Enterprise user permissions

Information about creating properties and using the Properties and Permissions functionality that lets Target administrators create separate workspaces (product profiles) in Target and then assign users different roles and permissions for individual pages, properties, or web sites based on these workspaces.

Properties and Permissions functionality is available as part of the Target Premium solution. They are not available in Target Standard without a Target Premium license.

Your Target implementation can be using any version of at.js or mbox.js.

You can tell whether your organization has a Standard or Premium license by clicking the Setup link at the top of the Target UI.

  • Target Standard Customers: If you see the Users tab (Setup > Users), your organization has a Target Standard license. Target Standard customers should follow the instructions in Users to add users and assign permissions in the Adobe Admin Console.

    Target Standard users see the following error message when clicking the Properties tab. There is nothing wrong with Target. Target Standard users do not have access to the Target Premium Enterprise Permissions functionality.

  • Target Premium Customers: If you see the Properties tab (Setup > Properties), your organization has a Target Premium license. Target Premium customers should follow the instructions in this topic and in Configure enterprise permissions.

Important: Ensure that you read the Caveats section below before proceeding with Enterprise Permissions.

Enterprise Permissions Training Video (3:16)

This video explains the Enterprise Permissions.

Learning objectives:

  • The three role levels that Adobe Target users can hold

  • The concepts of Properties and Workspaces, and how these boundaries and groupings work to allow for control over users' access levels

  • Different Property examples for your organization to consider

Terms and Definitions Used in this Section

The following terms are used throughout this section and might be new to users wanting to use the Properties and Permissions functionality in Target Premium.

Term Definition

Property

Properties are similar in nature to those within Dynamic Tag Management (Activation) in that they use a unique snippet of code to differentiate them.

A web property is a library of rules and one embed code. A web property can be any grouping of one or more domains and subdomains.

Properties are enabled by adding a specific name/value pair as a parameter with any call (mbox, api, etc.) to Target.

Properties belong to specific channels (Web, Mobile, Email, or API/Other).

Workspace (Product Profile)

A workspace lets an organization assign a specific set of users to a specific set of properties. In many ways, a workspace is similar to a report suite in Adobe Analytics.

Note: Workspaces are known as Product Profiles in the Adobe Admin Console for Enterprise.

If you are part of a multi-national organization, you might have a workspace for your European web pages, properties, or sites and another workspace for your American web pages, properties, or sites. If you are part of a multi-brand organization, you might have a separate workspace for each of your brands.

Users can be part of multiple workspaces and can even have different roles within each workspace.

Users can have different views of Adobe Target by moving between workspaces, similar to how Analytics users have different views of Analytics by moving between Report Suites.

Workspaces can include complete different audiences, code offers, and activities.

All audiences and activities created before the new Enterprise Permissions model migration will be grouped together in the "Default Workspace," discussed below.

All activities created via Adobe Experience Manager (AEM), Adobe Mobile Services, and Adobe Target Classic will be part of the "Default Workspace."

Default Workspace

All existing workspaces (product profiles) within Admin Console are merged into a single workspace called "Default Workspace" during your organization's migration to the new Enterprise Permissions model.

Important: Do not delete the Default Workspace.

All user roles and access to all Target functionality remains exactly the same as they were prior to the migration to the new Enterprise Permissions model.

User Groups

You can create user groups, such as Developers, Analysts, Marketers, Executives, etc., and then assign privileges across multiple Adobe products and workspaces. Assigning a new team member all the appropriate privileges across different Adobe products can be as easy as adding them to a specific user group.

Roles and Permissions

Roles and permissions determine the access levels that users have to create and manage activities in your Target implementation. In Target, roles include the following:

  • Observer: Can view activities, but cannot create or edit them.

  • Editor: Can create and edit activities before they are live, but cannot approve the launch of an activity.

  • Approver: Can create, edit, and activate or stop activities.

Channel

Channel refers to the content type of where your Target activities are delivered: webpages, mobile apps, email messages, and so forth.

When you create a new activity, it is created in the currently selected workspace. You'll see channel selection options in the first dialog box that lets you choose the desired channel for the activity: Web, Mobile App, Email, or Other/API.

Permissions Overview

The following information explains the way permissions were enforced previously in Target and how they are enforced using the Properties and Permissions functionality.

The new Permissions functionality lets you create different projects (called "Product Profiles" in the Adobe Admin Console for Enterprise) to allow you to assign different permissions for a single user that dictate that user's access rights for each project. These distinct projects can be compared to the way that report suites work in Adobe Analytics. Each project can have specific users with specific roles that apply to a set of properties. The result is that customers will be able to restrict the view, edit, and approval access to their users based on region, environment (dev/stage/prod), channel, or other custom criteria, as shown below:

For example, a specific user might have "approval" access on the Americas websites but only "view" access on the European mobile app. That same user might not have any access to even view the activities offered on web and mobile properties in the APAC region.

The current Target Permissions model has three permission roles (Observer, Editor, and Approver), as shown in the following illustration:

Each role has different levels of permissions:

Role Description

Observer

Has read-only access to activities. Can view activities, but cannot create or edit them.

Editor

Can create and edit activities before they are live, but cannot approve the launch of an activity.

Approver

Can create, edit, and activate or stop activities.

It is important to note that each user's role applies to every page, property, or site in your account that includes Target tags, as shown below:

The new Target Permissions model has the same three permission roles (Observer, Editor, and Approver); however, you can assign a user's permissions roles separately for individual pages, properties, or sites, as shown below:

In this example, Jan has Approver permissions to the US Homepage and the US Site and Observer permissions to the France Site.

Furthermore, Jan won't be able to see pages, properties, or sites in Target that she doesn't have permissions to see, as shown below:

In this example, Jan cannot see the Product Pages, Russia Site, and the Careers Site.

Use Case Scenarios

The following use cases might be helpful to understand how properties, projects, roles, and permissions can help you achieve your marketing goals with Target:

Type of Organization Example Project and Permissions Structure

Multi-national organization

If you are part of a multi-national organization, you might have a workspace for your European web pages, properties, or sites and another workspace for your American web pages, properties, or sites.

After a reorganization, using the personas in the illustrations above, you might set up workspaces and permissions similar to the following:

  • Jan: Jan is the Head of Optimization in the Center of Excellence for her organization's United States web pages, properties, and sites. She most likely has System Admin rights in the Adobe Experience Cloud.

    In her role, she has Approver permissions for the US Homepage and the US Site. With Approver permissions, she can create, edit, and activate or stop activities.

    Jan also consults with the optimization team in France and, therefore, has Observer permissions for the France Site that give her read-only access to activities. Jan can view activities, but cannot create or edit them.

    Because Jan has no role that necessitates her seeing the Product Pages, Russia Site, or Careers Site, she cannot see activities for those sites.

  • Ernie: Ernie is a Marketing Manager for the organization in charge of marketing in the United States.

    Because Ernie is fairly new to the organization and somewhat inexperienced with Target, he has Editor permissions for the US Homepage, US Site, and Product Pages. With Editor permissions, Ernie can create and edit activities before they are live, but he cannot approve the launch of an activity—someone with Approval permissions, such as Jan, must approve the activity before it can be put into production.

    Because Ernie has no role that necessitates him seeing the Russia Site, France Site, or Careers Site, he cannot see activities for those sites.

  • Diana: Diana is now an Analyst for the organization and has been granted Observer permissions for the US Homepage, US Site, Product Pages, Russia Site, and the France Site that give her read-only access to activities. Diana can view activities, but cannot create or edit them.

    Because Diana has no role that necessitates her seeing the Careers Site, she cannot see activities for those sites.

Multi-brand organization

If you are part of a multi-brand organization, you might have a separate workspace for each brand's web pages, properties, or sites.

After a reorganization, using the personas in the illustrations above, you might set up projects and permissions similar to the following:

  • Jan: Jan is the Head of Optimization in the Center of Excellence for a heath-care organization that operates in the hospital-product and consumer-product spaces. She most likely has System Admin rights in the Adobe Experience Cloud.

    In her role, she has Approver permissions for the Hospital Site. With Approver permissions, she can create, edit, and activate or stop activities.

    Jan also consults with the optimization team in the consumer-products space and, therefore, has Observer permissions for that site that give her read-only access to activities. Jan can view activities, but cannot create or edit them.

  • Ernie: Ernie is a Marketing Manager for the organization in charge of marketing in the consumer-product space.

    Because Ernie is fairly new to the organization and somewhat inexperienced with Target, he has Editor permissions for the Consumer Site. With Editor permissions, Ernie can create and edit activities before they are live, but he cannot approve the launch of an activity—someone with Approval permissions for the Consumer Site, but not Jan in this scenario, must approve the activity before it can be put into production.

    Because Ernie has no role that necessitates him seeing the Hospital Site, he cannot see activities for that site.

  • Diana: Diana is now an Analyst for the organization and has been granted Observer permissions for the Hospital Site and the Consumer Site that give her read-only access to activities. Diana can view activities, but cannot create or edit them.

Target UI Property and Permissions Touchpoints

The new Permissions functionality can be seen in various places in the Target UI.

  • Workspace (Product Profile) drop-down list: The Workspace drop-down list displays at the top of the Activities, Audiences, and Offers pages. Select the desired workspace to filter the list to display only items in the selected workspace.

  • Activity Creation: When you create a new activity, it is created in the currently selected workspace. You'll see channel selection options in the first dialog box that lets you choose the desired channel for the activity: Web, Mobile App, Email, or Other/API.

  • Audience Creation: When you create a new audience, it is created in the currently selected workspace.

  • Offer Creation: When you create a new offer, it is created in the currently selected workspace.

  • Properties page (Setup > Properties): You can use the Search box, the Channel, and Product Profile options to filter the Property List.

Caveats

Consider the following when using or configuring properties and permissions in Target Premium:

  • Important: Do not delete workspaces with activities. If this happens, work with client care to recover those activities.
  • When using the All My Workspaces view:

    • You can see activities, audiences, and offers for all workspaces that you have the proper roles and permissions to access.

    • When you select the All My Workspaces view, a new column is added to the Activities, Audiences, and Offers page that lists the item's workspace and your user permission associated with that item (Observer, Editor, or Approver),

    • When creating an activity, audience, or offer in the All My Workspaces view, you must select the workspace where the item is to be created. Only those workspaces can be selected for which you have the Editor or Approver permission.

    • When copying an activity, audience, or offer in the All My Workspaces view, you must select the workspace where the item is to be copied. Only those workspaces can be selected for which you have the Editor or Approver permission.

  • Any setting on the following the Setup pages can be controlled by any Approver in any workspace:

    • Preferences

    • Implementation

    • Scene7 Settings

    • Hosts

  • Users cannot move resources from one workspace (product profile) to another. Copy, however, is supported.

  • When viewing audiences from the Audiences page, the page loads slower than expected. If you interact with the search bar in any way, audiences display faster. This is a known issue and will be fixed in an upcoming update. This issue does not affect selecting audiences during the activity-creation workflow.

  • The following resources are or are not part of the new Enterprise Permissions model:

    Are Part of New Enterprise Permissions Model Are Not Part of New Enterprise Permissions Model

    The following resources are part of the new Enterprise Permissions model:

    • Activities, audiences, and code offers created within Target Standard/Premium after the customer is enabled for permissions. (Note: customers must be entitled to Target Premium.)

    • Properties can be added to existing activities in the Default Workspace; however, this is subject to change.

    The following resources are not part of the new Enterprise Permissions model:

    • Image offers

    • All Recommendations resources:

      • Criteria Library

      • Design Library

      • Catalog

      • Recommendations Setup

    Only new resources (such as activities, code offers, and audiences) created within Target Premium (after Enterprise Permissions are enabled) will be available to restrict by permissions.

    Existing resources (such as activities, code offers, and audiences) created within Target Premium prior to enabling Enterprise Permissions can be copied but cannot be moved to other workspaces.

    External resources are available only to users in the Default Workspace. A user's role in the Default Workspace applies globally (to all Target requests and all Target resources).

    Activities, audiences, code offers, image offers, or any other resource created using the following solutions or methods cannot be controlled by the Enterprise Permissions model, but will be part of the Default Workspace:

    • Target Classic

    • Adobe Experience Manager (AEM)

    • Adobe Mobile Services

    • Resources created via API (including activities, audiences, code offers, and image offers).

    Image offers (assets stored under https://[tenantName].marketing.adobe.com/content/mac/[tenantName]/target/offers.html#image-library) cannot be controlled by the Enterprise Permissions model at this time.

    clickTracking and redirects will only work when the destination link or destination page are part of a property that is included in the activity. Additionally, clickTracking may not work when using the targetPageParams() function. The targetPageParamsAll() is the recommended function.

    Target currently requires an at_property token to be present on any page where tracking occurs. In the event that the token is (1) not present, (2) not detected at the time of activity setup (within the VEC), or (3) not passed to the clickTracking mbox via the targetPageParamsAll() function, the metric will not be incremented and will appear as "0."

    The same applies for activities using redirects. The destination page must have an at_property token and be recognized at the time of setup within the VEC.

    In a future release, Target will work on pages where no at_property token is present or pages where a different at_property token is present.

  • The Enterprise User Permissions functionality is not supported in Adobe I/O API calls.

Frequently Asked Questions

Can I move an activity from one workspace to another?

Unfortunately, you cannot move activities from one workspace to another. However, you can copy an activity to any workspace knowing that reporting data will not carry over. For more information, see "Copying/Editing an Activity When Using Workspaces" in Copying/Editing an Activity When Using Workspaces.

Activities created before the migration continue to run the same way in the Default Workspace unless they are edited and assigned properties. Activities under a specific workspace will honor properties assigned to that workspace and, therefore, behavior might not remain same as before the migration.