Managing Study User Accounts & Role Assignment

This article describes how to manage a Vault CDMS user’s access to Studies and study-related data.

Prerequisites

Users with the CDMS Lead Data Manager and CDMS User Administrator study roles can perform the tasks above in System Tools by default.

If your vault uses custom Study Roles, your role must grant you the following permissions:

Type Permission Label Controls
Standard Tab System Tools Tab

Ability to access the Tools > System Tools tab

Functional Permission View Users

Ability to view Users and their access

Functional Permission Edit Users

Ability to create and edit Users and their access

If your Study contains restricted data, you must have the Restricted Data Access permission to view it.

Learn more about Study Roles.


Cross-Vault & Cross-Domain Users

In Vault, user accounts exist within a single domain. One user may not have access to every vault on a domain. Cross-vault users have access to multiple vaults on a single domain. Cross-domain users have access to multiple vaults on different domains. You can add users from other vaults on your domain, or users from other domains, to your Study from Tools > System Tools > Users.

These users can use a single set of login credentials to log in to any vault they have access to, regardless of domain. Cross-domain users log into their home domain, but the session is Vault specific. The My Vaults page, if enabled, is served from the cross-domain user’s Vault on their home domain.

Veeva Learning Integration

Vault CDMS has an integration with Veeva Learning’s Absorb learning management system, which your organization can use to prevent users from accessing study-related records before completing their assigned training curriculum. Learn more about how to use the integration.

If the integration is not enabled in your Study, you can simply enable and disable Study Access for your users.

If the integration is enabled for your Study, you have some additional options when creating and editing Users. The Study Access field is bundled with a new LMS Training Status field to roll up to Has Access. A user will have study access (Has Access set to Yes) if one of these two conditions is met:

  • The User has completed all assigned training (their LMS Training Status is Trained).
  • The User has Study Access set to Enabled and Ignore LMS Status, Assume Trained selected.

The Ignore LMS Status, Assume Trained checkbox allows you to override the user’s training status, so that they may access the Study without completing their training. This is useful when your organization is first enabling the Veeva Learning Integration and does not want to lock existing users out of a Study.

Training: Vault does not support training requirements for users with access to all studies.

Roles Limited by Environment Type

Because Studio is read only in non-development environments (UAT, training, and production), Vault includes a standard Study Role, CDMS Study Designer Read Only, that provides read only access to Studio. The CDMS Study Designer role provides complete access to Studio for users to design their study, typically in a development environment. That role cannot be assigned to users in a production environment.

Create the User’s Account

To create a new user:

  1. Navigate to Tools > System Tools > Users.
  2. Click + New User to create a new user.
  3. Enter a First Name and a Last Name.
  4. Enter a User Name. The user will use this value (with @domain.com appended) to log into Vault, for example, entering “cordelia.hunter” would have the user log in with the user name “cordelia.hunter@verteopharma.com”.
  5. Enter the user’s Email.
  6. Optional: Enter a Federated ID. If your organization is using Single Sign-On (SSO), Federated ID may be required for this user to be able to log in with SSO.
  7. Select a Security Policy.
  8. Optional: If this user is a Principal Investigator, select Yes for Add as Principal Investigator. Otherwise, leave this set to No.
  9. Optional: Enter a Title and Company. These fields are only informational, there isn’t any functionality tied to these values.
  10. Select the user’s Language. This is the language that Vault displays UI text in.
  11. Select a Locale. This informs the number and date formats that Vault uses to display numbers and dates to this user.
  12. Select a Timezone.
  13. Select an Activation Date. The User won’t be able to access the vault until this date.
  14. By default, Vault sends the Welcome Email on the chosen Activation Date. If you want to send the Welcome Email upon save, select No for Send Welcome Email on Activation Date. Otherwise, leave this set to Yes.
  15. Click Save.

To add an existing domain user to the current vault:

  1. Navigate to Tools > System Tools > Users.
  2. From the + New User menu, select + Add Existing User.
  3. Enter the user’s User Name. This must be an exact match.
  4. Click Add User.

Set the User's Study Access 21R1 & Earlier

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. If your Study isn’t listed in the Accessible Studies list:
    1. Click + Add Studies.
    2. Use the shuttle menu to move your Study from Available Studies to Accessible Studies.
    3. Click Save.
  4. Select your Study in the Accessible Studies list.
  5. Optional: To provide this user access (via the same role) to all environments and sites, select Yes for Grant Access to All Environments and Sites. Leave this set to No to set access to specific environments and sites.
  6. For each Environment, complete the following steps:
    1. Select Grant Access to allow the user to access this environment.
    2. Select a Study Role to assign this user.
    3. To assign a user access to all study sites, select Access All Sites.
    4. If you didn’t give the user all site access: Allow access to all Sites in a Study Country by selecting a Country for Country Access, or allow access to one or more chosen Sites by selecting specific Sites in Site Access.
    5. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  7. Click Save.

Set the User's Study Access 21R2 & Later

With the 21R2 release, we introduced a new security model, multi-role security. With multi-role security, a user can have multiple Study Roles in a study or in a vault with a single account and without a custom Security Profile. If your Study was created after the 21R2 release (August 2021), your Study is using this security model automatically. If your Study was created prior to the 21R2 release, you must upgrade to this model. If you haven’t upgraded, your vault is still using Role by Study. Contact your Veeva Services representative to discuss upgrading. See Set the User’s Study Access (21R1 & Earlier) for instructions to set a user’s study access in Role by Study.

A user can have up to fifteen (15) Study Roles in a single vault. For example, a user may be a lead data manager, but that user can also be assigned a CRA role to preview the study as a CRA would view it in the Review tab.

Environment by Environment

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. If your Study isn’t listed in the Accessible Studies list:
    • Click + Add Studies.
    • Use the shuttle buttons to move your Study from Available Studies to Accessible Studies.
    • Click Save.
  4. Select your Study in the Accessible Studies list.
  5. Locate the row of the Environment that you want to grant access to.
  6. Select the Grant Access checkbox to allow the user to access this environment.
  7. Select a Study Role from the Roles drop-down to assign this user.
  8. To assign a user access to all Sites in the Environment, select Access All Sites.
  9. If you didn’t give the user all site access:
    • Allow access to all Sites in a Study Country by selecting a Country for Country Access.
    • Allow access to one or more chosen Sites by selecting specific Sites in Site Access.
  10. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  11. To copy access and role assignment to another Environment:
    • Hover over the Environment that you want to copy from to show the Actions menu.
    • From the Actions menu, select Copy to Environment. Copy to Environment action

    • In the Copy From Environment dialog, select the Environment checkboxes that you want have copy the access of the source Environment. Copy to Environment dialog

    • Click Copy.
  12. Click Save.

Unassign a Study Role from an Environment

To remove a row and unassign a role, select Clear from the Actions menu.

Clear action

How to Remove Study Access

You can remove access on a study-by-study basis. This unassigns any Study Roles for that user across all Environments in that Study. To remove study access for an entire Study:

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. Select your Study in the Accessible Studies list.
  4. Click Remove Study Access. Remove Study Access

  5. Click Save.

Editing Existing Users

You can edit existing study users from EDC Tools > Users.

To edit a User:

  1. Navigate to Tools > System Tools > Users.
  2. Click the Last Name of the user you want to edit.
  3. Click Edit.
  4. Make any changes.
  5. Click Save.

Any changes to user access are effective immediately.

For cross-domain users, you can only edit their Security Profile and Application Role in your current vault. Any other changes must be made on that user’s home domain.

Importing Study Users

You can also create users in your Study in bulk by importing them as User records from a CSV (.csv) or Excel ™ (.xlxs) file.

Creating the Import File

You can create an import CSV file using this template:

  Download the Template CSV

  1. Download the template and open it in your preferred editor.
  2. Add a row for each User you want to add to your Study.
  3. Save your file.

File Restrictions

We recommend that you not import more than 1000 users at once.

  • CSV file must be smaller than 100mb.
  • Use CSV UTF-8 encoding, or don’t use any special characters.

Required Columns

The following columns are required in your import file:

Column Description Example Value Required
User Name

Enter the user’s User Name. The User Name is used for log in.

user.name@domain.com, john.smith@verteopharma.com

Email

Enter the user’s email address.

user.name@email.com

Title

Enter the user’s Title. This is informational and doesn’t affect the user’s ability to access the application.

Principal Investigator

 
Last Name

Enter the user’s last name.

Smith

First Name

Enter the user’s first name.

John

Company

Enter the name of the user’s company or organization. This is informational and doesn’t affect the user’s ability to access the application.

Verteo Pharma

 
Federated ID

If your organization is using Single Sign-on (SSO) for authentication, enter the user’s Federated ID. Vault uses Federated ID to map enterprise user names to Vault user names for SSO. Otherwise, leave this column blank.

user.name@enterprise-domain.com

Language

Enter the user’s Language, using the language tag. See a list of languages and their appropriate entry formats here.

en

Locale

Enter the user’s locale, using the locale tag. Available Locales are limited by the selected Language. See a list of locales by language and their appropriate entry format here.

en_US

Timezone

Enter the user’s timezone. This column requires a special format. See a list of timezones and their appropriate entry format here.

(GMT-08:00) Pacific Standard Time (America/Los_Angeles)

Security Policy

If your organization is using SSO, enter the Name of the Security Policy for your SSO solution. Otherwise, enter Basic to use Vault authentication.

Basic

Cross Study Role

If this User is to have access to all Studies in the vault with the same Study Role, enter that Study Role here. Otherwise, leave this column blank to assign access to a specific Study. You can view a list of Study Roles from Tools > System Tools > Role Management.

CDMS Principal Investigator

Activation Date

Enter the Activation Date for the user. This is the date the user will receive their welcome email (if selected) and access to the Study.

2/26/21

 
Send Welcome Email

Enter “Yes” to send the user a Welcome Email on the Activation Date or immediately if no Activation Date was provided. Otherwise, enter “No” to skip sending the Welcome Email.

Yes

 
Add as Principal Investigator

Enter “Yes” to add this user as a Principal Investigator. Otherwise, enter “No”. Adding a user as a Principal Investigator allows them to be selected as the Principal Investigator for a site during site creation.

Yes

Study

Enter the Study that you want the user to access. This is the study’s name without any environment appended to it (for example, “Cholecap”, not “Cholecap_DEV1”). If you assigned the user a Cross Study Role, leave this column blank.

Cholecap

Study Environment

Enter the Study Environments (comma-separated) that you want the user to access. If you assigned the user a Cross Study Role, or if you set Access to All Environments to Yes, leave this column blank.

Cholecap_DEV1, Cholecap_UAT1, Cholecap

Access to All Environments

Enter “Yes” to allow the user to access all Study Environments for a Study with the same Study Role. Otherwise, enter “No”. If you assigned the user a Cross Study Role, leave this column blank.

No

Study Role

Enter the Study Role that you want to assign the user in the selected environments. If you assigned the user a Cross Study Role, leave this column blank.

CDMS Principal Investigator

Access to All Sites

Enter “Yes” to allow the user to access all Sites in the Study. Otherwise, enter “No” to assign access to specific sites (in the Site Access column).

No

Study Access

Enter “Enabled” to allow the user to access the Study right away. Otherwise, enter “Disabled”.

Enabled

Country Access

Enter Study Countries (comma-separated) to allow the user access to. Granting access to a Study Country grants access to all Sites within that country. If you set Access to All Sites to Yes, leave this column blank.

United States

Site Access

Enter Sites (comma-separated) to allow the user access to. If you set Access to All Sites to Yes, leave this column blank. If you entered countries in the Country Access column, leave this column blank.

01-101, 01-102

Ignore LMS Status

Enter “Yes” to override the user’s training status, so that they may access the Study without completing their training. Otherwise, enter “No” to require the user to complete training before accessing the Study.

No

Vault automatically populates the License Type (Full User) and the Generate temporary password and notify user (selected) fields for each new User upon successful import.

For cross-domain and cross-vault users, you only need to populate the following columns:

  • User name
  • Study Role
  • Site Access
  • Country Access

Vault ignores any other user details, because changes outside these columns must be made in the user’s home vault or domain.

Importing the File

To import the file:

  1. Navigate to Tools > System Tools > Users.
  2. Click Import From File. Import From File button

  3. Click Select a file.
  4. Browse to and select your import file.
  5. Vault uploads the file and validates your new User records. Validation results display in the Preview area. (See possible validation errors below.)
  6. Optional: If your import file contains any validation errors, edit the file to resolve them. Then click Change File to re-upload.
  7. Once all of your new User records are ready for import, click Import. Vault begins a job to import and create all of your new User records. Vault sends you an email notification when the job is complete.
  8. Click Job History or Back to Study.

Import Statuses

There are three possible statuses for a new User record as you prepare it for import:

Status Explanation
Error There is at least one error on this row. Errors indicate missing or invalid values.
Warning There is at least one warning on this row. Warnings indicate conflicts with existing User records.
Ready for Import This User record is complete and can be successfully imported into the vault.

Validation Errors

Error Field Explanation Steps to Resolve
{Field} is required All This field is required. Provide a value for this field and re-upload your import file.
Environment does not exist Study Environment The Study Environment provided does not exist. Verify that you entered the Study Environment correctly, correct any errors, and re-upload your import file.
Invalid Email Format Email The email provided is in an invalid format. Verify that the email address is correct, and is in the someone@example.com format and remove any special characters. re-upload your import file.
Invalid User Name User Name The user name provided is in an invalid format, or Vault could not locate a cross-domain user with the user name included in your import file. Remove any special characters (@ ( ) [ ] \ . : ; < >), correct the cross-domain user’s user name, and re-upload your import file.
Invalid Timezone Timezone The timezone provided is in an invalid format. Enter a supported Time Zone and re-upload your import file. See a list of timezones and their appropriate entry format here.
Invalid Locale Locale The Locale provided does not exist in this vault, or it is not valid for the selected language. Enter a supported Locale and re-upload your import file. See a list of locales and their appropriate entry format here.
Invalid Language Language The language provided is not supported. Enter a supported Language and re-upload your import file. See a list of languages and their appropriate entry format here.
Invalid Status Study Status The Study Status provided is not an option for this field. Enter Enabled or Disabled and re-upload your import file.
Invalid Security Policy Security Policy The Security Policy provided is not an option for this field. Enter Basic and re-upload your import file.
Invalid Application Role Cross Study Role, Study Role The Application Role provided does not exist in this vault or is spelled incorrectly. Enter a valid Application Role and re-upload your import file. You can view a list of Application Roles from the Add User dialog in EDC Tools > Users or from Admin > Users & Groups > Application Roles.
Invalid Study Environment Study Environment The Study Environment provided does not exist, or, if Access to All Environments is No, no Study Environments were provided. Update the Study Environment and re-upload.
Site Access Invalid Site The Site provided does not exist in the Study or is spelled incorrectly. You also cannot list all Sites. Provide the User with Study Access to give all-site access. Enter a valid Site for your Study and re-upload your import file. You can view a list of Sites from EDC Tools > Sites.
Country Access Invalid Country The Country provided does not exist in the Study or is spelled incorrectly. Enter a valid Study Country for your Study and re-upload your import file. You can view a list of Study Countries from EDC Tools > Study Countries.
Inactive User All The cross-domain user is marked Inactive in their home domain. Remove the inactive cross-domain user’s row from your CSV and re-import.
Insufficient access to create Cross Domain User All You do not have the Admin: Security: Users: Add Cross-Domain Users permission, which is required to create cross-domain users. Remove the cross-domain user’s row from your CSV and re-upload.
Activation Date must be set to a future date Activation Date The Activation Date provided was not in the future (based on import datetime). Update the Activation Date and re-upload.
Federated ID must be no greater than 100 characters Federated ID The character limit for Federated ID is 100. Enter a Federated ID within the character limit and re-upload your import file.

Validation Warnings

Warning Explanation Steps to Resolve
Duplicate user record The import file contains two (or more) duplicate rows for a single User record. Remove the duplicate rows from your import file. For automated deployment Studies, the import file contains two (or more) duplicate rows for a single combination of User and Study Environment.
User exists. Applying Study access. This User already exists in the vault or Study Environment. Upon import, Vault does not create a new User record, and instead only adds this User to the Study. Remove this User row from your import file. You can add this User to your Study

Exporting Study Users

You can export user information in your Study into a CSV file. This can be useful for record keeping and user inventory. Note that any filters you apply to the listing of Users will also apply to your export. You can also export a list of study users to import into another study, copying all Study user access settings into that Study.

To export study users:

  1. Navigate to Tools > System Tools > Users.
  2. From the Actions menu, select CSV. CSV and User Activity Report in the Actions menu under Export

  3. Vault begins a job to create a CSV of your Users. When finished, Vault sends you an email notification with a link to download the output file.

The study user export includes all columns listed above, as well as a Last Login column (the date and time that the User last logged into Vault). To import your users into another Study, update the Site Access and Country Access columns with values from the target Study and then follow these steps to import. Vault ignores the Last Login column during import.

Reset a User’s Password

When needed, you can reset an existing user’s password.

To reset a user’s password:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose password you want to reset in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Reset Password.
  5. In the confirmation dialog, click Reset Password.

Resend a User’s Welcome Email

To resend a user’s welcome email:

  1. Navigate to Tools > System Tools Users.
  2. Locate the User whose welcome email you want to resend in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Send Welcome Email.
  5. In the confirmation dialog, click Send Welcome Email.

Changing an Account’s Status

Vault doesn’t allow you to delete user accounts entirely. Instead, you can inactivate any user accounts that are no longer in use. This prevents that account from accessing Vault, but it doesn’t remove the account from the system. If needed, you can later activate that user account.

Inactivate a Single User

To inactivate a user:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose account you want to inactivate in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Inactivate.
  5. In the confirmation dialog, click Inactivate User.

Inactivate Multiple Users

To inactivate users in bulk:

  1. Navigate to Tools > System Tools > Users.
  2. Select the Users that you want to inactivate. Select the Select All Users checkbox to select all users in the vault.
  3. Click Inactivate.
  4. In the confirmation dialog, click Inactivate.

Activate a User

To activate a user:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose account you want to activate in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Activate.
  5. In the confirmation dialog, click Activate User.

Activate Multiple Users

To activate users in bulk:

  1. Navigate to Tools > System Tools > Users.
  2. Select the Users that you want to activate. Select the Select All Users checkbox to select all users in the vault.
  3. Click Activate.
  4. In the confirmation dialog, click Activate Users.

User Activity Report

You can use the User Activity Report to easily track a user’s activity in the vault. This report (CSV) is a chronological log of user activity, including login attempts, password resets, and more. Learn how to generate a User Activity Report.