---
title: "Security"
slug: "security"
abstract: "Best practices to follow when defining your security model."
---
# Security

Understanding security requirements is the first step to setting up a security model in Sitecore Content Hub. Security requirements are a set of governance rules that define the permissions structure of your organization. In Content Hub, security is determined based on [user groups](https://doc.sitecore.com/ch/en/users/content-hub/standard-user-groups.html "Standard user groups") and [policies](https://doc.sitecore.com/ch/en/users/content-hub/user-group-policies.html "User group policies"). Each department or division can have its own user group membership and corresponding policies with refined access roles.

This section provides best practices to help you define your security model.

## Specify permissions for common access roles

The following table lists common access roles and the [permissions](https://doc.sitecore.com/ch/en/users/content-hub/permissions.html "Permissions") they should have.

| Role | Permissions |
| --- | --- |
| *Readers* | <ul><li>*Read* and *Download* permissions for the **Assets** search page.</li><li>Access to their own user **Profile** page.</li><li>*Read* access to the **Collections** page.</li><li>*ViewNotWatermarked* permissions to view renditions without watermarking.</li></ul> |
| *Creators* | <ul><li>*Create* and *Submit* permissions for assets, enabling them to upload and submit assets for review.</li><li>*Update* permissions for their own assets that are not yet approved.</li></ul> |
| *Content* approvers | <ul><li>*Approve* permissions for assets under review, enabling them to approve or reject these assets.</li><li>*Read* and *CreateAnnotations* permissions for assets.</li></ul> |

> [!note]
> These roles are typically refined based on the metadata, such as brand, product, and campaign linked to the assets or products.

> [!important]
> Don't create duplicate rules and permissions. If you assign multiple user groups to the same user, identical permissions might be granted by more than one of those groups. Review how the user groups share the permissions for the same entities. You can use the [security diagnostics](https://doc.sitecore.com/ch/en/users/content-hub/security-diagnostics.html "Security diagnostics") tool to detect duplicate policies that grant identical permissions for the same entity.

## Define user groups

When you define user groups, follow this recommended workflow.

> [!important]
> -   Sitecore periodically updates [standard user groups](https://doc.sitecore.com/ch/en/users/content-hub/standard-user-groups.html "Standard user groups"), such as the *Everyone* group, to include permissions for new essential site functionality. For this reason, we recommend you use these groups to apply common permissions to most users, and only use custom groups to apply exceptional permissions to those who need them.
>
> -   Modifying permissions for the *Everyone* user group is not recommended, as it might cause users to lose access to features and functions.
>
> -   Don't remove users from the *Everyone* user group, because this will remove the baseline permissions required for them to access the system.

To define user groups:

1. Define the roles you need as described in the previous section.
2. Create a new user group per role.
3. [Assign the modules](https://doc.sitecore.com/ch/en/users/content-hub/assign-modules-to-users-and-groups.html "Assign modules to users and groups") relevant to this user group.
4. Define the pages that each user group needs to access.
5. Define access for *Asset* and *File* definitions:
    - Create a single rule for both *Asset* and *File* when the definitions have identical permissions.
    - Set conditions to limit the assets available for each user group, according to your domain model design.
6. Define user group permissions for other entity definitions.
    - Define which definitions the users need to access, update, or delete.
    - Review the taxonomy definitions.
    - Review custom entity definitions.
    - Define which [permissions](https://doc.sitecore.com/ch/en/users/content-hub/permissions.html "Permissions") the users need for these definitions.

> [!important]
> Keep the number of user groups small. Having hundreds of user groups requires maintenance effort with every change in the domain model. Don't assign a user to more than ten user groups. Security checks are performed before loading certain operations or when running background processes. Setting more than ten user groups per user has a performance impact. Consider consolidating user groups to avoid this.

## Configure authentication

When you configure authentication, follow these recommendations.

- Disable registration by default - doing this prevents unauthorized access to your website, ensuring that only authorized users can access its content. [Enabling registration](https://doc.sitecore.com/ch/en/users/content-hub/configure-the-authentication-setting.html "Configure the Authentication setting") should be a deliberate action, allowing you to control who can create a user account.
- Implement [email domain whitelisting](https://doc.sitecore.com/ch/en/users/content-hub/configure-the-authentication-setting.html "Configure the Authentication setting") - you can strictly control access to your website by enabling `WhiteListedEmailPatterns`. This prevents the registration of users from other domains, and is best used in combination with `EnableConfirmationMail=true`.
- Properly configure SAML authentication - configuring authentication correctly means referencing the IDP directly instead of copying IDP metadata. This ensures successful sign-ins, even when IDP metadata changes (such as certificate renewal).

    > [!note]
    > When certificates are updated on the IDP side, no manual action is required within Content Hub. For SAML integrations, certificate updates are handled automatically when metadata is exchanged during configuration. Content Hub uses this metadata to stay in sync with the IDP’s current certificate.

- Enable [reCAPTCHA](https://doc.sitecore.com/ch/en/users/content-hub/configure-the-authentication-setting.html "Configure the Authentication setting") for your [user registration](https://doc.sitecore.com/ch/en/users/content-hub/user-authentication.html "User authentication") flow - doing this adds an extra layer of security by verifying that the user is not a bot, protecting your website from automated attacks.
- Restrict permissions for standard user groups - doing this ensures that even if unauthorized users gain access to your website, they cannot access any sensitive data. When new users are created, make sure they are not assigned to [user groups](https://doc.sitecore.com/ch/en/users/content-hub/standard-user-groups.html "Standard user groups") that grant [permissions](https://doc.sitecore.com/ch/en/users/content-hub/permissions.html "Permissions") they don't need. All users are part of the *Everyone* user group, so you need to ensure that this group only has permissions that you want to give to every user.
- Enable auto-lockout - you can automatically lock out users who repeatedly enter incorrect login credentials by setting up [`AttemptsBeforeLockout`](https://doc.sitecore.com/ch/en/users/content-hub/configure-the-authentication-setting.html "Configure the Authentication setting").
- Maintain a backup local administrator account with a strong password - doing this provides a fail-safe for your company, so you can still access Content Hub if there are issues with your identity provider or its configuration.