your import file. You can view a list of Sites from EDC Tools > Sites.
Invalid Country	Country Access	The Country provided does not exist in the Study or is spelled incorrectly.	Enter a valid Study Country for your Study and re-upload your import file. You can view a list of Study Countries from EDC Tools > Study Countries.
Activation Date must be set to a future date	Activation Date	The Activation Date provided was not in the future (based on import datetime).	Update the Activation Date and re-upload your import file.
Federated ID must be no greater than 100 characters	Federated ID	The character limit for Federated ID is 100.	Enter a Federated ID within the character limit and re-upload your import file.
{Input} does not exist	Domain Administrator, Service Availability Notifications, Product Announcement Emails	This field only accepts “Yes” or “No”.	Update the Domain Administrator field and re-upload your import file.
Only a Domain Administrator can manage other Domain Administrators	Domain Administrator	Only users who are domain administrators can make changes to other Users who are also domain administrators.	Remove the rows modifying domain administrators and re-upload your import file.
Status must be Active or Inactive	Status	The Status field only accepts “Active” or “Inactive”.	Update the Status field and re-upload your import file.
Can't modify own study access	Access related fields	Vault doesn’t allow you to modify your own study access. If you need changes to your access, contact your vault’s administrator.	Remove your own user row and re-upload your import file.

Validation Warnings

The table below lists possible validation warnings and their resolutions:

Warning	Explanation	Steps to Resolve
Duplicate user record	The import file contains two (or more) duplicate rows for a single User record.	Remove the duplicate rows from your import file. For automated deployment Studies, the import file contains two (or more) duplicate rows for a single combination of User and Study Environment.
User exists. Applying study access.	This User already exists in the vault or Study Environment. Upon import, Vault does not create a new User record, and instead only adds this User to the Study.	Remove this User row from your import file. You can add this User to your Study.
Activation date will be set to today as it is not specified	You didn’t specify a date for the Activation Date, so Vault automatically sets this field to the current date.	Enter an Activation Date and re-upload your import file.
User exists. Activation date will be ignored.	The specified user already exists and is Activated. Vault will apply other changes, but it will ignore the change to the Activation Date.	None
Site and Country access will be ignored for external studies.		None

Exporting Study Users

You can export user information in your Study into a CSV file. This can be useful for record keeping and user inventory. Note that any filters you apply to the listing of Users will also apply to your export. You can also export a list of study users to import into another study, copying all Study user access settings into that Study.

To export study users:

1. Navigate to Tools > System Tools > Users.

2. From the Actions menu, select CSV.

3. Vault begins a job to create a CSV of your Users. When finished, Vault sends you an email notification with a link to download the output file.

The study user export includes all columns listed above. To import your users into another Study, update the Site Access and Country Access columns with values from the target Study and then follow these steps to import. Vault ignores the Last Login column during import.

Reset a User’s Password

When needed, you can reset an existing user’s password.

To reset a user’s password:

1. Navigate to Tools > System Tools > Users.
2. Locate the User whose password you want to reset in the list.
3. Hover over the user’s Last Name to show the Actions menu.
4. From the Actions menu, select Reset Password.
5. In the confirmation dialog, click Reset Password.

Resend a User’s Welcome Email

To resend a user’s welcome email:

1. Navigate to Tools > System Tools Users.
2. Locate the User whose welcome email you want to resend in the list.
3. Hover over the user’s Last Name to show the Actions menu.
4. From the Actions menu, select Send Welcome Email.
5. In the confirmation dialog, click Send Welcome Email.

Changing an Account’s Status

Vault doesn’t allow you to delete user accounts entirely. Instead, you can inactivate any user accounts that are no longer in use. This prevents that account from accessing Vault, but it doesn’t remove the account from the system. If needed, you can later activate that user account.

Inactivate a Single User

To inactivate a user:

1. Navigate to Tools > System Tools > Users.
2. Locate the User whose account you want to inactivate in the list.
3. Hover over the user’s Last Name to show the Actions menu.
4. From the Actions menu, select Inactivate.
5. In the confirmation dialog, click Inactivate User.

Inactivate Multiple Users

To inactivate users in bulk:

1. Navigate to Tools > System Tools > Users.
2. Select the Users that you want to inactivate. Select the Select All Users checkbox to select all users in the vault.
3. Click Inactivate.
4. In the confirmation dialog, click Inactivate.

Activate a User

To activate a user:

1. Navigate to Tools > System Tools > Users.
2. Locate the User whose account you want to activate in the list.
3. Hover over the user’s Last Name to show the Actions menu.
4. From the Actions menu, select Activate.
5. In the confirmation dialog, click Activate User.

Activate Multiple Users

To activate users in bulk:

1. Navigate to Tools > System Tools > Users.
2. Select the Users that you want to activate. Select the Select All Users checkbox to select all users in the vault.
3. Click Activate.
4. In the confirmation dialog, click Activate Users.

User Activity Report

You can use the User Activity Report to easily track a user’s activity in the vault. This report (CSV) is a chronological log of user activity, including login attempts, password resets, and more. Learn how to generate a User Activity Report.