Adding and Editing Users

In order to access the OneTrust Platform, every user will need their own user profile. You can add users to the account directly from Global Settings. Users can be assigned multiple roles within multiple organizations, which can provide flexibility to accommodate each user's specific permissions needed to perform their respective job duties. Users can also be assigned to user groups through which they will inherit the roles associated with that user group in addition to their existing roles and permissions.

Note:

For additional information, click here to reference frequently asked questions (FAQ) about user management.

To add a user

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User management > Users.


    The Users screen appears.

  3. Click the Add user button.

    The Add user details section appears.

  4. Complete the required fields and enter additional details, as needed.


    Section

    Field

    Description

    User details

    First name

    Enter the user's first name.

    Last name

    Enter the user's last name.

    Email address

    Enter the email address for the user. The email address must be unique and will be used to access the platform.

    Note:

    The OneTrust platform only supports email addresses that contain less than 100 characters.

    External user

    Select the check box if this is an external user. Leave the check box blank if this is an internal user.

    Enter expiration date

    Enter the date on which an external user's access to the platform should automatically expire.

    Note:

    This field is available when the External User check box is selected. This optional feature can be used when you need to add external users for a short period of time; for example, just the amount of time necessary for a vendor to complete an assessment.

    Additional attributes (Optional)

    Business unit

    Enter the user's business unit.

    Department

    Enter the department with which the user is associated.

    Division

    Enter the division with which the user is associated.

    Employee ID

    Enter the user's employee ID.

    Job title

    Enter the user's job title.

    Manager

    Select the user's manager from the list of users within the platform.

    Manager (Legacy)

    Enter the name of the user's manager.

    Note:

    The Manager (Legacy) field will be deprecated in the future. OneTrust recommends using the new Manager field to populate this attribute for new and existing users.

    Office location

    Enter the location of the user's office.

    Assign roles to user

    Role

    Select a role to assign to the user. You can select from the default roles provided in the platform or select a custom role. You can also assign multiple roles to the user.

    For more information about roles and how to customize them, see Creating and Editing Custom Roles.

    Note:

    The following characters are restricted and cannot be used for role names: / ? # % & = + [ ] { } | \ ^ ' " < >

    Organization

    Select the organizational group in which the user will have the defined role.

    For more information about organizational groups and hierarchy, see Managing Organizations.
  5. Click the Next button. For more information, see .

    The Assign roles to user section appears.

  6. Click the Add role button.

    The Add role modal appears.

  7. In the Role field, select a role to assign to the user.
  8. In the Organization field, select the organizational group in which the user will have the defined role.
  9. Click the Add button.


    Note:

    You can assign multiple roles within multiple organizations to a user by repeating steps 5 - 8 or by clicking the Save and add new button on the Add role modal.

    The selected role appears in the Assign roles to user section.

  10. Click the Create button.
    Note:

    The new user will be sent a Welcome email with a link to access the platform. Clicking the link will take the user to the OneTrust Login screen and the user will be prompted to create a password before accessing the platform.

    If needed, you can resend the Welcome email by clicking the Context Menu icon corresponding to the given user on the Users list screen and selecting Resend invite. Then click the Send button on the Resend invite modal to resend the email. However, the Resend invite option is only available if the user has never logged in to the OneTrust Platform.

    To disable sending the Welcome email to new users that will use basic authentication to log in to the platform (e.g. users with non-SSO email domains), disable the Welcome Email template on the Templates tab on the Email screen.

    To disable sending the Welcome email to new users that will use Single Sign-On (SSO) to log in to the platform, disable the Welcome Email (Directory User) template.

    For more information on disabling email templates, see the To disable an email template procedure in Emails: Branding & Templates.

User information tab

On the User information tab on the Users screen, you can modify an existing user's details and any additional attributes configured when the user was created.

Note:

If editing the user's email address, see Editing a User's Email Address.

To edit user details

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user you want to edit. The User information tab on the Users screen appears.

  4. Hover over a field you want to modify, and click the Edit icon that appears. Editable fields become available.



  5. Edit the fields, as necessary.

  6. Click the Save button.

Editing a User's Email Address

Global Settings Configuration

Site admins can configure whether a user is required to confirm changes to their email address using the Require user confirmation to change login email setting on the User settings screen in Global Settings.



Based on the selected configuration, the following scenarios will apply:

Global Settings Configuration

Description

Require user confirmation to change login email setting is enabled in Global Settings

If a change is made to a user's email address, an email message will be sent to the new email address with a link to confirm the change. Another email message will be sent to the old email address to inform the user of the change request.

Note:

The email address will be updated in the platform only after the change request is confirmed using the received link.

Require user confirmation to change login email setting is disabled in Global Settings

Changes made to a user's email address will be automatically updated and will take effect immediately. Users will not be required to confirm the change once submitted.

Things to Know

  • If SSO is enabled, Site admins will need to ensure that the new email address is updated in the IdP for the change to take immediate effect. It is important to update the email address correctly in both the IdP and the platform to avoid user lockout and/or unwarranted access.

  • A user's email address cannot be updated in the following scenarios:

    • The user being edited is an external user.

    • The user being edited is an invited user.

    • The user who is attempting to update the user's information is an External Site admin. OneTrust Consultants are generally External users and cannot perform this action within your account.

    • The user who is attempting to update the user's information is not assigned to the root organization.

    • The user is attempting to update their existing email address on a domain verified for SSO to an email address that is not on a domain verified for SSO.

  • If the user's existing email address is on a domain verified for SSO, their new email address must also be on a domain verified by SSO. If this is not the case, the Site admin can either add and verify the new domain for SSO or remove the existing domain from SSO when updating a user's email address.

  • If the user is experiencing issues with updating their email address, cancel any open email update requests for that user by navigating to the Users > User information tab for that user and clicking the Cancel change button. Then access the User settings screen and disable the Require user confirmation to change login email setting. Navigate back to the User information tab for that user in the platform and try updating the user's email address once more.

  • Users that belong to multiple OneTrust accounts in the same environment (multi-tenant users) can update their email address in a single account and have the change apply to all OneTrust accounts associated with that user. However, a different email address cannot be merged into an existing email address that already exists within the same environment. The update process will vary based on the user status:

    • For non-SSO users or users that have never logged in to the OneTrust Platform: Email updates will apply immediately across all accounts.

    • For all other users: Email updates require verification through a confirmation link sent to the new email address that will require the user to authenticate with their existing credentials.

      Note:

      Email updates for multi-tenant users will need to be confirmed regardless of whether the Require user confirmation to change login email setting is enabled or disabled.

To edit a user's email address

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user you want to edit. The User information tab on the Users screen appears.

  4. Hover over the Email address field, and click the Edit icon that appears. Editable fields become available.

  5. In the Email address field, update the user's current email address to the new email address.

    Note:

    The OneTrust Platform only supports email addresses that contain less than 100 characters.

  6. Click the Save button.

Roles tab

On the Roles tab on the Users screen, you can assign, edit, and remove roles from the user. Roles assigned to the user individually as well as roles inherited by the user through an assigned user group appear on the Roles tab. In addition, when the user logs in, they will then be able to see their access granted by their assigned roles.

Important:

A user must keep at least one role in their default organization. You can't remove the user's primary role directly. If you want the user to keep a different role, first assign or keep the role you want in the default organization. Then update or remove the other role.

Note:

For more information on identifying your assigned roles and organizations, see Viewing Assigned Roles and Organizations.



To assign roles to a user

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user to which you want to assign a role. The User information tab on the Users screen appears.

  4. Navigate to the Roles tab. The roles assigned to the user appear.

  5. Click the Add role button. The Add role modal appears.



    Field
    Description
    Role

    Select a role to assign to the user.

    Note:

    Only existing Site admins can assign the Site admin role to another user.

    Organization

    Select the organizational group in which the user will have the defined role.

  6. Complete the fields, as necessary.

  7. Click the Add button.

To edit an assigned role

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user for which you want to edit a role. The User information tab on the Users screen appears.

  4. Navigate to the Roles tab. The roles assigned to the user appear.

  5. Hover over the role that you want to edit, and click the Context Menu icon that appears.

  6. On the Context menu, select Edit. The Edit modal appears.



  7. Modify the fields, as necessary.

  8. Click the Save button.

To remove roles from a user

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user from which you want to remove a role. The User information tab on the Users screen appears.

  4. Navigate to the Roles tab. The roles assigned to the user appear.

  5. Select the check boxes corresponding to the role(s) you want to remove from the user. Multiple check boxes can be selected.

  6. Click the Remove button. The Remove role modal appears.

    Note:

    At least one role must remain assigned to a user.



    Note:

    If the role you are removing is tied to an assigned user group, the modal below will appear stating that the user will be removed from the respective user group. All inherited roles and permissions granted by the user group will be removed from the user. You can identify which roles were inherited from a user group using the User group column on the Roles tab.



  7. Click the Confirm button.

User groups tab

On the User groups tab on the Users screen, you can assign the user to user groups. When a user is added to a user group that has additional roles that the user may not currently have, the user will inherit the roles associated with that user group in addition to their existing roles and permissions. When the user logs in, they will then be able to see their additional access granted by those new roles.

Note:

For more information on identifying your assigned roles and organizations, see Viewing Assigned Roles and Organizations.



To add the user to a user group

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user that you want to add to a user group. The User information tab on the Users screen appears.

  4. Navigate to the User groups tab. The user groups to which the user is added appear.

  5. Click the Add user group button. The Add User to User Group(s) modal appears.



  6. In the User group field, select the user group(s) to which you want to add the user.

  7. Click the Add button.

To remove the user from a user group

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select User management > Users. The Users screen appears.

  3. Click the link in the Name column for the user that you want to remove from a user group. The User information tab on the Users screen appears.

  4. Navigate to the User groups tab. The user groups to which the user is added appear.

  5. Select the check boxes corresponding to the user group(s) from which you want to remove the user. Multiple check boxes can be selected.

  6. Click the Remove button. The Remove user from user group modal appears.



    Note:

    If removing the user from multiple user groups, the Remove user from multiple user groups modal appears.



  7. Click the Confirm button.

User Management FAQ

The following responses are supported solutions to frequently asked questions (FAQ) about user management. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.

Why am I receiving the following error message: "Unable to add user as an email update is In progress."

This error message appears if an update to a user's email address is actively in progress and an attempt to create a new user with that same email address is made. You can locate the user record that is actively being updated on the Users screen by either searching for the user's old email address or by searching for the user's first or last name.

The error can be resolved using one of the following methods:

  1. The user can confirm the change via the link in the email message sent to the new email address.

  2. If the user is unable to confirm the change, you can cancel the change, disable the Require user confirmation to change login email setting in Global Settings, and update the user's email address again. With this setting disabled, changes made to a user's email address will be automatically updated and will take effect immediately. Users will not be required to confirm the change once submitted.

    Note:

    For more information, see Editing a User's Email Address.

Why can't I remove a user's role?

If the Remove option is unavailable, the role may be the user's primary role in their default organization. A user must keep at least one role in that organization.

To change which role the user keeps, first make sure the correct role is assigned in the default organization. Then remove or update the other role.