With the new user management system, you can manage your staff and their permissions centrally across all your organisations. Instead of assigning a fixed role to each user per organisation, you can group permissions into user groups and assign your staff to these groups. The permissions themselves consist of function packages, which you can combine as you wish.
This article explains the new structure and what has changed for you compared to the previous roles.
At a glance:
- Group: The group is your company as a whole. All organisations and all users belong to this single group.
- Organisation: A unit within your group, e.g. a company, branch or client.
- User group: A set of permissions, e.g. ‘Accounts’. Users who are members of this group are granted these permissions.
- Function package: A bundle of related functions, e.g. ‘Process payments’. Function packages are the building blocks of a user group.
What is the "Group"?
- The group is the top-level entity and represents your entire enterprise. Your organisations are situated beneath it.
- Every user belongs to exactly one group.
- A group is created for you during set-up or migration into the new system. You do not need to create it yourself.
- In the group overview, you can see all organisations, all user groups, as well as registered and invited (pending) users.
What is the "User group"?
A user group defines what its members are permitted to do and where – that is, within which organisation or across the entire group.
- A user group always belongs to your group.
- You can create as many user groups as you like and name them as you wish, e.g. ‘Accounts’, ‘Sales North’ or ‘Branch Management’.
- A user can be a member of several user groups. Their rights are determined by all their user groups combined.
- A user receives rights exclusively through their user groups. Rights are not assigned directly to individual users.
Example: Ms. Müller is a member of ‘Accounts’ (allowed to process payments in all organisations) and ‘Berlin Branch Management’ (allowed to create additional transactions within the Berlin organisation). She therefore has both sets of rights simultaneously.
Function packages
A function package groups together functions that are related in terms of their business purpose. In a user group’s rights matrix, each function package forms a column. Hovering over the info icon next to the name shows you what the package contains.
- View: View transactions, customer accounts and recurring payments
- View (restricted): View only transactions for which the user is the contact person
- Creation: Create transactions, recurring payments and drafts
- Editing: Edit transactions and customer accounts
- Editing (restricted): Edit only transactions for which the user is the contact person
- Process payments: Confirm, reset and assign payments
- Smartkasse: Initialisation via Smartkasse, withholding and refunding of deposits
- Receivables Management: Process reminders, view receivables management lists, export documents
- ADM: View ADM list, edit money laundering status, approve IBANs (whitelist)
- Reporting: Analyses, payment behaviour, totals of open items
- Sales account: Access to the turnover account
- International deposits: Lists and functions for international deposits
- eCom: Functions relating to eCom
- Administration: View and edit organisation settings
- User Management: Invite and remove users, edit permissions
- Organisation Emails: Receives emails at organisation level (e.g. invitations)
Note on ‘restricted’: Restricted packages only apply to transactions where the user themselves is listed as the contact person.
Dependencies between feature packages
Some packages require others to be enabled. For example, you can only process payments if you can view them. When you enable such a package, the required packages are automatically enabled as well:
- Editing: View is also activated
- Editing (restricted): View (restricted) is also activated
- Edit payments, Smartkasse, Reporting, Overseas deposits, eCom: View is also activated
- Receivables management: View and Processing are also activated
- ADM: View and Process payments are also activated
What has changed compared to the previous roles?
Previously, each user had exactly one fixed role per organisation (e.g. ‘Editor’ or ‘Viewer’), supplemented where necessary by additional roles such as ‘Anti-Money Laundering Officer’. What a role was permitted to do was strictly defined. If an employee required a combination of two roles, this was not possible.
Now you can put together permissions yourself from function packages:
- Previously, there was one static role per user and organisation; now there can be any number of user groups per user.
- Previously, permissions were fixed for each role; now they can be freely combined from function packages.
- Previously, permissions were assigned individually within each organisation; now you assign them once at group level and they apply to all organisations.
- Previously, additional roles (e.g. receivables manager) existed separately; now they are standalone function packages.
Predefined user groups
To ensure you don’t have to start from scratch, user groups have already been created in your group that largely correspond to the previous roles. You can continue to use these, customise them, or create new user groups.
- Admin (previously: Admin): all feature packages except the restricted versions
- HR (previously: HR Management): View, creation, editing, Smartkasse, administration, user management
- Editor (previously: Editor): View, creation, editing, edit payments, Smartkasse
- Editorrestricted (previously: Restricted Editor): View (restricted), creation, editing (restricted), edit payments, Smartkasse
- Adder (previously: Creator): View, creation, Smartkasse
- Adderrestricted (previously: restricted creator): View (restricted), creation, Smartkasse
- Viewer (previously: viewer): View
- Viewerrestricted (previously: restricted viewer): View (restricted)
- GWG (previously: anti-money laundering officer): View, ADM
- Receivables Manager (previously: Receivables Manager): View, Receivables Management
- Foreign Security Deposit (previously: Foreign Security Deposit Manager): View, Foreign Security Deposit
- Controlling: View, Reporting
There is also the ‘Group Admin’ system user group. It is created automatically and cannot be deleted or have its permissions changed. This ensures that there is always someone available to manage the group.
How does the inheritance of permissions work?
Permissions that you grant to a user group at group level automatically apply to all organisations below it.
In the permissions matrix, you can recognise inherited permissions by a green, greyed-out tick with the note ‘Inherited from parent level’. You can only change an inherited permission at the level from which it originates.
Tip: If you want a user group to have the same rights across all organisations, tick the boxes in the group’s row. If you want the rights to apply only to specific organisations, tick the boxes only in the rows for those organisations.
How are permissions from multiple user groups combined?
Permissions are always aggregated. A user is permitted to do everything that at least one of their user groups allows. There is no user group that revokes a user’s permissions.
If you wish to revoke a right from a user, remove them from the relevant user group or adjust the feature packages for that user group. Please note that any change to a user group affects all its members.
Who can manage user groups?
The group overview and the ‘Invite users’ function are available to users who have the ‘Administration’ or ‘User Management’ feature package at group level, e.g. members of the ‘Admin’ or ‘HR’ user groups.
How to: Common tasks
Create a new user group
- Open the Groups overview from the menu.
- Go to the ‘user groups’ tab.
- Click on ‘Create user group’.
- Enter a name (e.g. ‘Accounts’) and click on ‘create’.
Defining role packages for a user group
- Open the user group in the group overview.
- Switch to the ‘rights matrix (configuration)’ tab.
- The rows show your group and the organisations, whilst the columns show the function packages.
- Tick the boxes where you want the user group to be assigned the respective function package.
Any changes are saved immediately. You will then see the message ‘rights successfully saved’.
Inviting new staff members
- Click on ‘Invite users’ in the menu.
- Enter one or more email addresses. Separate multiple addresses with commas.
- Under ‘Assign permission user groups’, select one or more user groups.
- Select the language for the invitation email and click on ‘Send invitation’ .
The live preview shows you in advance the full set of permissions the new user will receive. Until they have registered, the user will appear in the ‘Pending’ tab. There, you can resend the invitation if necessary.
New staff members can also be added using the ‘Invite users’ quick function in the menu on the left.
Adding an existing employee to another user group
- Open the relevant user group.
- Go to the ‘Assigned employees’ tab.
- Select the employee and click ‘Add employee’.
The permissions preview shows you which rights the employee will be granted through the user group.
View your own permissions
Under ‘Personal Profile’ > ‘My User Groups’, you can see which user groups you are a member of and what permissions you have in each group or organisation as a result.
Frequently Asked Questions
FAQ
Do I have to transfer my existing roles myself?
No. During the migration, your users’ existing roles will be transferred to the appropriate predefined user groups (see above). Your users’ permissions will therefore remain unchanged.
Can I change the predefined user groups?
Yes, except for the ‘Group Admin’ system user group. Bear in mind that any change will apply to all members of the user group. If you only need different permissions for individual staff members, it is better to create a separate user group.
An employee cannot see a particular function. Why is that?
Check the employee’s personal profile or the group overview to see which user groups they are a member of. Then check the permissions matrix to see whether one of these user groups contains the required function package for the correct organisation.
What happens if I delete a user group?
Members will lose the permissions associated with that user group. Permissions from their other user groups will remain unchanged. Deletion cannot be undone.
Who can help me?
If you have any questions about setting up your group, please contact your designated contact person or our customer service team.