The Datatailr User Manager app enables you to define Datatailr users and user groups. The runnables that a user can access are determined by the group to which they belong. **Note –** A [global Datatailr administrator](https://datatailr.readme.io/docs/user-manager#reviewing-datatailr-groups--access-permission) (Admin) and a member of the **user\_admin** group can access the User Manager. Click the **User Manager**

icon. The following is displayed –

**Note –** On the first day of using Datatailr, a Datatailr admin will typically define Developer users who will develop Runnables in Datatailr. See [Step 1 – Defining Datatailr Users – Day One](doc:step-1-defining-datatailr-users-day-one) for details. In Datatailr, access to runnables is awarded to users according to the groups to which they belong. The **Groups** column in the **Users** tab of the User Manager window lists the groups of which each user is a member, as shown below –

## Reviewing Datatailr Groups – Access Permission Datatailr is provided pre-populated with various groups that enable access to the Datatailr apps (tools). You can then assign users to these groups to enable them access to the Datatailr apps (tools). For example, the **Developer** group enables access to all the Datatailr Developer apps. In addition, you can create groups containing a selection of users to enable them access to specific apps created by Datatailr developers. Later when you [schedule a runnable](doc:job-scheduler), you can specify the groups that contain the users who are allowed access to the runnable being scheduled. #### To review the Datatailr groups – Click the **User Manager**

icon and then select the **Groups** tab on the left. The following is displayed –

This list shows all the predefined groups that were pre-populated in Datatailr to enable access to the Datatailr developer and Administrator apps, as well as all the groups created by Datatailr developers so that they can assign access to their end-users. The following describes the predefined groups Datatailr provides and the apps (tools) to which they enable access. These groups cannot be removed. * **admin –** Is a global Datatailr administrator, which means that this user can access all the Datatailr Admin apps, excluding the [Billing](doc:billing) app (which requires membership in the \*billing\_admin **group) and the[Cost\ Manager](doc:cost-manager) app (which requires membership in the cost\_admin** group). Datatailr is provided with at least one **admin** user out-of-the-box.

* **billing\_admin –** Can access the **[Billing](doc:billing)** app.

* **blob\_store\_admin –** Can programmatically access the Datatailr blob store (via API), such as Amazon S3. This role is not awarded access to any app. * **cost\_admin –** Can access the [Cost Manager](doc:cost-manager) app.

* **db\_admin –** Can access the [Database Manager](doc:database-manager) app.

> **Note –** As described above, defining a user as an **admin** means that they are a global Datatailr admin and can access almost all the Datatailr Admin apps, excluding the [Billing](doc:billing) app (which requires membership in the **billing\_admin** group) and the [Cost Manager](doc:cost-manager) app (which requires membership in the **cost\_admin** group). * **developer –** Can access all the Datatailr [Developer apps](doc:datatailr-developer-apps), shown below –

* **dtusers –** Is automatically assigned to anyone who can log in to Datatailr. * **image\_admin –** Can access the [Image Manager](doc:image-manager) app and perform various image management functions, excluding creating a new image (done in the [Image Builder](doc:image-builder)). All members of the **Developer** group (described above) can access the Image Manager app. * **instance\_admin –** Can access the Admin [Instance Manager](doc:instance-manager) app.

* **log\_admin –** All members of the **Developer** group (described above) can access the Developer’s [Log Viewer](doc:log-viewer) app, but members of the **log\_admin** group can see additional system logs. * **msg\_bus\_admin –** Can access the Admin [Msg Bus Manager](doc:msg-bus-manager) app.

* **package\_admin –** Can access the Developer’s [Package Manager](doc:package-manager) app. All members of the **Developer** group (described above) can also access the [Package Manager](doc:package-manager) app.

* **setup\_admin –** Can access the Admin [Software Update](doc:software-update) app.

* **pre-tester –** Not applicable. * **power\_user –** Can access Datatailr Developer apps, can create runnables and can run them, but cannot release the runnables that they develop to other users. * **schedule\_admin –** Can access the Developer’s [Job Scheduler](doc:job-scheduler) app and can schedule all runnables in Datatailr (even ones that they did not create). All members of the **Developer** group (described above) can also access this app. However, members of the **Developer** group can ***only*** schedule runnables that they themselves created.

* **user\_admin –** Can access the Administrator [User Manager](doc:user-manager) app.

* **bug\_admin –** Can access the Admin [Bug Tracker](doc:bug-tracker) app. Icon Description automatically generated

**Note –** Only a **Global Datatailr Admin** can access the Administrator [Settings](doc:settings) app. A picture containing icon Description automatically generated

A picture containing icon Description automatically generated

## Defining Datatailr Groups You can create new Datatailr groups to control which users can access which runnables and the read/write permissions to those runnables. **Note –** To edit or remove a group, right-click on it to display the following dropdown menu or use the icons on the right, as shown below –

#### To create a new group – 1. Click the **User Manager**

icon and select the **Groups** tab on the left. The following is displayed –

2. Click the **+**. The following is displayed –

3. In the **Name** field, specify an indicative name that describes the users who will belong to this group, such as **fx\_traders** and click **Save**. #### To add users to a group – 1. Select the name of the group on the left and then mark the checkboxes of the users to be assigned to that group, as shown below –

2. Click the **Save**

button. **Note –** To undo the current selection of users, click the **Discard**

button. 3. Later when you schedule a runnable in the [Job Scheduler](doc:job-scheduler), you can specify the groups that contain the users who are allowed access to the runnable being scheduled. See [Scheduling a runnable](doc:job-scheduler) for more information.

## Defining Users The following describes how to add a new Datatailr user and assign that user to a group, which determines the Datatailr runnables to which they are allowed access and the read/write permissions to those runnables. You cannot delete yourself as a user or the global Datatailr Admin group (shown below in the first row). **Note –** To edit a user, select the user’s name and then select **Edit** in the dropdown menu option or use the **Edit**

button. The dropdown menu also enables you to reset the Multifactor Authentication (MFA) token. #### To create a new user – 1. Click the **User Manager**

icon. The **Users** tab is selected in the left pane, and a list of existing Datatailr users is displayed –

2. Click the **+**. The following is displayed –

3. If you are defining a **human user** (not a system account), then – * Fill in standard user information, such as **First Name**, **Last Name** and **Email**. * The **Login** field is automatically generated from the **First Name** and **Last Name** fields. **IMPORTANT!** The **Login** field shows the user name to be used in order to log in to Datatailr. * In the **Password** field, enter a password or click

to auto-generate the password. To define a **system account** user – Alternatively, a system user can be defined for the purpose of running jobs or services by the Datatailr runnables. This can be useful for securing sensitive information, such as database keys. Restricting access to the keys to this specific system account user eliminates the need to update the user name in various jobs in the event that a human user leaves the company. This type of user cannot log in to the Datatailr user interface. Multiple human users can use a system account simultaneously. * Mark the **System Account** checkbox to define a user as a system account. * For this type of user, you must enter a value in the **Login** field, but you cannot enter the user's **First Name**, **Last Name** **Email** or **Password**, because this is not a human user. You may refer to [System Accounts](doc:using-system-accounts) for more information.

4. In the **Groups** field, select one or more of the groups created in Datatailr, as described in [Defining Datatailr Groups](https://datatailr.readme.io/docs/user-manager#defining-datatailr-groups). There are no limitations on the number of combinations of groups you can select. All users are automatically assigned to the **dtusers** group so that they can access Datatailr. **IMPORTANT!** It is vital to add developers to the **Developer** group and admins to the **Admin** group, as well as any other groups that will award them access to the groups that they need to use. 5. Click the **Save** button. ## Disabling and Removing a User ### Disabling a User You can disable a user at any time by marking the **Disabled** checkbox so the disabled user cannot log in to the Datatailr user interface.\ Disabling a user does not automatically terminate a job; it just prevents this user (or background job) from logging in again. Disabling a system account user does not affect the jobs running under that user name. Disabling and/or removing a user does not delete their home directories or data. ### Removing a User #### To remove a user – Right-click the user’s name and then select the **Remove** dropdown menu option or select the **Remove**

button to the right of the user's name. When this user logs out, it will automatically terminate the session of all runnables (apps, jobs and services) that were using the system account associated with that username.

Tip – To completely remove a user, the following steps are recommended – 1. Disable the user. 2. Review the list of jobs/services/batches that are using this user. 3. Replace the user with a different user for any services that need to continue running. 4. Remove the user.