General information

Roles can be added to users in three ways:

Directly on the user (Role→User)
Inherited via a group which the user is a part of (Role→Group→User)
Inherited via a group that has the role inherited from another group (Role→Group→Group→User) (Technically, you can have unlimited groups in groups - but the groups must never create a circular reference)

Users can simultaneously have roles added directly and roles inherited via groups - having the same role added twice (or multiple times) doesn't have an impact. Removing e.g. a group with a duplicate role - will still leave your user with the role.

Roles and groups that have been inherited, will be greyed out. (You also inherit download qualities, but our current implementation does not make them show up. In a perfect world, the inherited download qualities would show up as greyed out)

If you have duplicate roles then the role will have a (+) appended

CRUD
Create	Make new things
Read	Retrieve existing things
Update	Change existing things
Delete	Delete existing things

List of roles

This list is descriptive, meaning that it's not prescriptive.

Essentially, this means that this list describes what it currently does - not what it's supposed to do. As time goes on, these two things should align 100%.

#	Roles	DC	MM	OC	Marked for deletion by:	Description
1	Administrator	✓	✗			Used internally to access different internal apis, like loading workflows in a format that can actually be initialized. Should be given to the System user.
2	Ai_Add	✗	✓			Enables you to use AI tagging on images. Requires additional setup if you don't want to use Digizuite's Azure account for it. Requires an EditMultiComboVlaue to be defined in MM's config manager.
3	Ai_Translate	✗	✓			If you have AI tagging enabled, this role allows you to translate values into other languages automatically.
4	Asset_Can_Crop	✗	✓			Is the gateway to use crop. On its own, it only supports sending out "crops" via email. This role can be combined with "Asset_Can_Revise" to make an asset have crops as children - and "Asset_Can_Replace" which enables the crop to supersede the asset being cropped-
5	Asset_Can_Delete_Permanently	✓	✗			Enables one to remove an asset + all its metadata from all places (storage, Azure storage, database)
6	Asset_Can_Download	✗	✓			Enables one to download an asset and print published assets (assets without a lock). You need to have download qualities added, to be able to download assets. These are assigned via groups. Groups with download qualities are: "Guest", "Light Users", "Content Creators", "Administrators", and "Super Administrators"
7	Asset_Can_Download_Custom_Quality	✗	✓			Gives one the option to download an asset in either another colorspace (e.g. sRGB, greyscale) or another filetype (jpg, png)
8	Asset_Can_Replace	✓	✓			Enables assets to be replaced via the MM. It requires "write rights" to the asset to work. It also allows for assets to be replaced by crops + it enables restoring older versions of the asset via the "Asset history" (Effectively reverting a replace)
9	Asset_Can_Revise	✗	✓			Enables one to make crops into child assets
10	AuditTrail_View	✗	✓			Enables one to look at all assets' audit trail (basically metadata history). Please be aware that very few things are "audited" out of the box
11	Can_Change_Styling_And_Theming	✗	✓			Gives one the ability to change the channel's logo and color (theming/styling) via the MM
12	Can_Edit_Automation_Workflow	✗	✓			Allows the user to see and edit automations
13	Can_Live_Export_Asset_Only	✗	✓			Allows the user to create an export that contains only assets. Also required to enable sharing by zip.
14	Can_Live_Export_Assets_And_Metadata	✗	✓			Allows the user to create an export that contains both assets and metadata
15	Can_Live_Export_Metadata_Only	✗	✓			Allows the user to create an export that contains only metadata
16	Can_View_Automation_Workflow_Status	✗	✓			Allows the user to view the status of running automations
17	Can_View_Logs	✗	✓			Allows the user to view some logs directly in the MM UI
19	Can_Open_Office_Documents	✗	✓			Enables one to open Office documents in the Office Connector via the MM. Supports PowerPoints, Word, and Excel formats (incl. macros and templates)
20	Comments_Admin_Delete	✓	✓			Enables one to Delete other peoples' comments - e.g. to remove spam
94	Comments_Admin_Update	✓	✓			Enables one to Update other people's comments
21	Comments_CRUD	✓	✓			Enables one to Create (own), Update (own), Delete (own) comments (for tasks and images) and Create (own), Update (own), Delete (own), annotations on images. It requires Comment_View to function.
22	Comment_View	✓	✓			Enables one to Read (all) comments (assets and tasks) and Read (all) annotations
23	Editor_Catalogs	✓	✗			Enables "Catalog" in the left side menu
24	Editor_Portal	✓	✗			Enables "Channels" in the left side menu
25	Editor_Portal_Admin	✓	✗		LS	Does nothing beyond what "Editor_Portal" already does. Deprecated.
26	Editor_SystemTools_AllwaysAllowItemSecurityEdit	✓	✓			This role at its purest Every time the user reads, it'll skip the mandatory security check. It'll grant you access to change rights for all items. Gives you read access to everything you've added - e.g. makes all Catalog and Channel folders appear if you've added "Editor_Catalogs" and "Editor_Portal". It only in the DC - It does not give you read access to the added assets in the MM, even though you seemingly have read access to them when you look at it Channels in DC. With this, you can give yourself (and others) write access to folders you don't have write access to. It also adds "System Tools" to the left side menu - but it is blank - meaning that there are not any system tools in it. It opens up for access to content in Media Manager. Here this role gives you high-level access. It gives you access to all collections for all users in the system
27	Editor_SystemTools_Config	✓	✗			Enables System Tools → ConfigManager
28	Editor_SystemTools_Dam	✓	✗			Enables one to select all catalog and channel folders in System tools → Workflow → AssetSyncFolder → "Sync rootfolder"/"Destination folder". Without this role, one can only select folders that you have read-access to.
29	Editor_SystemTools_Destinations	✓	✗			Enables System Tools → Destinations
30	Editor_SystemTools_DigizuiteConfig	✓	✗			Enables System Tools → Digizuite™ configuration AND Enables System Tools → Asset type configuration
31	Editor_SystemTools_License	✓	✗			Enables System Tools → License
32	Editor_SystemTools_MediaFormat	✓	✗			Enables System Tools → Formats
33	Editor_SystemTools_MediaFormatType	✓	✗			Enables System Tools → Format types
34	Editor_SystemTools_Metadata	✓	✗			Enables System Tools → Metadata
35	Editor_SystemTools_MetaDataLanguage	✓	✗			Enables System Tools → Language
36	Editor_SystemTools_PlayerTemplate	✓	✗		LS	Deprecated with the deprecation of player templates. There is a cleanup task already for player template.
37	Editor_SystemTools_Profiles	✓	✗			Enables System Tools → Profiles
38	Editor_SystemTools_Status	✓	✗			Enables System Tools → Status
39	Editor_SystemTools_Stopwords	✓	✗			Enables System Tools → Search stop words
40	Editor_SystemTools_TranscodeSetting	✓	✗			Enables System Tools → Transcode settings
41	Editor_SystemTools_UserManager_Groups	✓	✗			Enables System Tools → Users and groups → Groups
42	Editor_SystemTools_UserManager_Users	✓	✗			Enables System Tools → Users and groups → Users
43	Editor_SystemTools_Workflow	✓	✗			Enables System Tools → Workflow
44	GDPR_Admin	✗	✗			It gives you the right to Read and Delete other users' data. There is no UI for this.
45	Integration_Endpoints_CRUD	✗	✓			Gives one the ability to Create, Read, Update, Delete integration endpoints
46	Integration_Endpoints_View	✗	✓			Gives one the ability to Read existing integration endpoints
47	ItemControlAdmin	✓	✗		LS	Unused.
48	MediaPortal_Admin_Log	✗	✓		SF	Not implemented - to be deleted
49	MediaPortal_Admin_StartScreen	✗	✓			Enables one to change the start screen from the MM
50	MediaPortal_Admin_Trash	✗	✓		SF	Not implemented - to be deleted
51	MediaPortal_Admin_Users	✗	✓		SF	Not implemented - to be deleted
52	MediaPortal_Asset_Replacer	✗	✓		SF	Not implemented - to be deleted - Use "Asset_Can_Replace" instead
53	MediaPortal_Asset_Unpublisher	✗	✓		SF	Not implemented - to be deleted
54	MediaPortal_Can_Preview_Office	✗	✓			Enables one to use Online Office to preview Office documents. This requires the site to be accessible from the outside (i.e. only works on sites where VPN isn't needed to access the site). It can be accessed by previewing, the same way you would an image.
55	MediaPortal_Collection	✗	✓			Enables users to Create, Update (their own), and Delete (their own) collections. All users can Read collections - though they have to be accessed via mail
56	MediaPortal_CustomQuality	✗	✓		SF	Not implemented - to be deleted - Use "Asset_Can_Download_Custom_Quality" instead
57	MediaPortal_Downloader	✗	✓		SF	Not implemented - to be deleted - Use "Asset_Can_Download" instead
58	MediaPortal_Edit_Account	✗	✓		SF	Not implemented - to be deleted
59	Member_Viewer	✗	✓			Allows the user to see other members of the portal (e.g. during the "asset status", "comment", and "sharing" processes, where it's needed to see internal users)
60	MediaPortal_See_Asset_Info_Default	✗	✓		SF	Not implemented - to be deleted
61	MediaPortal_See_Profile_Images	✗	✓		SF	Not implemented - to be deleted - Use config manager instead
62	MediaPortal_See_Uploader_Name	✗	✓		SF	Not implemented - to be deleted - Use config manager instead
63	MediaPortal_Share	✗	✓			Enables one to share via the MM UI. Enabling this gives you the ability to share assets via: URL, Zip (email), social media - and if collections are enabled one can also share assets via: New collection (create new), and Existing collection (add to existing). If collections are enabled, one can share them via: Zip (a package over mail), Social media, and Collection (give people rights to preview the collection from MM) If the following is enabled "Give new recipients of non-social collections (e.g. not Facebook collections) access to manipulate collections:" via config manager, the recipient will be able to CRUD the collection, else the recipient will only be able to Read the collection. Sharing over social media makes the shared asset publicly available. One needs to manually revoke the read rights on the asset level, to make it internal again. Note: Sharing by zip also requires the Can_Live_Export_Asset_Only role.
64	MediaPortal_Uploader	✗	✓			Gives one the ability to upload via the MM (one still needs "write rights" to the Upload folder though - the "Trusted" role will give you this) + shows the "your uploads"
65	MediaPortal_User	✗	✓			Required to access to MM
66	MediaPortal_Video_Embed	✗	✓			Requires "MediaPortal_Share" + some settings in CondigManager to work (See the table in the bottom of this page - ctrl+f "embed") Adds embed as a sharing option. It only works with videos.
67	RunningJobs_AdminViewSubmitXML	✓	✗			Makes "Create XML" show in the "Info" tab. Requires at least
68	RunningJobs_ChangePriority	✗	✗			Might be reintroduced in the future
69	RunningJobs_EditAll	✓	✗			Gives you Write rights to all jobs in "Running jobs". It gives you the ability to press "Upload again" and "Retry". It does not require "RunningJobs_EditOwn" in order to work. Requires "RunningJobs_View" - else you won't see any jobs.
70	RunningJobs_EditOwn	✓	✗			Gives you Write rights to all jobs in "Running jobs" → "[Your user]". It gives you the ability to press "Upload again" and "Retry". Requires "RunningJobs_ViewAll" - else you won't see any jobs.
71	RunningJobs_View	✓	✗			It gives you the ability to see your own running jobs. With this, you'll also be able to see how many jobs are failed/waiting/running - just now which jobs it is and who's jobs it is. Only gives Read access.
72	RunningJobs_ViewAll	✓	✗			Gives you Read access to all running jobs. Meaning that you cannot e.g. restart them if you've failed. Doesn't require "RunningJobs_View" in order to work.
73	Saved_Searches_CRUD	✗	✓			Enables one to CRUD one's own saved searches. One can also share them without having the "share role" enabled
74	Upload_Only	✓	✗			If this is enabled, accessing the DC will put you into a "write-only" mode - e.g. for photographers, who should not have read access but write access. Requires "write access" to the Uploads folder in order to work.
75	Uploader	✗	✗		LS	Unused.
76	Uploader_ReplaceWithArchive	✓	✗		LS	Unused.
77	Uploader_ReplaceWithoutArchive	✗	✗			It enables a user to replace assets without archiving the old version. Cannot be accessed via the UI
78	Uploader_ShowFolderSelector	✗	✗			Only implemented in DFS. Is used to give users access to upload to the catalog area while using the embedded upload component
79	Viewer_Catalogs	✓	✗		LS	Does nothing beyond what Editor_Catalogs already does. Deprecated.
80	VP3_Portal_Admin_StartScreen	✗	✗		SF	Not implemented - to be deleted
81	VP3_Portal_Admin_VideoSlides	✗	✗		SF	Not implemented - to be deleted
82	WorkStages_Edit_Others	✗	✓			Enables you to change statuses on assets that are assigned to other users than yours.
83	WorkStages_View	✗	✓			Enables you to get the "Asset Status --> My tasks"
84	WorkStages_View_Others	✗	✓			Enables you to get the "Asset Status --> All tasks". It requires that "WorkStages_View" is also set to work.
85	Download_Approval_Bypass	✗	✓			Enables the user to download an asset, bypassing the download approval process in MM5.
86	Download_Approval_Admin	✗	✓			Enables the user to edit download request approval configuration within MM5.
87	Copyright_Notification_Bypass	✗	✓			Enables the user to download an asset, bypassing the copyright notification in MM5.
88	Business_Workflow_CRUD	✗	✓			Enables one to create, read, update, delete workflows (Aka. the BW editor) - requires Business_Workflow_View to function
89	Business_Workflow_Instance_CRUD	✗	✓		SF	Obsolete - to be deleted
90	Business_Workflow_View	✗	✓			Enables the user to view the workflows in the system - however, not access to them, for this you need Business_Workflow_CRUD
91	Business_Workflow_Instance_View_Others	✗	✓			Enables one to view the workflow instances of other users
92	Asset_Can_Download_Any	✗	✓			Enables the user to download any asset.
93	Youtube_Admin	✗	✓			Enables the user to configure the YouTube integration from MM5.
99	Business_Workflow_Instance_View	✗	✓			Enables the user to see it's own workflow instances (aka. tasks)
100	Business_Workflow_Instance_Transition	✗	✓			Enables the user to create or transition a workflow instance overall. Transitions also require an "transition executor" constraint to allow for transitioning. There are 3 "transition executor" constrains. They are the constraints that start with "Only" in their names.
101	Business_Workflow_Instance_Assign	✗	✓			Enables the user to assign a workflow instance or stage to another user. Unused in MM5
102	Business_Workflow_Instance_Delete	✗	✓			Enables the user to delete any workflow instance
103	Business_Workflow_General_Transition_Executor	✗	✓			Enables users to bypass the "transition executor" constraints on workflow transitions. There are 3 "transition executor" constrains. They are the constraints that start with "Only" in their names.
104	Office_Can_Upload_New	✗	✗	✓		Enables the user to save new Office documents with the Office Connector.
105	Office_Can_Replace	✗	✗	✓		Enables the user to replace an existing Office document with the Office Connector.
112	EditSSO	✓	✓			Enables to the user to change system SSO settings. Should probably only be given to select SuperAdministrators

Note: If both Uploader_ReplaceWithArchive and Uploader_ReplaceWithoutArchive are enabled the user will be asked what he wants to do with the old asset: archive it or delete it.

Features

The other way around - what roles and rights need to be added to enable a feature

MediaPortal_User is needed to access MM - so for all MM features below, it's given that MediaPortal_User is already enabled.

In a lot of instances, you also need read access to assets. I only scarcely add this as a right sometimes. Usually, it's self-evident that one should have read access to an asset to add it to a collection.

The Upload folder (46) is the default folder for uploading. This can be changed - and if changed, use this other folder instead.

For Keywords - Keywords (10192) is default. This can of course also be changed - where you should use this new metadata field instead.

Green = OK

Red = Might not be OK

Features in MM	Roles	Rights	ConfigManager
Upload assets via MM + see "Your uploads"	MediaPortal_Upload	Write access to "Upload" folder (Usually granted through the "Trusted" group)
Enable users to change their profile information			Enable users to see and edit their account information = True
Upload/change profile image via MM	MediaPortal_Upload		Enable profile images = True Enable users to see and edit their account information = True
Restore old asset version via MM	Asset_Can_Replace	Write access to "Upload" folder (Usually granted through the "Trusted" group) (Having write access to Content does nothing)
Replace asset + See "Asset History" (Not audit trail)	Asset_Can_Replace	Write access to the asset
See asset statuses + Enable the "My tasks" view	WorkStages_View	Read access to the asset
Enable the "All tasks" view	WorkStages_View WorkStages_View_Others	Read access to the asset
Change/set assets' statuses (on assets not already assigned to other users - Meaning only assets where you or none is assigned)	Member_Viewer WorkStages_View	Write access to the asset Write rights to the metadata fields in "Metadata > Asset > Shared > Tasks" (usually granted via trusted)
Change/set assets' statuses (regardless of who they're assigned to)	Member_Viewer WorkStages_View WorkStages_Edit_Others	Write access to the asset Write rights to the metadata fields in "Metadata > Asset > Shared > Tasks" (usually granted via trusted)
Printing	Asset_Can_Download	The asset is "public" (no padlock)
Download predefined qualities	Asset_Can_Download	The asset is "public" (no padlock) Should be added to a group with download qualities: "Guest", "Light Users", "Content Creators", "Administrators", or "Super Administrators"
Download custom qualities	Asset_Can_Download Asset_Can_Download_Custom_Quality	The asset is "public" (no padlock)	Custom quality color spaces = must have content Custom quality image types = must have content Enable custom quality download = true
Enable sharing (URL, Social)	MediaPortal_Share	The asset is "public" (no padlock)
Enable sharing (Zip)	MediaPortal_Share Can_Live_Export_Asset_Only	The asset is "public" (no padlock)
Enable embed as a sharing option for videos	MediaPortal_Video_Embed MediaPortal_Sharing		Choose available embed video sizes = must have content Choose available embed video qualities = must have content Embed player user = must have content (usually "Guest")
Enable sharing assets to/via collections (Create new, Add to existing)	MediaPortal_Sharing MediaPortal_Collection	The asset is "public" (no padlock)
Add asset to own collection	MediaPortal_Collection	The asset is "public" (no padlock)
Enable ability to CRUD own collections	MediaPortal_Collection
Enable ability to CRUD own collections + CRUD collections shared to oneself/Others	MediaPortal_Collection		Give new recipients of non-social collections (e.g. not Facebook collections) access to manipulate collections = true
Enable non-preexisting users to read collections on an SSO site	MediaPortal_Collection		Allow shared collection users to bypass login required screen = true
Enable user to use AI Tagging + your site has external access	Ai_Add	Write access to the asset (only images)	Enable AI tagging functionality for metadata field = Keywords(10192) (Keywords must be autotranslate = true)
If you want AI tagging but don't have external access	Ai_Add	Write access to the asset (only images)	Enable AI tagging functionality for metadata field = Keywords(10192) (Keywords must be autotranslate = true) Use local analysis for AI services = true
Enable CRUD of own saved searches	Saved_Searches_CRUD
Enable crop/trim (share it via email)	Asset_Can_Crop
Enable crop/trim + Replace original asset with crop/trim + Restore to an older version of an asset	Asset_Can_Crop Asset_Can_Replace	Write access to the asset Write access to the Uploads folder OR the Content folder (The option to restore requires "write access" to the Uploads folder)
Enable crop/trim + Make new child asset with crop/trim	Asset_Can_Crop Asset_Can_Revise	Write access to the asset Write access to the Uploads folder OR the Content folder
Have filter open every time you access the MM			Automatically expand filter pane in asset list = true
Make all filters be expanded every time you access MM			Automatically expand filter pane in asset list = true Automatically expand individual filters in asset list = true
Make asset ID shown			Show asset ID in asset list = true
Enable password reset			Enable the option to reset one's password = true
Enable self sign-up where users can choose their own password			Enable self sign up = true Template user for self sign up users = A user with all the rights, roles, and groups your users should have (User must be enabled) Allow users to chose a password on signup = true Auto-created user folder ID = the ID of the folder where you want your users to go.
Enable email verification for self-sign up (when self sign-up already is enabled) where users can choose their own password			Enable self sign up = true Template user for self sign up users = A user with all the rights, roles, and groups your users should have (User must be disabled) Allow users to chose a password on signup = true Verification when a user is created using self sign up = Email verification
Enable admin verification for self-sign up (when self sign-up already is enabled) where users can choose their own password			Enable self sign up = true Template user for self sign up users = A user with all the rights, roles, and groups your users should have (User must be disabled) Allow users to chose a password on signup = true Verification when a user is created using self sign up = Admin verification Administrative verification email = the admin's email
Enable that refreshing MM will log one out			Enable persistent login = false
Enable multi-download of assets	Asset_Can_Download Can_Live_Export_Asset_Only	Should be added to a group with download qualities: "Guest", "Light Users", "Content Creators", "Administrators", or "Super Administrators"
Enable multi-download of metadata	Asset_Can_Download Can_Live_Export_Metadata_Only	Should be added to a group with download qualities: "Guest", "Light Users", "Content Creators", "Administrators", or "Super Administrators"
Enable multi-download of assets and metadata	Asset_Can_Download Can_Live_Export_Assets_And_Metadata	Should be added to a group with download qualities: "Guest", "Light Users", "Content Creators", "Administrators", or "Super Administrators"
Enable reading other peoples' comments and annotations	Comment_View
Enable commenting and annotating	Comment_View Comment_CRUD
Enable commenting and annotating + tagging other users	Comment_View Comment_CRUD Member_Viewer
Access the task list	Business_Workflow_Instance_View
Edit workflows	Business_Workflow_CRUD Business_Workflow_View
Request a standard quality download	Asset_Can_Download Business_Workflow_Instance_Transition	Download approval must be set up The asset is "public" (no padlock) Have enabled standard download
Request a custom quality download	Asset_Can_Download_Custom_Quality Business_Workflow_Instance_Transition	Download approval must be set up The asset is "public" (no padlock) Have enabled custom download
Circumvent the download approval process	Download_Approval_Bypass	Download approval must be set up Have enabled either standard or custom download
Approve or deny download requests	Business_Workflow_Instance_View Business_Workflow_Instance_Transition Download_Approval_Admin	You must be auto-assigned via the accompanying workflow as per the documentation
Enable copyright notification		Follow the documentation: In short, you need to set it up via the config manager settings + metadata settings
Circumvent the copyright notification	Copyright_Notification_Bypass	Have copyright notifications enabled

Features in DC	Roles	Rights	ConfigManager
Upload only (e.g. for photographers)	Upload_Only	Write access to the Uploads folder
SuperAdministrator rights	Editor_SystemTools_AllwaysAllowItemSecurityEdit

Changes in roles from the last version to this

Added

Name	Note
Can_See_Grafana_Shortcut
Comments_View
EditSso

Removed

Name	Note
Can_Force_Unlock_Office_Document	There's no locking in OC anymore
Business_Workflow_Instance_CRUD

Changed

Old	New	Note
MediaPortal_Member_Viewer	Member_Viewer	Starting with 5.4.0, the role 'MediaPortal_Member_Viewer' has been renamed to 'Member_Viewer' .

Documentation

DC 5.4 Roles