User access management from Campaign Standard to Campaign v8 user-management-acs

Both Adobe Campaign Standard and Adobe Campaign v8 enable users to define and manage permissions for different users/operators. These permissions consist of specific rights that grant users access to various features of the product. However, the two products use distinct approaches and implementations for managing user access.

The following concepts are used in Adobe Campaign Standard and Campaign v8 to achieve user access management:

Migration approach from Security group to Operator group

The table below outlines the migration approach for user role groups when transitioning from Adobe Campaign Standard to Campaign v8. In Campaign Standard, a Security group, referred to as an Operator group in Campaign v8, is used to assign a set of roles to a user. While some security groups/operator groups are available out-of-the-box, users can create new groups or modify existing ones if needed.

In both Adobe Campaign Standard and Campaign v8, Security groups and Operator groups are mapped to Product profiles in the Admin console. If you want to assign a Security group or Operator group to a user, you can link the corresponding Product profile in the Admin console. This association is synchronized when the user logs in. Learn more about Product profile

Migration approach from User roles to Named rights

In Adobe Campaign Standard, the term User role is referred to as Named right in Campaign v8. The table below outlines the terminology used for Named rights in Campaign v8 corresponding to User roles in Campaign Standard.

Migration approach from Organizational unit

In Adobe Campaign Standard, the Organization unit is mapped to the existing Folder hierarchy model in Campaign v8 to maintain similar access control. Learn more about folder management

About parallel organizational unit assignment parallel-assignments

A parallel organizational unit assignment occurs when a user has access to multiple units (assigned via security groups) that exist in separate branches of the hierarchy without having access to a common parent org unit. This creates a security risk during migration.

For example, consider the following organizational unit hierarchy:

{width="50%" modal="regular"}

An assignment without parallel organizational units would look like:

{width="50%" modal="regular"}

Here, the user has access to organizational units A, A1, and A2-1, all connected under the parent org unit A. The user can access everything under A.

The following assignment contains parallel organizational units:

{width="50%" modal="regular"}

The user has access to A1-1, A2 and A2-1, which exist in separate branches with no common assigned parent.

Security implications

Resolution

Parallel organizational unit assignment can be resolved by ensuring all organizational units assigned to a user fall under a single, common parent unit that is also assigned to the user.

Some ways to achieve this are mentioned below:

For the example above where a user has access to A1-1, A2, and A2-1, specific resolutions steps are:

Migration approach from Program

In Campaign v8, Programs are represented as Folders. Campaign v8 enables the creation of folders and allows restricting access to them.

By using Groups and Named rights, Operators can be granted access to specific Folders within the navigation hierarchy, with the ability to assign read, write, and delete permissions. Learn more about folder management

Since a Program is treated as a Folder in Campaign v8, its access can be managed in the same way as any other folder. After migration, Campaign Standard administrators can follow these steps:

Product profile mapping to access REST APIs

To access transactional APIs from the execution instance in Campaign v8, a new Product profile is required, in addition to the Administrator and Message Center product profiles. This new Product profile will be added to existing or pre-created technical accounts in Campaign Standard.

After migration, Campaign Standard users should review their Product Profile mappings and assign the appropriate Product Profile if they do not wish to link their Technical accounts to the Administrator Product Profile. For future integrations, we recommend using the Campaign v8 Tenant ID in the REST URL instead of the previous Campaign Standard Tenant ID.

Migration of access to built-in Campaign resources for Campaign Standard operators

Operators migrated from Campaign Standard will have read access to specific built-in resources in Campaign v8.

Non-migrated security groups and roles non-migrated-groups-roles

Below is a list of Campaign Standard roles that have not been transitioned:

Below is a list of Campaign Standard security group mappings that have not been transitioned.