Manage sub-accounts and assignments

Super administrator

Sub-accounts

Supported account management systems

Public cloud RPA supports two account management systems: Alibaba Cloud RAM and Alibaba Cloud IDaaS. You can choose the one that best fits your needs.

Use Alibaba Cloud RAM to manage sub-accounts

1. Create an Alibaba Cloud RAM sub-account. Before you add a sub-account in the RPA Console Member Management menu, you must first create a RAM sub-account in the Alibaba Cloud RAM console. As shown in the following figure.

   

   Important

   To ensure Alibaba Cloud RPA functions correctly, confirm the following settings when creating a RAM sub-account:

   • Access Mode: Select Console Access.

   • MFA multi-factor authentication: We recommend selecting Not Required.

     • If you enable MFA, you must complete verification when signing in to a client (robot or editor) with the RAM method.

     • If your enterprise security policies require MFA, you can use the dynamic sign-in code method when you sign in to the client to meet your compliance requirements.

2. Return to the Member Management page in the Alibaba Cloud RPA console and click Create Account, as shown in the following figure.

   

   Field	Description
   Member account	Select the existing RAM sub-account you want to bind.
   Member nickname	Must be 1 to 16 characters long and can contain Chinese characters, English letters, digits, and the following special characters: @ . - _
   Department	By default, the top-level department in the organization tree on the left is selected. To change this, you must first create the desired organizational structure.
   Role	Select a role for this account from the drop-down list. The role controls the account's permissions and data visibility in the console. To create a new role or modify an existing one, go to System Settings > Role List.
   Email	Enter the email address associated with this account.
   On-premises robot authorization	You can assign this authorization after the account is created. For details, see Assign on-premises robot licenses.
   Editor authorization	You can assign this authorization after the account is created. For details, see Assign an editor.
   On-premises robot scope	The default value is All. For details, see Set the on-premises robots that an account can use.

Use Alibaba Cloud IDaaS to manage sub-accounts

For details, see Use Alibaba Cloud IDaaS to manage sub-accounts.

Switch account management systems

• Account information, such as account names and passwords for different sign-in methods, is stored in the respective account management system. Alibaba Cloud RPA only associates the account with the product; it does not store the account information itself.

• You can use only one of the two account systems at a time.

• To switch the account system, click Settings in the upper-right corner of the Member Management page.

  Important

  Switching the account system has the following effects:

  • All sub-accounts added in RPA are removed, leaving only the primary account. However, the account information you previously created in Alibaba Cloud RAM or Alibaba Cloud IDaaS is not affected.

  • All assigned RPA editor and robot authorizations are released. The corresponding clients become unusable.

  • You must then recreate the necessary sub-accounts and re-assign editor or robot authorizations based on the newly selected account system.

Department management

If you manage a large number of member accounts, you can create sub-departments to manage them separately. You can also change an account's department from the account list.

Console permissions and roles

Console permissions include operation permissions and data permissions:

• Operation permission

  • Controls the menu items that an account can access and operate.

  • You can manage roles on the System Settings - Role List page, and some built-in roles are provided for ease of use.

• Data permission

  • Determines the scope of data an account can view and manage within a menu.

  • Currently, data permissions for each menu are determined by the corresponding feature. For details, see the data permission description for each feature menu.

Three built-in roles are provided by default, and you can view them in System Settings - Role List:

• super administrator: This role is exclusive to your Alibaba Cloud primary account and cannot be assigned to other sub-accounts.

• administrator: By default, this role does not have Member Management permission. To configure a sub-account to manage other accounts as an administrator, see Use a sub-account to manage members in the RPA console.

• employee: Intended for end users (business users). This role only has permissions to request and use RPA applications.

You can also add custom roles in System Settings - Role List.

Assign an editor

After an editor license is assigned to an account, the user can sign in to the editor client with that account to develop automation flows. You can assign editor licenses in two ways.

• Method 1: Select and edit a member (primary account or sub-account), and then add or modify the authorization.

• Method 2: Batch assignment. Select multiple members from the member list to assign authorizations in bulk. Batch operations support only Professional Edition editor licenses and Professional Edition robot licenses.

  

Assign on-premises robots

Sign in to the client

After you create sub-accounts and assign authorizations, you can sign in to the client. The following table summarizes the supported sign-in methods for different account types. For detailed procedures, see Sign in to the client.