User and group management

There are many types of users who play a part of any Assets (Digital Asset Management) workflow, each requiring access to different parts of the system.

You can control access and permissions for your users in the following ways:

• User roles: Determine what users can access and do in the Cloudinary Console and product environments.
• User groups: Organize users into groups to manage shared permissions efficiently, rather than configuring access for each user individually. For more details, see User group configuration.
• Folder and collection permissions: Control which users and groups can access specific folders and collections, and what actions they can perform on their contents. See Access permissions via folder sharing and Access control via collections.
  • These permissions apply to users with the Media Library User system role, or with custom roles that don't grant access to all content in the product environment.

Check out the Introduction to Cloudinary Assets pathway in the Cloudinary Academy for free self-paced courses on DAM topics.

Recommended workflow

It's important to carefully plan your setup so that your folder structure and the assets each folder contains correspond accurately with your users, groups, and the roles and permissions they'll have.

It's recommended to follow a process similar to the following:

Plan your Assets setup as described, then implement the steps in the same order. Follow the links for more information on each topic:

1. Define user groups: Think about the different teams in your organization, such as Designers, Marketers, and Content managers. Groups should represent teams of users who need to access the same assets.
2. Plan and create roles: Review the available system roles and decide which apply to each group and user type. Enterprise customers can also create custom global and content roles in Role Management to match their specific access requirements.
3. Assign global roles to user groups: In the Groups tab of User Management, assign system roles or custom roles to each user group to define their account-level and product environment-level access.
4. Add and configure users: Create user accounts and assign each user the appropriate groups and roles.
5. Create folder structure: One of the main considerations when creating a folder structure is who gets access to each folder and the assets within it. Keep in mind that permissions cascade from folder to subfolder: if you grant access to a folder, you can't restrict it for any of its subfolders.
   The Cloudinary Assets product provides powerful search and metadata capabilities, so there's no need to design a deep folder structure for organization. You can focus on using folders to define access levels.
6. Add assets to folders: Add assets to the folders that reflect the right access levels for them.
7. Share folders (and optionally collections) with user groups and individual users: For each folder, grant the appropriate permission level to each user group that needs access.

User group configuration

User groups let you manage permissions for many users at once. Instead of configuring access user by user, you assign permissions to a group and all members inherit them automatically. You can assign a user to a group when inviting them, rather than assigning roles directly to the individual.

You can assign two types of roles to a group, each in a different place:

• Global roles: System roles (all plans) or custom roles (Enterprise only) that define account-level and product environment-level access. Assign them to a group in the Groups tab of the User Management page of Console Settings. All group members inherit these roles, making groups the most efficient way to manage access at scale.
• Content roles: Folder and collection roles that define access to specific content. Assign them by sharing a folder or collection with the group from the Media Library. See Access permissions via folder sharing and Access control via collections.

Also keep in mind:

• A user can belong to more than one group. If permissions conflict between two groups, or between a group and permissions assigned directly to a user, the higher (less strict) permission applies.
• In the User Management page of Console Settings, you can create and delete user groups, view the number of members in each group, and edit group details. While editing, you can rename groups, view member lists, search for members by name or email, and add or remove members.
• You can't add yourself to a user group in the Console, because group membership can give you permissions you don't already have. Another user with user management permissions can add you, and you can still remove yourself from a group. The root user isn't subject to this restriction.

For instructions on creating groups, assigning global roles to groups, and managing group membership, see Create and manage groups.

User configuration

The My Profile page of Console Settings includes your personal profile details, email preferences, and two-factor authentication setup. Any user can update their personal information here.

To configure settings for all account users (adding, modifying, or removing users), you need user management permissions. The Master Admin and Admin system roles include this by default. Enterprise customers can also grant it via custom roles.

• You can view and manage all account users, including adding users, removing users, changing their roles, and more.
  
• You can activate SAML login for your organization from the Account Security page of the Console Settings.

Root user

The Root User is automatically created in a Cloudinary account as the first user and holds permanent, full administrative access. This user is essential to account management, is clearly marked in the interface, and is the only user who can cancel the account. The Root User is subject to the following restrictions:

• Can't be deleted, disabled, force-logged out, or have its password revoked

• Can't be assigned to roles

• Is always assigned to all product environments

Having a root user ensures there is always a reliable point of authority with full access to manage and maintain the account.

Managing users

You can add users via the Console, or provision users programmatically:

• Console: Use the Invite New Users Console Option or the Invite button on the User Management page in Console Settings.
  Note

  You can add up to five users at a time via the Console. The access levels you select apply to all of those users. If you want your new users to have different permissions or levels of access, you need to complete a separate form for each level of access.
• SAML provisioning: Automatically provision users through any SAML-compliant identity provider. See SAML/SSO login.
• Provisioning API: Add and manage users programmatically at scale. See Provisioning API.

Adding new users

For each user, you can set:

• User Details: Enter the email address, first name, and last name for all the users you're adding. Each user you create will receive an email that requires confirmation to this address. This email address is also used for logging in to Cloudinary.

  Note

  If you'd like to prevent users with email addresses on your domain from signing up for separate free accounts, which would prevent you from adding them to your main account as a user, please contact support.

• Groups: Instead of assigning roles to individual users, assign those roles to user groups. Group members inherit all the global and content roles assigned to the group. Product environment access isn't inherited through groups, so you need to make sure the users are individually assigned product environment access for the roles in those product environments to take effect.

• Access Management: Assigns the user's level of access in the Console, including roles and product environment access.

  • For quick setup, select an access bundle, a predefined set of roles for a common user type, from the Access Management dropdown. A bundle includes system roles, which may be account-level roles, product environment-level roles applied across all product environments, or both.
    Tip

    To see exactly which roles the bundle you select assigns, and optionally further refine the selected roles, expand Manage access details.
  • For granular control, select Custom access from the Access Management dropdown, or expand Manage access details to select the individual roles for the users you're adding on both the account and product environment levels. Available roles can include both predefined system roles as well as custom roles (Enterprise only) that an administrator on your team built from selected permissions.
    • Account Roles: Select roles that provide access on the account level, such as provisioning users and accessing the Billing pages in the Console Settings.
    • Product Environment Roles: Select roles that provide access on the product environment level, such as defining upload behavior, setting named transformations, and granting full access to the Media Library.
      Note

      Product environments were previously referred to as sub-accounts.
      • If your account includes more than one product environment, you can assign the selected roles to All product environments, or manually select up to 30 specific environments to assign them to.
      • Assigning roles to users doesn't automatically give them access to those product environments. To ensure users can access what their roles allow, explicitly grant them access to each product environment from the User Management page of the Console Settings. For a specific user, click their Product Environments field in the table.
        

        For details, see Define access when inviting new users.

Updating users

You can update users from the User Management page in Console Settings:

• To edit a user's details: Select Edit Details from the (3-dots) option menu for the user. You can edit basic details such as email, first name, last name, and groups.
• To assign product environments: Click the entry in the user's Product Environment column. You can assign a user access to all product environments, or manually select up to 30 specific ones.
• To manage user roles: Select Assign Roles from the (3-dots) option menu for the user. See Assign global roles to existing users.

Resetting user passwords

You can initiate a password reset for an individual user to ensure account security.

To initiate a password reset, select Reset Password from the kebab menu at the end of a specific user's row in the User Management page within your Console Settings. This action:

• Immediately terminates the user's active session.
• Invalidates the old password, rendering it unusable for login. The user must set a new password to regain access.
• Triggers an email containing a link that allows the user to set a new password. Alternatively, users can initiate the password reset process themselves by clicking on the Forgot your password link on the login page.

Users undergoing a password reset are marked with a specific status in the User Management table, clearly indicating that they're in the process of changing their password. This makes it easy to identify and manage such users.

Force immediate logout

You can initiate a force logout for an individual user to ensure account security. This feature is particularly helpful when you prefer not to require a password reset, or for users logged in via Google, GitHub, or SAML, who lack passwords, making it impossible to link session termination with a password reset.

To force a user to logout, select Force Logout from the kebab menu at the end of a specific user's row in the User Management page within your Console Settings. This action terminates the user's active session within ten minutes.

Deleting users

To delete a user, select Delete from the kebab menu at the end of a specific user's row in the User Management page within your Console Settings.

When a user leaves your organization and needs to be removed from your system, certain information about them must still be retained. This includes details like the collections they created and the assets they uploaded.

To address those needs, user deletion is handled in the following ways:

• The deleted user's status is changed to Inactive. This status is permanent, and the user can't be reactivated.
• Throughout the user interface, a label indicating Inactive is displayed wherever the deleted user is mentioned.
• Deleted users no longer count against your account's user quota.
• You have the option to reuse the deleted user's email and assign it to a completely new user.
• In the Activity Reports, actions performed by a deleted user are still attributed to them.
• Collections the deleted user created, assets they uploaded or replaced, and comments they made are still attributed to them.
• In the Assets, Collections and Moderation views, it's still possible to filter content by a deleted user.

Managing additional user subscriptions

You can see the maximum number of users that you're eligible for via your base plan in the panel on the right side of your Account Settings page of the Cloudinary Console. If you need to increase your user limit, you can upgrade your plan by clicking the Change Plan button.

Alternatively, you can purchase additional user subscriptions over and above your plan's limit. If you've reached the maximum number of users allowed for your plan, a banner will appear in the User Management page within your Console Settings. Click the Change user limit link displayed in the banner. You can extend your limit by up to 20 additional user subscriptions, with no need to switch plans.

Afterwards, you can increase or decrease the number of additional user subscriptions on your account anytime.

For additional help, or to add more than 20 additional users, contact support.

Access permissions to assets via folder sharing

Share folders with users or user groups to control access to their contents, from full management to view-only. As an administrator, set up your folder structure first, then grant users access at the appropriate permission levels.

Folder roles

Folder access is controlled by folder roles, including the Viewer, Distributor, Contributor, Editor, and Manager system roles. Each role maps to a specific set of folder permissions. For details on which actions are available with each role, see Folder permissions by role.

Enterprise customers can also create custom folder roles with the specific permissions they need.

Who can share folders

Depending on the roles you assign, users may be able to re-share folders with others, extending access beyond your original assignments. Users who can share folders include users with any of the following:

• Any admin system product environment-level role (Master Admin, Admin, Tech Admin, or Media Library Admin)
• The Manager system folder role for the specific folder
• For Enterprise customers, a custom folder role with the Share with users and groups permission, or a custom role with the Share all folders global permission

How to share folders

To share one or more folders:

• Select one or multiple folders using one of the following methods:
  • For a single folder, select Share from the options drop-down next to the current folder path at the top of the Media Library.

    

    OR

    From the Folders grid, select Share from the kebab menu.

    

  • For multiple folders from the Folders grid, select the folders, then select Share from the kebab menu.

    

• Select the users and/or user groups you want to share the folder(s) with, as well as the permission level for each.

  An email notification is automatically sent to anyone you've shared with who hasn't opted out of receiving emails in the My Profile page of the Console Settings.

• Make changes using the Share dialog box:

  

To adjust or remove access levels for users who already have access:

• Do one of the following:

  • Click Access Details from the Share dialog box.
    
    
  • Click Access Details from the folder Preview Pane.
    
    

• Make changes using the Access Details dialog box:

  

Folder sharing guidelines and best practices

When planning your folder sharing strategy, consider the following:

• Sharing rights:
  • Users can share a folder only if they have share-level permissions on it: the Manager folder role, or a custom folder role that includes the Share with users and groups permission. Users with lower-level permissions can't share a folder.
  • Only users with share permissions can see which user groups a folder is shared with, and how many users are in each of those groups.

• Sharing with multiple groups: You can share a folder with multiple users and user groups at the same or at different levels.

• Permissions on subfolders:

  • When you share a folder at a certain level, that permission level cascades down to all subfolders under it.
  • You can increase the permission level for a particular user or group in a sub-folder of a folder they already have access to, but you can't decrease their permission level.
    For this reason, it's recommended to minimize folder access granted to users at high-level folders, and especially on the Home (root) folder.
  • Best practice: If you're setting up folder permissions for a new product environment where no assets are yet in production, it's recommended not to store assets directly in the Home (root) folder, and to avoid sharing the Home folder with all or most users or user groups.
  • If you don't share a folder (nor any parent of that folder) with a particular user or group at all, those users won't be able to see that folder or the contents inside it. Even when performing a search on all folders, the results include only folders where the user has at least view permissions.
    Similarly, if you don't share any folders with a particular user or user group, then those users won't have access to any assets in the Media Library.
    Exception: Users invited to a collection can view and download its assets even without access to their folders. See Collection sharing guidelines and best practices.

• Multiple user groups and permission levels: If a user belongs to multiple groups, and each of those groups has the folder shared with it at different permission levels (which are higher than the permissions they may have received individually), then the highest of those permission levels applies to the user.

Access control via collection sharing and permissions

Collections are a dynamic way to group assets regardless of folder structure, making it easy to collaborate with others inside or outside your organization. You can grant access to collections at varying permission levels.

Collection roles

Collection access is controlled by collection roles, including the Viewer, Collaborator, Distributor, and Manager system roles. Enterprise customers can also create custom collection roles from the available collection permissions.

You can assign multiple collection roles to the same user. For example, assign both Distributor (external sharing) and Manager (to remove assets, delete the collection, or download restricted assets), since neither covers all of those actions alone.

Who can create and share collections

Depending on the roles you assign, users may be able to share collections with others at equal or lower permission levels, or create collections on their own:

• Create: Requires the Collection Creator standalone global role. Users with the Media Library User system role who aren't assigned this role can't create collections.
• Share internally: Requires the Distributor or Manager role. Users can only grant permissions equal to or lower than their own.
• Share externally: Requires the Distributor role only, and lets users share collections externally via public links. Manager doesn't include external sharing.

You can assign these roles to any user via Role Management.

How to share collections

To share a collection internally, invite teammates (users or user group members) to it. Along with initially inviting teammates to collections, you can later adjust or remove access levels for users who were already invited.

Your teammates can see the collection that they've been invited to and the collection creator's name in the main Collections view, as shown in View collections available to you.

To invite teammates to collections:

1. Open the Invite Teammates dialog box:

   • From the main Collection view, right-click or click the (3-dots) options menu of a collection and select Invite.
   • From the main Collection view, select a collection and click Invite teammates in the Preview pane. (If the Preview pane is closed, click the Open Preview Pane toggle button to display it.)
   • When viewing the contents of a collection, click the Share drop-down button and select Invite.
     
     

2. Select the users and/or user groups you want to invite to your collection, as well as the permission level for each.

   An email notification is automatically sent to all the invitees who haven't opted out of receiving emails in the My Profile page of the Console Settings.

To adjust or remove access levels for users who were already invited:

1. Open the Access Details dialog box by clicking Access Details from the Invite Teammates dialog box or from the collection's Preview Pane.
2. Click the pencil edit icon next to the permissions you'd like to change and delete or switch permissions.
   
   

Collection sharing guidelines and best practices

Depending on the permissions you grant users via folder and collection roles, users may be able to take actions that affect asset access in the following ways. Be mindful of which permissions you assign.

• Viewing and downloading assets: Users that receive invites to collections can view and download assets in those collections, even if they don't have permission to access those assets via their folders.
• Inviting teammates to collections: May expose assets in the collection to other users that couldn't access those assets originally.
• Publishing the collection via a link to a generated web page: Exposes assets in the collection externally.
• Creating a collection: May expose assets in the new collection to internal users that couldn't access those assets originally, as well as to external stakeholders, if the new collection is then shared.
• Adding assets to collections: Potentially exposes assets that you might not want to expose.
  For example, if assets from a particular folder are part of a collection, and a user group or users who otherwise can't access that folder receive an invite to that collection, those users are still able to view and download (but not modify) the assets in that collection.
• Removing assets from collections and deleting collections: Assets may become unexpectedly unavailable to internal or external stakeholders.
  For example, if a user deletes a collection that's part of a Media Portal, the collection is no longer available to external stakeholders via the portal.

SAML/SSO login

Find the option to activate SAML (SSO) login in the Account Security page of the Console Settings:

SAML Login: This option enables the administrator to activate SAML (SSO) login. This can enable users in your organization to log in using the same authentication system that they use for other SSO-supported applications. If you activate this option, you can globally select whether to Enforce SAML login or to allow users to choose whether to log in either via the SSO application or via the Cloudinary Console login window. If you choose the latter ('Enforce' is disabled), then when creating new users, you can optionally select Send invitation email for that user. When selected, that user receives an email inviting them to create a Console password.