Summary
Within the Portal Manager, under "Users & Roles", you'll find tabs for External Users and External Roles
External Roles are similar to the "standard" Roles assigned to Users (i.e. you and your colleagues in your Planhat tenant), except they are for End Users who have access to Portals - called "External Users"
You have granular control over the specific access levels you enable within an External Role
In the "External Users" tab, you can view a list of your External Users across all Portals, and you can manage them (including via bulk actions) from here
Who is this article for?
Planhat admins (e.g. CS Ops) who are managing Portals for their organization
Tutorial
For a quick overview of External Users and Roles within Portal Manager, you can also check out our Tutorial here.
Series
Portal Manager - External Roles and External Users ⬅️ You are here
Article contents
Introduction
Portals are a shared space for collaboration between you and your team, and your customers/prospects. There are therefore two main types of Portal users:
"Internal Users" are people accessing Portals who are from within your organization - you and your colleagues (corresponding to the Planhat "User" model)
"External Users" are people accessing Portals who are from outside your organization - your customers and prospects (corresponding to the Planhat "End User" model)
In this article, we will focus on how you can configure permissions for External Users in "External Roles", which are an equivalent to the standard Roles you configure in the "Settings" Global Tool for Users (i.e. you and your colleagues) for your Planhat tenant in general. External Roles are managed within the "Users & Roles" part of the Portal Manager. Being able to enable/disable permissions here means you have granular control over what End Users can view and do in Portals.
Click the image to view it enlarged
In the "Users & Roles" part of the Portal Manager you can also view and manage the External Users who have been added to Portals - this is across all your Portals, for different Companies. We talk through how to add External Users in a separate article, here (as this is done in Portal Settings of individual Portals rather than in "Users & Roles" in Portal Manager).
Click the image to view it enlarged
In the overall process of setting up Portals, typically:
You as a Planhat admin (e.g. CS Ops) will first configure one or more External Roles
Then general Planhat users (e.g. CSMs) can invite End Users to be External Users in Portals, where they will have the appropriate permissions as per their External Roles
📌 Important to note
The default is that you will be able to configure one External Role, but depending on your Planhat package, you may have the ability to create and configure multiple different External Roles. You can speak to your Customer Manager (CSM) if you would like to discuss this further from a subscription perspective.
External Roles
The "External Roles" tab of "Users & Roles" in Portal Manager is where you set permissions so that your External Users (added End Users) can view and interact with the data in their Portals (but only have the access levels they need, and no more).
Click the image to view it enlarged
Setting External Role permissions here is similar to setting permissions for User Roles (for you and your colleagues) within the "Settings" Global Tool - but for External Roles there are fewer permissions to configure.
You will have at least one External Role to configure, but depending on your Planhat package, you may have the option to create and configure multiple External Roles - we talk more about this later in this article.
External Roles start off with almost no permissions enabled (only a few vital ones), meaning they are effectively a blank slate where you can add the specific access you would like to enable. This approach has been designed for data security. You are fully in control of what your External Users (i.e. Portal End Users) can see and do in their Portals.
Let's take a closer look at the different permissions you can enable in External Roles.
Workflow permissions
The first tab is for workflow permissions.
Click the image to view it enlarged
Workflow permissions are toggle switches that you can enable for your External User(s) as desired.
There are two permissions in this category (at time of writing):
Import
This gives the option to upload data in a spreadsheet. Model permissions still apply. (You may be familiar with this permission from User Roles)
File Download / Upload Access
This permission allows External Users with the External Role to see files that have already been uploaded to their Portal, and also gives them the ability to add more files
This is related to Company attachments (which at time of writing, are coming soon)
📌 Important to note
To be able to view permissions here (to be able to enable them), they first need to be enabled for your tenant within "Tenant Permissions", which is only accessible to Planhat staff ("Super Admins").
If you can't see a permission to enable for your External Users, speak to your Customer Manager (CSM).
Data model permissions
The other tab for External Users is where you set data model permissions.
Click the image to view it enlarged
Like when you set data model permissions in Roles for Users (you and your colleagues) in the "Settings" Global Tool, these are organized into "business models" at the top (the standard models you are used to seeing in the Planhat app, such Company, Asset and Project etc.), and "system models" at the bottom (which you can see some definitions of here). There are separate checkboxes for Create, View, Update, Remove and Export on the model, and you can click any model to expand it out to see its properties (fields) and set permissions there too, enabling very granular control.
As a minimum, we recommend enabling permissions for:
Workflow: View permissions for the model and the Name, Target Id, and Groups properties
Comment: Create, View and Update
Task: Create, View and Update
External Roles have some built-in constraints, for data security (to be appropriate for External Users). You will see that many data model permissions are disabled and cannot be enabled for External Users (e.g. ApiAccessLog, Automation and ConnectionData (example shown below).
Also note that External Users cannot open/view Company or End User Profiles (even if links to them were shared).
Option for multiple External Roles
In some circumstances, you may have the ability to create multiple Roles. This ability is configured by a Planhat staff member ("Super Admin") on a tenant level, and the functionality is enabled based on your Planhat package.
In some circumstances, it may be useful to allow different groups of External Users to have different access levels.
If your tenant does have the ability to have multiple External Roles, you will see a button in the top right of the External Roles tab: "Add new Role", which you can click if you would like to create a new Role from scratch.
Click the image to view it enlarged
This will open up a modal where you can name your Role and give it a description. Ensure you make it clear who exactly this External Role is for (in contrast to your other External Role(s)). This will create a blank Role (with only minimal necessary permissions enabled), so you can build it up "from scratch".
The alternative is that you can duplicate an existing External Role, if you would like your new External Role to have a starting point of the same permissions that you can then edit, rather than starting with a blank slate. To do this, mouse over the External Role you would like to copy, and click on the ellipsis (symbol of 3 dots):
... and then click "Duplicate":
This opens up the same modal, with the original External Role details cloned, for you to edit for this new External Role. Once you have adjusted the name/description and clicked "Save", the new External Role will be created with the same permissions as the original one, for you to edit as desired.
Managing External Roles
If you have multiple External Roles, you can simply click on one in the list to open up its permissions on the right-hand side to view or edit.
If you would like to edit the name/description of an External Role, or delete it, then simply mouse over its name to show the ellipsis (3 dots), and then click "Edit" or "Remove" respectively.
External Users
The other tab in the "Users & Roles" part of Portal Manager is "External Users". Here you can see a list of your End Users who are External Users in a Portal.
Click the image to view it enlarged
🚀 Tip
You don't actually add new External Users here (at time of writing) - you add them via the Portal Settings in individual Portals, as we describe here.
This is a useful place to get an overview of your External Users, and to apply bulk actions if desired. From here, you can:
Activate/deactivate External Users
View and change External Role assignment
Send invitations to External Users
Delete External Users
Export External Users to an Excel spreadsheet
Click the image to view it enlarged