Assign permissions to external users—Role-based consoles

Assign permissions to external users so that they can complete tasks in an instance. When a console user slides in to an instance, the console user is identified as a named external user.

Assigning permissions to external users is a multi-step process:

  1. Assign permissions to the CPAUser.

  2. Assign permissions to roles.

  3. Assign a role to console users.

When you assign the same permissions to the CPAUser and a role for console users, external users have those specific permissions to perform activities in an instance.

Named role-based permissions apply to the following consoles:

  • Accountant (SIAP / BPO)

  • Management

Overview

The CPAUser is the main template user in an instance. The CPAUser determines the permissions that external users inherit when they slide in to an instance.

An external user gets a combination of permissions from the following:

  • The CPAUser.

  • A role assigned to their console user record.

However, you must assign the same permissions to the CPAUser and a role so that external users can complete tasks in an instance.

If you assign different permissions to the CPAUser and a role for console users, external users receive the lesser of the two permission sets between the role and CPAUser permissions.

Go to About the CPAUser for more information.

The permissions assigned in an instance and console are a user's effective permissions in an instance.

An admin assigns Bills List, View, and Add permissions from the Accounts Payable application to the CPAUser. A console admin also assigns Bills List, View, and Add permissions to a role for console users. Because the same permissions are assigned to the CPAUser and role, external users can list, view, and add bills in an instance.

An admin assigns Bills List, View, and Add permissions from the Accounts Payable application to the CPAUser. However, a console admin assigns Bills List, View, and Edit permissions to a role for console users.

In an instance, external users can list and view bills, but they cannot add or edit bills. Because the Bills List and View permissions are assigned to the CPAUser and role, external users can complete those tasks. Since Bills Add and Edit permissions are not assigned to both the CPAUser and role, external users cannot complete those tasks.

Assign permissions to the CPAUser

Sage Intacct recommends that you assign the necessary permissions to the CPAUser in an instance. Then, assign those specific permissions to a role for console users in the console. Assigning permissions first to the CPAUser confirms the maximum permissions that external users might inherit when they slide in to an instance.

Subscription

Administration
Regional availability

All regions

User type

Business user with admin privileges
Permissions

  • Users: List, View, Permissions

  • Application subscriptions: Assign users

  1. Go to Company > Admin > and select External users.

  2. Find the CPAUser and select Subscriptions.

  3. Select the applications that you want the CPAUser to access.

  4. Select Permissions next to a selected application to set specific permissions for that application.

  5. Select permissions for the activities that you want external users to perform.

  6. Save your changes.

  7. On the User Subscriptions page, also Save your changes.

Assign permissions to roles in the console

Assign the CPAUser permission set to a role. Then, assign that role with the specific permissions to console users. When the same permissions are assigned to the CPAUser and role, external users can complete specific tasks in an instance.

The same permissions must be assigned to the CPAUser and role. If the permissions are different, external users receive the lesser of the two permission sets between the role and CPAUser permissions.

Intacct recommends that you create separate roles for login and slide in. Separate roles help to maintain audit trail integrity and the security of your company. Select Login only or Slide-in only in the Use for field when you create or edit a role.

  • Login and slide-in. Enables console user permissions in the console. Also, enables external user permissions in an instance.

  • Login only. Enables console user permissions in the console.

  • Slide-in only. Enables external user permissions in an instance.

Subscription

Administration
Regional availability

All regions

User type

Business user with admin privileges
Permissions

Users: List, View, Add, Edit

  1. Go to My practice or Console > All > Users and contacts > and select Roles.

  2. From the Roles list, select Add or Edit next to a role.

  3. If you add a role, complete the role information, and Save your changes.

    If you edit a role, select Subscriptions.

  4. Choose the applications that you want this role to access.

  5. Select Permissions next to a selected application to set specific permissions for that application.

  6. Select permissions for the activities that you want external users to perform.

  7. Save your changes.

  8. On the Roles Subscriptions page, also Save your changes.

For more information, go to Define roles for console users.

Assign a role to external users

After you assign permissions to a role, assign that role to console users. When you assign the same permissions to the CPAUser and role, external users can complete the activities that they have permissions for.

Subscription

Administration
Regional availability

All regions

User type

Business user with admin privileges
Permissions

Users: List, View, Edit

  1. Go to My practice or Console > All > Users and contacts > and select Users.

  2. Find the console user and select Edit.

  3. Select the Roles information tab.

  4. Select an empty row under Role name, then choose a role from the dropdown.

  5. Save your changes.

  6. When the Verify your identity page appears, enter your password.