Users, roles, and domains

The security roles

Version:

Sitecore comes with a series of predefined roles that you can use to manage user authorization on items and functionality.

Security role	Description
Everyone	All users are assigned the Everyone role. This role is a virtual role. It mirrors the Windows Everyone group. It does not exist in the role database but is only used for assigning and resolving security. You can use the Everyone role to assign access rights to every user or every user in a specific domain. The Everyone role is available as both a global role and a local role in every domain. Note If you select a different domain than Sitecore, you must set the read/write permissions on the Languagesnode for one of the base roles or for the Everyone role for that domain.
Analytics Advanced Testing	Gives the user access to see additional tabs and controls in the Marketing Control Panel. You typically give this role to optimization experts, who need expanded rights when performing tests, traffic allocation, and so on.
Analytics Content Profiling	Gives the user access to the content profiling functionality in the Experience Editor and in the Content Editor. Members of this role are: Marketing Automation Editors
Analytics Maintaining	Gives the user access to the Campaign Creator, Marketing Control Panel, the Engagement Plan Designer, and the Supervisor. The role gives the user permissions to create goal or page event messages and campaigns for messages. Members of this role are: Marketing Automation Editors List Manager Editors Forms Editor
Analytics Management Reporting	Gives the user access to view the management reports for optimization efforts. This role is typically given to users working with optimization, who wants to view management reports for the optimization efforts. The user can still perform tests, but this is not their main objective.
Analytics Personalization	Gives the user access to the personalization functionality in the Experience Editor and in the Content Editor. Members of this role can create and edit personalization rules. Users who are not members of this role can switch personalization variations. Members of this role are: Author
Analytics Reporting	Gives the user access to the Campaign Creator, Marketing Control Panel, the Engagement Plan Monitor, and to the Executive Dashboard.
Analytics Testing	Gives the user access to the Test Lab in the Marketing Control Panel and to the test functionality in the Experience Editor and in the Content Editor. Members of this role can create and edit test variations. Members of this role are: Author
Author	Gives the user access to content in the content tree. This role provides access to basic item editing features, such as the Media Library and the Content Editor, with a reduced set of tabs on the ribbon. This role is also a member of two Sitecore Client roles, so if you assign just this role to a user, the Sitecore Client Authoring and Sitecore Client Users roles will be automatically assigned to the user. Members of this role are: Marketing Automation Editors List Manager Editors Developer
Designer	Gives the user read and write access to the areas of the content tree that are required when changing layout details for individual items and groups of items via template standard values, as well as items required when configuring the Experience Editor Design Pane. This role also has two of the Sitecore Client roles assigned to it, so if you assign just this role to a user, the Sitecore Client Designing and Sitecore Client Users roles will be automatically assigned to the user. This role provides access to the Experience Editor Design Pane features and the designer options in the Content Editor. Note This role is not a member of the Author and Authoring roles, so it does not allow users to edit items. Members of this role are: Developer
Developer	Gives the user access to content manipulation facilities in the Content Editor, plus all the design and authoring roles normally used by client authors and client designers. It also provides access to more functionality on the ribbon of the Content Editor to allow full development features for users assigned to this role. This role also has access to the Development Tools menu in the Sitecore menu, which gives the user access to further development tools, such as the Package Designer.
EXM Advanced Users	Gives the user full access to all the functionality in the Email Experience Manager. This role is a member of the List Manager Editors role. Members of this role can: Delete a message. Change the default settings. Open or edit the engagement plan. Change the recipient lists of a subscription message. Save a message as a subscription message template. Change the target device.
EXM Users	Gives the user access to all the basic functionality in the Email Experience Manager, such as create, send, and manage messages. This role is a member of the List Manager Editors role.
Facebook Message Reviewer	Gives the user access to edit Facebook messages.
List Manager Editors	Gives the user access to the List Manager application so they can manage the contact lists. This is primarily given to EXM users. Members of this role are: Sitecore\EXM Users Sitecore\EXM Advanced Users
Marketing Automation Editors	Gives the user access to the Marketing Automation application so they can create, edit, and manage marketing automation campaigns. In addition, this role gives the user access to the Marketing Control Panel application so they can create, edit, and manage marketing definitions that are part of the automation campaigns and the Analytics workflow.
Sitecore Client Account Managing	Gives the user access to maintain users, roles, and domains in the Access Manager, the Domain Manager, the Role Manager, and the User Manager. Members of this role are: Sitecore Local Administrators
Sitecore Client Advanced Publishing	Gives the user access to the publishing functionality in the Experience Editor and in the Content Editor. This role has access to republish in addition to the same access rights as the Sitecore Client Publishing role.
Sitecore Client Authoring	Gives the user access to basic item editing features. The role is intended for client users to allow access to basic authoring features. The role only influences the Content Editor commands available, it does not influence the Desktop interface's menu or the Control Panel commands. Members of this role are: Author Forms Editor
Sitecore Client Bucket Management	Gives the user access rights to the /sitecore/content/Applications/Content Editor/Ribbons/Chunks/Item Buckets item in the Core database.
Sitecore Client Configuring	Gives the user access to the Content Editor features that allow a user to change the configuration details associated with items, such as the icon associated with the item and whether the item is protected or hidden. This role adds the Configure tab to the Content Editor and displays the Appearance, Masters, and Attribute groups. Members of this role are: Sitecore Client Bucket Management Developer
Sitecore Client Designing	Gives the user access to Experience Editor Design pane features that allow a user to set layout details associated with items in the Sitecore client. Members of this role are: Designer
Sitecore Client Developing	Gives the user access to application shortcuts and commands commonly required by developers. Members of this role are: Sitecore Client Bucket Management Developer
Sitecore Client Forms Author	Gives the user access to the minimum features of the Web Forms for Marketers module. This role allows the user to: Insert a new form Edit an existing form View the Summary report
Sitecore Client Maintaining	Gives the user access to template editing features and reporting tools. This role is intended for Sitecore super-users and developers. Members of this role are: Sitecore Client Bucket Management Developer
Sitecore Client Publishing	Gives the user access to the publishing functionality in the Experience Editor and in the Content Editor. Users that are not members of the Publishing role may still be able to publish, but only via automatic publishing features associated with Workflows. This role has access to Incremental publish, Smart publish, and Publish related items. Members of this role are: Sitecore Client Advanced Publishing
Sitecore Client Securing	Gives the user access rights to security features in the Content Editor and other relevant applications. This role is intended for users who need to maintain users and access rights. Members of this role are: Sitecore Local Administrators
Sitecore Client Social Authoring	Gives the user access to create messages and post them to social networks. The role is a member of the Sitecore\Author role.
Sitecore Client Translating	Gives the user access to Sitecore’s translation features, such as the command Scan the database for untranslated fields. The role is intended for content authors who need access to languages other than the site's default language.
Sitecore Client Users	Gives the user minimal access to Sitecore. With this role, the user can log in to the Sitecore Desktop, but will not have access to any applications. All of the other Sitecore client roles are members of the Sitecore Client Users role, which means that users in any Sitecore client role are automatically members of the Sitecore Client Users role.
Sitecore Limited Content Editor	Limits the amount of Content Editor functionality provided by the Sitecore Client Authoring role (which is still required for users given this role). When a content author is assigned this role, they only have access to the Home, Review, and Publish tabs on the Content Editor ribbon and have no access to copy, move, or sort from the item's right-click menu.
Sitecore Limited Page Editor	Restricts the amount of functionality that is available in the Experience Editor. However, unlike the Minimal Page Editor role, users assigned this role see a simple version of the standard Experience Editor ribbon. This role limits the amount of functionality provided by the Sitecore Client Authoring role (which is still required for users given this role), but allows more functional access than the Sitecore Minimal Page Editor role.
Sitecore Local Administrators	Sitecore local administrators can log in to Sitecore and manage the security applications (including assigning security) within that domain. A local administrator cannot create domains or associate domains to users. Note The local administrator role is a member of the Sitecore Client Users, Sitecore Client Account Managing, and Sitecore Client Securing roles. You can use this role as a shortcut to adding these roles to a user.
Sitecore Marketer Form Author	This role inherits access rights from the following roles, and can be used as a shortcut to assign a user all the access rights from those roles: Sitecore Client Form Author Analytics Maintaining Analytics Reporting
Sitecore Minimal Page Editor	Restricts the amount of functionality provided in the Experience Editor to the absolute minimum and users who have been assigned this role do not have access to the Experience Editor ribbon. For example, members of the Minimal Page Editor role cannot switch personalization variations. This role limits the amount of functionality provided by the Sitecore Client Authoring role (which is still required for users given this role).
Social Marketer Message Reviewer	Gives the user access to edit social marketer messages.
Social Message Author	Gives the user access to create, edit, and remove all social marketer messages.
Social Message Workflow Editor	Gives the user access to use the Draft state and its commands in the Social Message workflow and the Social Marketer Message workflow.
Social Message Workflow Reviewer	Gives the user access to use the Awaiting Approval state and its commands in the Social Message workflow. In addition, the user also has access to the Awaiting Post Review, Post Accepted, and Post Removed states and their commands in the Social Marketer Message workflow.
Twitter Message Reviewer	Gives the user access to edit Twitter messages.

If you have suggestions for improving this article, let us know!