Follow
Understanding Group Administrators

***

When you are the system administrator for a large company with many departments, you might not want to manage all the groups in each department yourself. Instead, you can create one group for each department and assign each group a Group Administrator. The Group Administrator can manage the needs of the group such as user membership, layout templates, custom data, projects, and templates separate from other groups in the system. 

Designating Group Administrators

As a system administrator, you can create groups. When adding members to the groups you create, you can designate some of them as Group Administrators for the group. 
You can have multiple users designated as Group Administrators in a group. A group must have at least one Group Administrator. 
For more information about creating groups and designating Group Administrators, see the "Creating a Group" section in "Creating and Managing Groups."

Users who have been designated as a Group Administrator for a group have some capabilities that only the System Administrator has. 
For more information about the capabilities of Group Administrators, see "Capabilities of Group Administrators."

Before designating users as Group Administrators we recommend you do the following: 

  • Capture the current number of system administrators in your system.
  • Capture the number of groups you have in your system.
  • Determine whether you can change the Access Level of some of the system administrators and designate them as Group Administrators instead. 
    For more information about the capabilities of Group Administrators, see "Capabilities of Group Administrators."
  • Determine whether you want Group Administrators to be able to log in as other users, or to reset passwords for users in the groups they administer. Additional access is needed to perform these tasks. 
    For more information about the access needed to log in as or reset the passwords of other users, see "Access Needed for Group Administrators."
  • For better user management, consider assigning groups instead of users to the following objects:
    • Layout Templates
    • Schedules
    • Timesheet Profiles 

Access Needed for Group Administrators

To designate someone as a Group Administrator and allow them to perform the tasks of a system administrator for their groups, they must have the following access:

  • A Planner license
    You can designate only users with a Plan license as Group Administrators
  • Edit access to users
    NOTE We recommend granting Edit access with administrative rights to users, but this is not mandatory. If Group Administrators do not have administrative access to users, they are only able to edit users they create. 
    For more information about granting this access, see "Access Needed to Edit Users" in "Understanding User Access."
  • Group Administrative access to users is required only if you want them to perform the following tasks:
    • Log in as other users in the groups and subgroups they manage.
    • Reset the password of another user in the groups and subgroups they manage. 
      For more information about granting a user Group Administrative access to users, see "Understanding User Access."
  • Timesheets & Hours administrative access is required if you want them to assign Timesheet Profiles to users in their groups and subgroups
    For more information about granting administrative access to Timesheets & Hours, see "Administrative Access." 

Capabilities of Group Administrators

As a system or a Group Administrator, you can designate a user as a Group Administrator. For more information, see section "Creating a Group" in the article "Creating and Managing Groups."

The Group Administrators that you assign to a group can perform the following tasks for groups they manage and their users:

Creating a Subgroup and Managing Group Membership

Only system administrators can create groups. Every group must have at least one Group Administrator. 

Once designated as a Group Administrator, a user can perform the following tasks:

  • Create subgroups for the groups they administer
  • Manage the subgroups of the groups for which they are designated as an administrator
    For more information about creating a subgroup, see section "Creating a Subgroup" in the article "Creating and Managing Groups."
  • Add users to existing groups and subgroups 
    NOTE Group Administrators can add to groups and subgroups only the users for whom they have Edit access.
  • Associate users with groups and subgroups they manage when editing user profiles
    For more information about editing user profiles, see "Editing User Accounts."

The following users can add the following groups and subgroups to a user:

  • System administrators can add all groups and subgroups in the system to any user.
  • Group administrators can add the groups they manage and public groups to a user that they can edit. 
  • Users with a Plan license with administrative access to users can add any public groups to a user that they can edit. 

Creating and Editing a Group-Level Status

Only system administrators can create system-level statuses.

Group Administrators can create and edit group-level statuses. 

Group-level statuses are only visible to users who belong to those groups. 

For more information about creating or editing group-level statuses, see "Creating and Customizing Group Statuses."

Creating a Layout Template

Only system administrators can create system-level Layout Templates.

Group Administrators can create group-level Layout Templates and associate them with the groups they manage or the users that they can edit. 

Group administrators cannot assign Layout Templates to job roles or teams. 
For more information about creating Layout Templates, see "Creating and Managing Layout Templates."

Group administrators and users with a Plan license who can edit other users can add system-level and group-level Layout Templates to the users they can manage when editing their profile. 

Creating a Timesheet Profile

Only system administrators can create system-level timesheet profiles. 

Group Administrators can add system-level and group-level timesheet profiles to the users they manage when editing their profile. 

Users with a Plan license who can edit other users can add only system-level timesheet profiles to other users.  

Group Administrators can create group-level timesheet profiles, associate them with users and groups they manage, and manually generate timesheets. 
For more information about creating Timesheet Profiles, see "Creating Timesheet Profiles."

Creating a Schedule

Only system administrators can create system-level schedules and indicate a default schedule. 

Group Administrators can create and edit only schedules associated with the groups they manage. They cannot edit system-level schedules, and they cannot designate a schedule as the default schedule for the system. 
For more information about creating schedules, see "Creating Schedules."

Group Administrators and users with a Plan license who can edit other users can add a system-level or a group-level schedule to another user when they are editing that user's profile. 

Recovering Deleted Items

Group Administrators can recover deleted items for users who belong to the groups that they manage. 

The following configuration must exist before a Group Administrator can recover deleted items:

  • The item deleted is associated with a project. 
    NOTE Documents that are uploaded to the Documents area in the Global Navigation Bar and not associated with a project cannot be recovered. 
  • The project to which the deleted item originated is in a group managed by the Group Administrator.

Group Administrators can restore a project or any tasks, issues, and documents associated with the project from the Recycle Bin.
For more information about restoring items in Workfront from the Recycle Bin, see "Restoring Deleted Items."

Resetting Another User's Password

Group Administrators can reset passwords for users they can edit that are in the groups they manage. 
For more information about resetting a user's password, see "Editing User Accounts."

NOTE Group Administrators can reset only Workfront passwords. If you have integrated Workfront with an SSO solution, Group Administrators might not be able to reset passwords for other users. Those permissions are configured in your SSO system rather than in Workfront. 

The following configuration must exist before Group Administrators can restore the password of another user:

  • The user who needs a password restored is in a group managed by the Group Administrator.
    When this configuration exists, the Group Administrator can see the Reset Password link when they edit the user's profile. 
  • The Group Administrator has the User Admin (Group Users) permission enabled in their access level. This setting is disabled by default, so it must be enabled. For more information, see "Creating or Modifying Access Levels."
    Group_admin_user.png

NOTE Group Administrators cannot reset the password of a system administrator. 

Logging in as Another User

Group Administrators can log in as other users that are members of the groups they manage. For more information about logging in to Workfront as another user, see "Logging in As Another User." 
NOTE Group Administrators cannot log in as a system administrator. 

The following configuration must exist before Group Administrators can log in as another user:

  • The user that the Group Administrator is logging in as must be in a group they manage.
  • The Group Administrator has the User Admin (Group Users) permission enabled in their access level. This setting is disabled by default, so it must be enabled.
    Group_admin_user.png

Viewing Available Licenses

Group Administrators can view the number of licenses available for the groups they manage. For more information, see "Managing Available Licenses in your System."

License_Management_-_Read-only_view_for_Group_Admins.jpg

Editing Information in Another User's Profile

Group Administrators can update the following fields in another user's profile if they have the User Admin (Group Users) permission enabled in their Access Level and the user is a member of a group they manage:

  • Email Address
  • Reports To
  • Direct Reports
  • Primary Role
  • Other Roles

For more information about editing a user's profile, see "Editing User Profiles."

***

Later on, when permissions around projects will be introduced, add this to the restore items section: They must have permissions to View the project, tasks, issues, or documents before they can restore them.  (this is not true yet, but it will be and it needs to be live when they fix this - after beta 3)
For more information about permissions in Workfront, see "Understanding Permissions in the Access Model."

Linked from and links to Creating and Managing Groups, Managing Group Membership and Subgroups, Logging in as another user;  

This article last updated on 2018-11-07 16:58:18 UTC