Managing Study User Accounts & Role Assignment

This article describes how to manage a Vault CDMS user’s access to Studies and study-related data.

Prerequisites

Users with the CDMS Lead Data Manager and CDMS User Administrator study roles can perform the tasks above in System Tools by default.

If your vault uses custom Study Roles, your role must grant you the following permissions:

Type Permission Label Controls
Standard Tab System Tools Tab

Ability to access the Tools > System Tools tab

Functional Permission View Users

Ability to view Users and their access

Functional Permission Edit Users

Ability to create and edit Users and their access

If your Study contains restricted data, you must have the Restricted Data Access permission to view it.

Learn more about Study Roles.


Cross-Vault & Cross-Domain Users

In Vault, user accounts exist within a single domain. One user may not have access to every vault on a domain. Cross-vault users have access to multiple vaults on a single domain. Cross-domain users have access to multiple vaults on different domains. You can add users from other vaults on your domain, or users from other domains, to your Study from Tools > System Tools > Users.

These users can use a single set of login credentials to log in to any vault they have access to, regardless of domain. Cross-domain users log into their home domain, but the session is Vault specific. The My Vaults page, if enabled, is served from the cross-domain user’s Vault on their home domain.

Veeva Learning Integration

Vault CDMS has an integration with Veeva Learning’s Absorb learning management system, which your organization can use to prevent users from accessing study-related records before completing their assigned training curriculum. Learn more about how to use the integration.

If the integration is not enabled in your Study, you can simply enable and disable Study Access for your users.

If the integration is enabled for your Study, you have some additional options when creating and editing Users. The Study Access field is bundled with a new LMS Training Status field to roll up to Has Access. A user will have study access (Has Access set to Yes) if one of these two conditions is met:

  • The User has completed all assigned training (their LMS Training Status is Trained).
  • The User has Study Access set to Enabled and Ignore LMS Status, Assume Trained selected.

The Ignore LMS Status, Assume Trained checkbox allows you to override the user’s training status, so that they may access the Study without completing their training. This is useful when your organization is first enabling the Veeva Learning Integration and does not want to lock existing users out of a Study.

Roles Limited by Environment Type

Because Studio is read only in non-development environments (UAT, training, and production), Vault includes a standard Study Role, CDMS Study Designer Read Only, that provides read only access to Studio. The CDMS Study Designer role provides complete access to Studio for users to design their study, typically in a development environment. That role cannot be assigned to users in a production environment.

Roles Requiring All Sites Access

Certain roles require All Sites access. In the current release, the current standard Study Roles require All Sites access:

  • CDMS API Read Write
  • CDMS Clinical Coder
  • CDMS Clinical Coder Administrator
  • CDMS Clinical Coder Manager

Create the User’s Account

To create a new user:

  1. Navigate to Tools > System Tools > Users.
  2. Click + New User to create a new user.
  3. Enter a First Name and a Last Name.
  4. Enter a User Name. The user will use this value (with @domain.com appended) to log into Vault, for example, entering “cordelia.hunter” would have the user log in with the user name “cordelia.hunter@verteopharma.com”.
  5. Enter the user’s Email.
  6. Optional: Enter a Federated ID. If your organization is using Single Sign-On (SSO), Federated ID may be required for this user to be able to log in with SSO.
  7. Select a Security Policy.
  8. Optional: If you want to assign this user as the designated Principal Investigator for a Site during site creation, select Yes for Add as Principal Investigator. Otherwise, leave this set to No. Adding a user as a Principal Investigator allows them to be selected as the Principal Investigator for a site during site creation. A user can be a principal investigator (via job title or study role assignment) without having this field set to “Yes”. This field applies only to the Principal Investigator field on the Site record.
  9. Optional: Enter a Title and Company. These fields are only informational, there isn’t any functionality tied to these values.
  10. Select the user’s Language. This is the language that Vault displays UI text in.
  11. Select a Locale. This informs the number and date formats that Vault uses to display numbers and dates to this user.
  12. Select a Timezone.
  13. Select an Activation Date. The User won’t be able to access the vault until this date.
  14. By default, Vault sends the Welcome Email on the chosen Activation Date. If you want to send the Welcome Email upon save, select No for Send Welcome Email on Activation Date. Otherwise, leave this set to Yes.
  15. Click Save.

To add an existing domain user to the current vault:

  1. Navigate to Tools > System Tools > Users.
  2. From the + New User menu, select + Add Existing User.
  3. Enter the user’s User Name. This must be an exact match.
  4. Click Add User.

Set the User's Study Access 21R1 & Earlier

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. If your Study isn’t listed in the Accessible Studies list:
    1. Click + Add Studies.
    2. Use the shuttle menu to move your Study from Available Studies to Accessible Studies.
    3. Click Save.
  4. Select your Study in the Accessible Studies list.
  5. Optional: To provide this user access (via the same role) to all environments and sites, select Yes for Grant Access to All Environments and Sites. Leave this set to No to set access to specific environments and sites.
  6. For each Environment, complete the following steps:
    1. Select Grant Access to allow the user to access this environment.
    2. Select a Study Role to assign this user.
    3. To assign a user access to all study sites, select Access All Sites.
    4. If you didn’t give the user all site access: Allow access to all Sites in a Study Country by selecting a Country for Country Access, or allow access to one or more chosen Sites by selecting specific Sites in Site Access.
    5. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  7. Click Save.

Set the User's Study Access 21R2 & Later

With the 21R2 release, we introduced a new security model, multi-role security. With multi-role security, a user can have multiple Study Roles in a study or in a vault with a single account and without a custom Security Profile. If your vault was created after the 21R2 release (August 2021), your vault is using this security model automatically. If your vault was created prior to the 21R2 release, you must upgrade to this model. If you haven’t upgraded, your vault is still using Role by Study. Contact your Veeva Services representative to discuss upgrading. See Set the User’s Study Access (21R1 & Earlier) for instructions to set a user’s study access in Role by Study.

With multi-role security, you can assign a User a Study Role across all Studies in the vault, across all Environments in a Study, or to one or more Environments in a Study. A user can have up to fifteen (15) Study Roles in a single vault. For example, a user may be a lead data manager, but that user can also be assigned a CRA role to preview the study as a CRA would view it in the Review tab.

Across All Studies

To assign a user a_ Study Role_ or multiple Study Roles across all Studies in the vault:

  1. Navigate to the User in Tools > System Tools > Users.
  2. If you aren’t already in Edit mode, click Edit.
  3. Scroll to the Study Access section.
  4. Select Yes for Grant Access to All Studies. Grant Access to All Studies set to Yes

  5. Click into the Grant Access table cell for the All Studies row to show the checkbox.
  6. Select the Grant Access checkbox to grant the user access to all studies with the Study Role you will choose in step 7.
  7. Select the Study Role you want to grant this user from the Role drop-down. Select Role

  8. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  9. Hover over the All Environments column to show the Actions menu.
  10. From the** Actions** menu, select + New Role. This adds a row to the table. New Role action

  11. In the new row, select a Role.
  12. Repeat steps 5 through 11 until you’ve assigned this User all of their Study Roles.
  13. Click Save.

Unassign a Study Role from All Studies

To remove a row and unassign a Study Role from that User, select Remove from the Actions menu in that role’s row.

Remove action

Across All Environments in a Study

You can also assign a user multiple roles across all Environments in a Study. To assign a user across all environments:

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. If your Study isn’t listed in the Accessible Studies list:
    • Click + Add Studies.
    • Use the shuttle buttons to move your Study from Available Studies to Accessible Studies.
    • Click Save.
  4. Select your Study in the Accessible Studies list.
  5. Select Yes for Grant Access to All Environments and Sites. Grant Access to All Environments and Sites set to Yes

  6. Select a Study Role from the Roles drop-down.
  7. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  8. Hover over the Environments column to show the Actions menu.
  9. From the** Actions** menu, select + New Role. This adds a row to the table. New Role action

  10. In the new row, select a Study Role from the Roles drop-down.
  11. Click Save.

Unassign a Study Role from the Study

To remove a row and unassign a role, select Remove from the Actions menu.

Remove action

Environment by Environment

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. If your Study isn’t listed in the Accessible Studies list:
    • Click + Add Studies.
    • Use the shuttle buttons to move your Study from Available Studies to Accessible Studies.
    • Click Save.
  4. Select your Study in the Accessible Studies list.
  5. Select No for Grant Access to All Environments and Sites.
  6. Locate the row of the Environment that you want to grant access to.
  7. Select the Grant Access checkbox to allow the user to access this environment.
  8. Select a Study Role from the Roles drop-down to assign this user.
  9. To assign a user access to all Sites in the Environment, select Access All Sites.
  10. If you didn’t give the user all site access:
    • Allow access to all Sites in a Study Country by selecting a Country for Country Access.
    • Allow access to one or more chosen Sites by selecting specific Sites in Site Access.
  11. Optional: Select Ignore LMS Status, Assume Trained if you’re using the Veeva Learning Integration but want this user to be able to access the Study without completing assigned training curriculums. For example, you may want to select this option for study designers in your development environment so that they can begin their design work without waiting for training.
  12. To copy access and role assignment to another Environment:
    • Hover over the Environment that you want to copy from to show the Actions menu.
    • From the Actions menu, select Copy to Environment. Copy to Environment action

    • In the Copy From Environment dialog, select the Environment checkboxes that you want have copy the access of the source Environment. Copy to Environment dialog

    • Click Copy.
  13. Click Save.

Unassign a Study Role from an Environment

To remove a row and unassign a role, select Clear from the Actions menu.

Clear action

How to Remove Study Access

You can remove access on a study-by-study basis. This unassigns any Study Roles for that user across all Environments in that Study. To remove study access for an entire Study:

  1. If you aren’t already in Edit mode, click Edit.
  2. Scroll to the Study Access section.
  3. Select your Study in the Accessible Studies list.
  4. Click Remove Study Access. Remove Study Access

  5. Click Save.

Editing Existing Users

You can edit existing study users from EDC Tools > Users.

To edit a User:

  1. Navigate to Tools > System Tools > Users.
  2. Click the Last Name of the user you want to edit.
  3. Click Edit.
  4. Make any changes.
  5. Click Save.

Any changes to user access are effective immediately.

For cross-domain users, you can only edit their Security Profile and Application Role in your current vault. Any other changes must be made on that user’s home domain.

Importing Study Users

You can also create users in your Study in bulk by importing them as User records from a CSV (.csv) or Excel ™ (.xlxs) file.

Creating the Import File

You can create an import CSV file using this template:

  Download the Template CSV

  1. Download the template and open it in your preferred editor.
  2. Add a row for each User you want to add to your Study.
  3. Save your file.

File Restrictions

The following restrictions apply to the CSV file:

  • CSV file must be smaller than 20mb.
  • Use CSV UTF-8 encoding, or don’t use any special characters.

Required Columns

The following columns are required in your import file:

Column Description Example Value Required
User Name

Enter the user’s User Name. The User Name is used for log in.

user.name@domain.com, john.smith@verteopharma.com

Email

Enter the user’s email address.

user.name@email.com

Title

Enter the user’s Title. This is informational and doesn’t affect the user’s ability to access the application.

Principal Investigator

 
Last Name

Enter the user’s last name.

Smith

First Name

Enter the user’s first name.

John

Company

Enter the name of the user’s company or organization. This is informational and doesn’t affect the user’s ability to access the application.

Verteo Pharma

 
Federated ID

If your organization is using Single Sign-on (SSO) for authentication, enter the user’s Federated ID. Vault uses Federated ID to map enterprise user names to Vault user names for SSO. Otherwise, leave this column blank.

user.name@enterprise-domain.com

Language

Enter the user’s Language, using the language tag. See a list of languages and their appropriate entry formats here.

en

Locale

Enter the user’s locale, using the locale tag. Available Locales are limited by the selected Language. See a list of locales by language and their appropriate entry format here.

en_US

Timezone

Enter the user’s timezone. This column requires a special format. See a list of timezones and their appropriate entry format here.

(GMT-08:00) Pacific Standard Time (America/Los_Angeles)

Security Policy

If your organization is using SSO, enter the Name of the Security Policy for your SSO solution. Otherwise, enter Basic to use Vault authentication.

Basic

Cross Study Role

If this User is to have access to all Studies in the vault with the same Study Role, enter that Study Role here. Otherwise, leave this column blank to assign access to a specific Study. You can view a list of Study Roles from Tools > System Tools > Role Management.

CDMS Principal Investigator

Activation Date

Enter the Activation Date for the user. This is the date the user will receive their welcome email (if selected) and access to the Study. If you’re updating an existing User, note that you can only change the Activation Date if the user has not yet been activated. You can’t change the Activation Date for an active user.

2/26/21

 
Send Welcome Email

Enter “Yes” to send the user a Welcome Email on the Activation Date or immediately if no Activation Date was provided. Otherwise, enter “No” to skip sending the Welcome Email.

Yes

 
Add as Principal Investigator

Enter “Yes” to allow this user to be selected as the principal investigator for a site during site creation. Otherwise, enter “No”. Adding a user as a Principal Investigator allows them to be selected as the Principal Investigator for a site during site creation. A user can be a principal investigator (via job title or study role assignment) without having this field set to “Yes”. This field applies only to the Principal Investigator field on the Site record.

Yes

Study

Enter the Study that you want the user to access. This is the study’s name without any environment appended to it (for example, “Cholecap”, not “Cholecap_DEV1”). If you assigned the user a Cross Study Role, leave this column blank.

Cholecap

Study Environment

Enter the Study Environments (comma-separated) that you want the user to access. If you assigned the user a Cross Study Role, or if you set Access to All Environments to Yes, leave this column blank.

Cholecap_DEV1, Cholecap_UAT1, Cholecap

Access to All Environments

Enter “Yes” to allow the user to access all Study Environments for a Study with the same Study Role. Otherwise, enter “No”. If you assigned the user a Cross Study Role, leave this column blank.

No

Study Role

Enter the Study Role that you want to assign the user in the selected environments. If you assigned the user a Cross Study Role, leave this column blank.

CDMS Principal Investigator

Access to All Sites

Enter “Yes” to allow the user to access all Sites in the Study. Otherwise, enter “No” to assign access to specific sites (in the Site Access column).

No

Study Access

Enter “Enabled” to allow the user to access the Study right away. Otherwise, enter “Disabled”.

Enabled

Country Access

Enter Study Countries (comma-separated) to allow the user access to. Granting access to a Study Country grants access to all Sites within that country. If you set Access to All Sites to Yes, leave this column blank.

United States

Site Access

Enter Sites (comma-separated) to allow the user access to. If you set Access to All Sites to Yes, leave this column blank. If you entered countries in the Country Access column, leave this column blank.

01-101, 01-102

Ignore LMS Status

Enter “Yes” to override the user’s training status, so that they may access the Study without completing their training. Otherwise, enter “No” to require the user to complete training before accessing the Study.

No

Domain Administrator

If you are not a domain administrator, leave this blank. Enter “Yes” to make the user a Domain Administrator. Note that only domain administrators can manage other domain administrators. Otherwise, enter “No”.

Yes

 
Service Availability Notifications

Enter “Yes” to set the user’s preference to receive Service Availability Notififcations. Set to “No” to have the user not receive these notifications.

Yes

Product Announcement Emails

Enter “Yes” to set the user’s preference to receive Product Announcement Emails. Set to “No” to have the user not receive these announcements.

Yes

Status

Enter “Inactive” to set an existing user’s Status to Inactive. This field can only be used to inactivate active users. Use the System Tools UI to activate inactive users.

Active

Vault automatically populates the License Type (Full User) and the Generate temporary password and notify user (selected) fields for each new User upon successful import.

Case Sensitivity: The matching of values in the import file to those values in CDMS is case-sensitive.

For cross-domain and cross-vault users, you only need to populate the following columns:

  • User name
  • Study Role
  • Site Access
  • Country Access

Vault ignores any other user details, because changes outside these columns must be made in the user’s home vault or domain.

Importing the File

To import the file:

  1. Navigate to Tools > System Tools > Users.
  2. Click Import From File. Import From File button

  3. Click Select a file.
  4. Browse to and select your import file.
  5. Vault uploads the file and validates your new User records. Validation results display in the Preview area. (See possible validation errors below.)
  6. Optional: If your import file contains any validation errors, edit the file to resolve them. Then click Change File to re-upload.
  7. Once all of your new User records are ready for import, click Import. Vault begins a job to import and create all of your new User records. Vault sends you an email notification when the job is complete.
  8. Click Job History or Back to Study.

Import Statuses

There are three possible statuses for a new User record as you prepare it for import:

Status Explanation
Error There is at least one error on this row. Errors indicate missing or invalid values.
Warning There is at least one warning on this row. Warnings indicate conflicts with existing User records.
Ready for Import This User record is complete and can be successfully imported into the vault.

Validation Errors

The table below lists possible validation errors and their resolutions:

Error Field Explanation Steps to Resolve
{Field} is required All

This field is required.

Provide a value for this field and re-upload your import file.
Inactive User All

The cross-domain user is marked Inactive in their home domain.

Remove the inactive cross-domain user’s row from your CSV and re-import.
Insufficient access to create Cross Domain User All

You do not have the Admin: Security: Users: Add Cross-Domain Users permission, which is required to create cross-domain users.

Remove the cross-domain user’s row from your CSV and re-upload.
Evironment does not exist Study Environment

The Study Environment provided doesn’t exist.

Verify that you entered the Study Environment correctly, correct any errors, and re-import your import file.
Invalid Study Environment Study Environment

The Study Environment provided doesn’t exist, or, if Access to All Environments is set to No, no Study Environments were provided.

Update the Study Environment and re-upload your import file.
Invalid Email Format Email

The email provided is in an invalid format.

Verify that the email address is correct and that it is in the someone@example.com format. Remove any special characters. Re-upload your import file.
Invalid User Name User Name

The user name provided is in an invalid format, or Vault couldn’t locate a cross-domain user with the user name included in the import file.

Remove any special characters (@ ( ) [ ] . : ; < >), correct the cross-domain user’s user name, and re-upload your import file.
Invalid Timezone Timezone

The timezone provided is in an invalid format.

Enter a supported Timezone in the appropriate format and re-upload your import file. See a list of appropriate entry formats here.
Invalid Locale Locale

The Locale provided does not exist in this vault, or it is not valid for the selected language.

Enter a supported Locale and re-upload your import file. See a list of appropriate entry formats here.
Invalid Language Language

The language provided is not supported.

Enter a supported Language and re-upload your import file. See a list of appropriate entry formats here.
Invalid Status Study Status

The Study Status provided is not an option for this field.

Enter either “Enabled” or “Disabled” and re-upload your import file.
Invalid Security Policy Security Policy

The Security Policy provided is not an option for this field.

Enter “Basic” and re-upload your import file.
Invalid Application Role Cross Study Role, Study Role

The Study Role provided doesn’t exist in this vault or is spelled incorrectly.

Enter a valid Study Role (formerly known as Application Role) and re-upload your import file. You can view a list of Study Roles from the Add User dialog in System Tools > Users or from Admin > Users & Groups > Application Roles.
Invalid Site Site Access

The Site provided does not exist in the Study or is spelled incorrectly. You also can’t list all Sites. Provide the user with All Site Access to give access to all Sites in the Study.

Enter a valid Site or list of Sites for your Study and re-import your import file. You can view a list of Sites from EDC Tools > Sites.
Invalid Country Country Access

The Country provided does not exist in the Study or is spelled incorrectly.

Enter a valid Study Country for your Study and re-upload your import file. You can view a list of Study Countries from EDC Tools > Study Countries.
Activation Date must be set to a future date Activation Date

The Activation Date provided was not in the future (based on import datetime).

Update the Activation Date and re-upload.
Federated ID must be no greater than 100 characters Federated ID

The character limit for Federated ID is 100.

Enter a Federated ID within the character limit and re-upload your import file.
{Input} does not exist Domain Administrator, Service Availability Notifications, Product Announcement Emails

This field only accepts “Yes” or “No”.

Update the Domain Administrator field and re-upload your import file.
Only a Domain Administrator can manage other Domain Administrators Domain Administrator

Only users who are domain administrators can make changes to other Users who are also domain administrators.

Remove the rows modifying domain administrators and re-upload your import file.
Status must be Active or Inactive Status

The Status field only accepts “Active” or “Inactive”.

Update the Status field and re-upload your import file.

Validation Warnings

The table below lists possible validation warnings and their resolutions:

Warning Explanation Steps to Resolve
Duplicate user record

The import file contains two (or more) duplicate rows for a single User record.

Remove the duplicate rows from your import file. For automated deployment Studies, the import file contains two (or more) duplicate rows for a single combination of User and Study Environment.

User exists. Applying study access.

his User already exists in the vault or Study Environment. Upon import, Vault does not create a new User record, and instead only adds this User to the Study.

Remove this User row from your import file. You can add this User to your Study.

Exporting Study Users

You can export user information in your Study into a CSV file. This can be useful for record keeping and user inventory. Note that any filters you apply to the listing of Users will also apply to your export. You can also export a list of study users to import into another study, copying all Study user access settings into that Study.

To export study users:

  1. Navigate to Tools > System Tools > Users.
  2. From the Actions menu, select CSV. CSV and User Activity Report in the Actions menu under Export

  3. Vault begins a job to create a CSV of your Users. When finished, Vault sends you an email notification with a link to download the output file.

The study user export includes all columns listed above. To import your users into another Study, update the Site Access and Country Access columns with values from the target Study and then follow these steps to import. Vault ignores the Last Login column during import.

Reset a User’s Password

When needed, you can reset an existing user’s password.

To reset a user’s password:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose password you want to reset in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Reset Password.
  5. In the confirmation dialog, click Reset Password.

Resend a User’s Welcome Email

To resend a user’s welcome email:

  1. Navigate to Tools > System Tools Users.
  2. Locate the User whose welcome email you want to resend in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Send Welcome Email.
  5. In the confirmation dialog, click Send Welcome Email.

Changing an Account’s Status

Vault doesn’t allow you to delete user accounts entirely. Instead, you can inactivate any user accounts that are no longer in use. This prevents that account from accessing Vault, but it doesn’t remove the account from the system. If needed, you can later activate that user account.

Inactivate a Single User

To inactivate a user:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose account you want to inactivate in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Inactivate.
  5. In the confirmation dialog, click Inactivate User.

Inactivate Multiple Users

To inactivate users in bulk:

  1. Navigate to Tools > System Tools > Users.
  2. Select the Users that you want to inactivate. Select the Select All Users checkbox to select all users in the vault.
  3. Click Inactivate.
  4. In the confirmation dialog, click Inactivate.

Activate a User

To activate a user:

  1. Navigate to Tools > System Tools > Users.
  2. Locate the User whose account you want to activate in the list.
  3. Hover over the user’s Last Name to show the Actions menu.
  4. From the Actions menu, select Activate.
  5. In the confirmation dialog, click Activate User.

Activate Multiple Users

To activate users in bulk:

  1. Navigate to Tools > System Tools > Users.
  2. Select the Users that you want to activate. Select the Select All Users checkbox to select all users in the vault.
  3. Click Activate.
  4. In the confirmation dialog, click Activate Users.

User Activity Report

You can use the User Activity Report to easily track a user’s activity in the vault. This report (CSV) is a chronological log of user activity, including login attempts, password resets, and more. Learn how to generate a User Activity Report.