Genesys Cloud enables administrators to assign roles to groups, allowing all group members to inherit associated permissions and access controls simultaneously through a division-based role management system. When roles are assigned at the group level, all current and new members automatically inherit those permissions, while removing a user from the group revokes their associated role permissions. Roles inherited through group membership cannot be edited at the individual user level; modifications must occur at the group level.
The system supports division-based access control, enabling organizations to restrict role permissions to specific configuration objects by division. Administrators create divisions through User Management > Divisions and assign configuration objects to each division, then associate those divisions with group roles. This approach allows multiple users in different geographic locations to hold identical roles while accessing only their respective division's campaigns and configuration objects. For example, outbound administrators in different contact centers can hold the same Outbound Admin role while accessing only their respective division's resources.
Configuration involves creating divisions with optional descriptions, then assigning campaigns to those divisions through the Campaigns tab. Administrators establish contact center-specific groups through the User Management menu with options to control group visibility (Public, Members Only, or Owners Only). Individual administrators are added to groups by searching for and selecting users from the system. Role and division assignment occurs at the group level, where the same role is paired with different divisions to restrict access appropriately.
The system includes a security restriction preventing role assignment to groups with membership rules unless those rules are explicitly disabled. When configuration objects are created, they are automatically assigned to the Home division; administrators must explicitly move them to different divisions to enforce proper access controls. Outbound dialing administrators can assign divisions directly during campaign configuration, with access restrictions ensuring they can only select divisions to which they belong. If Division-Aware Role Management is enabled at the organization level, administrators must possess relevant permissions on a per-division basis to grant roles. This structured approach enables efficient permission management and granular control over resource access across multiple contact centers.
Administrators can use a group’s Roles tab to grant a role to all members of a group and to assign divisions to that role. These divisions set which that the role can access. For more information, see the eaxmple.
For more information about divisions and how to create them, see Divisions overview.
When you assign a role to a group, all members of the group gain the permissions associated with that role. Any new members of the group inherit the same roles and permissions. If you remove a member from a group, that user loses the roles and permissions associated with the group.
Also, roles that a user inherits from a group are not editable in that user’s roles section. Instead, you can see the group from which the user inherited group permissions. You cannot edit divisions. You cannot remove a role from a user unless you remove the role from the group or remove the user from the group.
To grant a role and its divisions to multiple people, create a group.
To grant users who have the same role the access to different configuration objects, create multiple groups.
Note: If the Division-Aware Role Management setting is enabled at the organization level, then admins must have the relevant permission on a per-division basis to provide role grants for users. For more information, see Enable division-aware role management.
Assign a role to group
Click Admin.
Under Directory, click Groups.
Click Menu > User Management > Groups.
Click the name of the group that you want to edit.
Click the Roles tab.
To assign a role to your group, click Assign Roles.
Find the role that you want to add to the group, and to the right enable Selection.
From the Divisions list, select the division to associate with the group and add access controls.
Example
This is an example of how roles for a group can work.
Suppose that your organization has outbound contact centers in New York and California. You want to prevent outbound administrators from administering campaigns outside their own area. An admin in California does not need access to New York’s campaigns. An admin in New York does not need access to California’s campaigns.
All outbound dialing administrators play the same role (Outbound Admin), but administrators in each contact center only need access to their own configuration objects.
Step 1: Define each contact center as a division having its own set of configuration objects
Divisions define a set of . Divisions do not define who can use those objects.
Click Admin.
Under People & Permissions, click Divisions.
Click Menu > User Management > Divisions.
Click Create Division.
Name the division CA Call Center.
Click Save. The new division opens to the Settings tab.
Optionally add a more detailed description to the division and then click Save.
To move configuration objects to the division, click the Campaigns tab.
In the Add new campaign box, begin typing the first few letters of the campaign name and then select it from the list. Genesys Cloud adds the campaign to the division. Select only California contact center campaigns.
Repeat step 8 for each additional campaign you want to add.
Click Admin.
Under People & Permissions, click Divisions.
Click Menu > User Management > Divisions.
Click Create Division.
Name the division NY Call Center.
Click Save. The new division opens to the Settings tab.
Optionally add a more detailed description to the division and then click Save.
To move configuration objects to the division, click the Campaigns tab.
In the Add new campaign box, begin typing the first few letters of the campaign name and then select it from the list. Genesys Cloud adds the campaign to the division. Select only New York contact center campaigns.
Repeat step 8 for each additional campaign you want to add.
Step 2: For each contact center, define a group of its outbound administrators
To identify where outbound dialing administrators work, create groups named CA Dialer Admins and NY Dialer Admins.
Click Admin.
Under Directory, click Groups.
Click Menu > User Management > Groups.
Click Add Group.
Type CA Dialer Admins in the Name box.
Optionally change the group’s visibility from Public to Members Only, or Owners only.
Click Save. After a few seconds, a profile page for the group appears, opened to the Membership tab.
Click Edit.
Click the Individuals tab.
Type all or part of a California administrator’s name in the Add Person box. Then select a person from the list of results. The system adds the selected person to the list of individuals who belong to this group.
To add more administrators to the group, repeat the previous step until it contains all outbound dialing administrators for the contact center.
Click Save.
Click Admin.
Under Directory, click Groups.
Click Menu > User Management > Groups.
Click Add Group.
Type NY Dialer Admins in the Name box.
Optionally change the group’s visibility from Public to Members Only, or Owners only.
Click Save. After a few seconds, a profile page for the group appears, opened to the Membership tab.
Click Edit.
Click the Individuals tab.
Type all or part of a New York administrator’s name in the Add Person box. Then select a person from the list of results. The system adds the selected person to the list of individuals who belong to this group.
To add more administrators to the group, repeat the previous step until it contains all outbound dialing administrators for the contact center.
Click Save.
Step 3: Assign a role and division to each group
Assign the Outbound Admin role to both groups, but assign a different division to that role in each group. This process ensures that administrators cannot access any campaigns except their own.
Note: You cannot assign roles to a group with membership rules.
To permit the assignment of roles to the group, you must Enable Rules. In addition, the group may not have associated rules. If the group has membership rules, you receive a warning. If you continue, then you lose all rules associated with the group. For security, this restriction prevents rules from adding members to a group that in turn gives members access to permissions that someone did not specifically grant.
Members of a group receive the permissions assigned to roles, with granular divisions that determine which configuration objects members of that group can access. Members of different groups may inherit the same role (Outbound Admin for example). However, the divisions assigned to each group define the resources (such as campaigns) that each group can access.
Assign to the CA Dialer Admins group, the Outbound Admin role, and the CA Call Center division. This step gives all members of the CA Dialer Admin group authorization to administer outbound campaigns, but only for campaigns in the CA Call Center division.
Complete these steps:
Click Admin.
Under Directory, click Groups.
Click Menu > User Management > Groups.
Type CA Dialer Admins in the search box.
To edit the group, click CA Dialer Admins.
Select the Roles tab.
Click Enable Roles.
Click Assign Roles.
Click Next to locate the Outbound Admin role.
Enable the Selection switch for the Outbound Admin role.
Type CA in the Divisions box. Then select CA Call Center from the result list.
To remove the Home division, click .
Click Save.
Assign to the NY Dialer Admins group, the Outbound Admin role, and the NY Call Center division. This step gives all members of the NY Dialer Admins group, authorization to administer outbound campaigns, but only for campaigns in the NY Call Center division.
Complete these steps:
Click Admin.
Under Directory, click Groups.
Click Menu > User Management > Groups.
Type NY Dialer Admins in the search box.
To edit the group, click NY Dialer Admins.
Select the Roles tab.
Click Enable Roles.
Click Assign Roles.
Click Next to locate the Outbound Admin role.
Enable the Selection switch for the Outbound Admin role.
Type NY in the Divisions box. Then select NY Call Center from the result list.
Click x to remove the Home division.
Click Save.
What to do after new configuration objects are created
When an administrator adds a new configuration object, the system automatically assigns it to the Home division. To limit access to the object, move it to a different division. For more information, see Move objects from one division to another.
However, for outbound dialing campaigns, the Outbound Admin can assign a division directly in the campaign configuration. If the campaign entry includes division assignment, then Genesys Cloud automatically updates the division.
Outbound dialing administrators can select only those divisions of which they are a part.
[NEXT] Was this article helpful?
Get user feedback about articles.
Assign roles to a group - Genesys Cloud Resource Center