User and Group permission changes


User and product management have moved to the Admin Console. Adobe will notify you when it is your time to migrate users. After all customers have migrated, help content for Analytics > Admin > All admin > User management will be retired.

What Changed?

Admin > User Management > Groups


Due to the high number of possible permission combinations available, we cannot provide documentation describing all of the API methods that can be used in every permission combination. Generally, non-administrators who are granted Web Services access will have only Read access to API methods. They will not have Write access to methods.

Because the API and interface use the same permissioning system, whatever permissions a particular non-administrator has been granted by an administrator in the interface (Adobe Admin Console), will be the same permissions that user has in the API.

Enhancement Description

Changes to the Report Access (Customize Groups)

Add New Group > Report Access

The Report Access section on the Define User Group page has been streamlined to four categories, which enable you to customize permissions at a granular level.

Items previously in

  • Analytics Tools: Enable user permissions for General items (billing, logs, etc.), Company Management, Tools, Web Service Access, Report Builder, and Data Connectors integration.

    Note: Company settings from the Customize Admin Console category have been moved to Analytics Tools.

  • Report Suite Tools: Enable user permissions for Web Services, Report Suite Management, Tools and Reports, and Dashboard Items.

  • Metrics: Enable permissions for traffic, conversion, custom events, solution events, content aware, and so on.

  • Dimensions: Customize user access at a granular level, including eVars, traffic reports, solution reports, and pathing reports.

For example, you can create a group with access to multiple Analytics tools ( Analysis Workspace, Reports & Analytics, and Report Builder), with permission to specific metrics and dimensions (including eVars), and capabilities like segment or calculated metrics creation.

Changes to Predefined Groups

Administrator access: Predefined groups are no longer required for administrators. Administrators now have access to all items (tools, metrics, dimensions), as well as Web Service access, Report Builder, and Activity Map.

Going forward, the purpose of groups is to grant or restrict access to non-administrative users.

Custom groups: Custom groups have replaced predefined groups. Existing predefined groups will be migrated to custom groups, using the same group name. Any custom groups that you have created, including their settings, will be preserved. However, you will notice that the location of settings will have moved. For example, Company settings (in Customize Admin Console) are now in Customize Analytics Tools.

Users belonging to All Report Access have been migrated to a custom group with access to:

  • All Dimensions
  • All Metrics
  • All Report Suites
  • Channel Report Permission
  • Anomaly Detection Report Permission
  • Real-Time Report Permission
  • Analysis Workspace Access Permission

Administrators can delete custom groups and create their own, as all settings that were previously available in predefined groups are available for customization under the Report Access settings in Define User Groups.

Dimension-Level Permissions

You can customize permissions to include or exclude access to dimensions (in addition to metrics).

  • All current dimensions and metrics within custom groups have been automatically migrated to the new categories. If an existing group has metrics enabled, it will be given all newly permissionable dimensions (eVars and content aware) and metrics by default.

  • Classifications Importer (formerly, SAINT) permissions: Access to classifications is determined by access to the variable on which the classification is based.

See Customize Dimension Permissions.

Admin Console

Recommended only for new customers or customers with companies provisioned in the Experience Cloud. A migration for existing Analytics customers to the Experience Cloud identity management system is planned.

More information is available in Manage product permissions in the Admin Console.

Frequently Asked Questions about Permission Changes

Here is important new information about new and planned updates and how they affect your administrative environment.

Question Answer
What permissions changes came in the July 2016 release?

All Report Suite Access

When adding report suites to include in a group, you can specify All Report Suite Access. This setting applies group permissions to all current and future report suites.

To enable this feature, navigate to User Management > Groups > Add New User Group, then select All Report Suite Access.

Should I use the Admin Console to manage users, or the existing Analytics User Management?

Changes made in Analytics > Admin > User Management are not reflected in the Admin Console. Therefore, only new customers who already use the Admin Console for user and group management should continue doing so. A migration for existing Analytics group management to the Admin Console is planned.

What Permissions changes were made in the October 2016 release?

The following enhancements to the current Admin Tools interface are available:

  • Permission changes as described in Administrative Changes - Fall 2016.
  • Removed defunct traffic reports that were no longer in the menu.
  • Classifications permissions: Access to classifications will be determined by access to the variable the classification is for.

Is there anything I need to do to migrate users?

No, all permissions migrations will happen transparently.

  • All current traffic reports in a Custom Group will automatically be migrated to the new Dimension Category.
  • If a Custom Group has any metrics already enabled, it will automatically be given all newly permissionable dimensions (eVars and Solution variables).
  • A custom group with at least one metric will automatically be granted access to all eVars and other content-aware dimensions except the newly available traffic dimensions (formerly traffic reports).
  • Every predefined group will be changed into a permission. These new permissions will be added to a new Analytics Tools category.
  • Every Custom Group with any metrics will have all Analytics Solution events added as new metrics.
  • Every user that used to be in All Report Access will be added to the new custom group. All Report Access will no longer exist.

What will not change?

Visitor Attributes will continue to be non-permissioned.

Permissioning Quick Reference

The following table lists tasks and where they can take place (depending on a company’s status).


A migrated user and Experience Cloud user refer to users who have accepted an email invitation to join the Experience Cloud. If the email invitation is not accepted, users are still Analytics users and cannot be managed in the Admin Console. (The exception is if the migration is using enterprise or federated IDs. In this case, the user is migrated when the administrator migrates users on a user-by-user basis.)

Task Non-Migrating Login Company Currently Migrating Company Finished Migrating Login Company
Create a user

Admin Console (creating a user and adding him or her to an Analytics product configuration also creates the user account in Analytics).

Admin Tools

Admin Console

Admin Console

Edit a user

Admin Tools

Admin Console

Admin Tools - Editing in the Admin Tools for migrated users is limited to API-key management, and deleting / transferring assets.

Admin Console

Admin Tools - Editing is limited to API-key management, and deleting /transferring assets.

Delete a user

Admin Console - For Experience Cloud users

Admin Tools - for all users, but for Experience Cloud users, only deletes the mapped Analytics user, not the Experience Cloud account.

Admin Console - For Migrated Users.

Admin Tools - For Analytics-only Users.

Admin Console

Admin Tools - After deleting a Experience Cloud user, or un-linking their account in Admin Console, you can delete the Analytics login from Admin Tools.

Log in to Analytics

Experience Cloud: Only available for Experience Cloud users.

Analytics (legacy): For Analytics only users, and for Experience Cloud users with their Analytics credentials - only available for Experience Cloud users. - For analytics only users, and for Experience Cloud users with their Analytics credentials.

During migration, admins can turn off login ability for specific users.

Admin Console

Create a group

Admin Console - When a group is created in Admin Console, a mapped group in Analytics will appear in the Admin Tools, but this mapped group cannot have its name changed from Admin Tools, or be deleted from Admin Tools.

Admin Tools.

Admin Console ( create product configuration)

Admin Console ( create product configuration)

Edit users in a group

Admin Console - Only for Experience Cloud users

Admin Tools - both Analytics-only users, and Experience Cloud user membership to groups can be edited from Admin Tools. However, if a Experience Cloud user is part of a group in Admin Console, they cannot be removed from the group in Admin Tools.

Admin Console - Experience Cloud users only

Admin Tools - Analytics-only logins can still be added to/removed from groups in Admin Tools.

Admin Console

Edit permissions for a group

Admin Console - You can edit groups created in Admin Console.

Admin Tools - You can edit permissions for any group.

Admin Console

Admin Console

Delete group

Admin Console - You can delete only groups created in Admin Console.

Admin Tools - You can delete only groups created from Admin Tools.

Admin Console

Admin Console

Change admin status for user

Admin Console - Only for Experience Cloud users.

Admin Tools

Admin Console - Only for Experience Cloud users.

Admin Tools - Only for Analytics users.

Admin Console

On this page