Managing Users Across Vaults

Some vaults belong to domains with other vaults. If you have the Domain Admin user setting, you’ll see the Domain Users page, rather than the standard Users page, when you navigate to Admin > Users & Groups > Users. From this page, you can filter the user list to see only members of specific vaults, cross-domain users, or all users including home-domains and cross-domains. Note that you only have access to vaults where you have the correct permissions

This article explains additional user management options from the user administration area. To learn about managing users with the User object, see Managing the User and Person Objects..

As a user with Domain Admin access, you can also see an additional Vaults tab in the user details page. This tab lists each vault that the user belongs to, as well as the user’s security profile and license type for that vault, as long as you have access to the vault. If the user does not belong to the vault you’re currently viewing, some portions of the user details page, including the Groups and Security Overrides tabs, are not available.

This article explains additional user management options for users with Domain Admin access. To learn about options that are available for Admins without Domain Admin access, see Creating & Managing Users.

About Permissions & Settings for Domain User Management

The following settings govern whether you can access the Domain Users page and manage users across vaults:

  • For every vault, you must have a security profile with a permission set that grants these permissions:
    • Admin: Users: Create
    • Admin: Users: Edit 
  • Your user profile must have the Domain Admin setting enabled.

How to Grant Domain Admin Access

Only users who already have the Domain Admin setting can give access to another user. You can enable this setting for any user, but only users with the correct permissions on all vaults will have access to all options.

The Domain Admin setting and permissions allow access to all vaults in a multi-vault domain. This access should be limited to only the users who need it.

To grant Domain Admin access:

  1. From the user’s details page, open the Details tab.
  2. Click Edit.
  3. Select the Domain Admin checkbox.
  4. Click Save.

How to Change User Status

With Domain Admin access, you can change a user’s status for an individual vault or for the entire domain. First, open the Vaults tab from the user details page. To change the status for a vault, click Change Status in the vaults grid. To change the status for all vaults in the domain, click Change Status in the Domain Status field.

Note that a user may be Inactive in all vaults, but still have a Domain Status of Active. If the Domain Status is Inactive, the user cannot be Active in any vaults.

How to Assign License Types & Security Profiles

To change the license type or security profile assigned to a specific user, click Edit from the Vaults tab. Change the selections as needed and click Save.

Note that you can never assign a security profile that includes permissions which you do not have.

Admins can only change the license type and security profile for cross-domain users in the Details tab. These are not editable in the Vaults tab.