Legacy permissions reference

All Cloudinary accounts have moved to the Roles and Permissions system, except for a small number of accounts that still use the legacy permissions system. This page describes the legacy system for those accounts and for reference.

Legacy permissions vs. Roles and Permissions

This table compares the legacy system with Roles and Permissions:

Legacy roles

Each user in your Cloudinary account is assigned a role. This role defines the operations a user can perform, the areas of the Cloudinary Console that they can view or change, and the settings they can control.

Whereas Master admins have access to all product environments, users with other roles can be set to have access to all or only specified product environments. Users have the same role in all product environments they have access to.

Below are tables summarizing the permission details for each role, divided by Console areas:

• The Assets digital asset management product
• Account and product environment Console Settings

Permissions for the Assets digital asset management product

Additional Assets role considerations and guidelines

• If you don't add a Media Library user to any groups or share any folders with those groups or directly with that user, the user won't see any content in the Media Library.
• The Media Library user role replaces the obsolete Contributor and Viewer roles. For users with these roles, Cloudinary made the following adjustments to keep their access permissions unchanged:
  • Users in either of these roles were automatically migrated to the Media Library user role.
  • Viewer and Contributor user groups were automatically created, and these users are included in the relevant group.
    
  • These two user groups have permissions to the Home folder at the corresponding level (Can view or Can contribute).

Permissions for Console Settings

Managing users in the legacy system

In the legacy system, users with the Master admin or Admin role can configure settings for all account users, including adding, modifying, or removing users.

Adding users

You can add up to five users at a time by either:

• Using the Invite New Users Console option
• Clicking the Invite button on the User Management page of the Console Settings

For each user, you can set:

• E-mail: The new user receives an email asking them to confirm this address, which they also use to log in to Cloudinary.
• Role: The user's level of access in the Console. For details, see Legacy roles.
• Product environment access: If your account includes more than one product environment, choose which product environments the users can access: all of them, or up to 30 specific ones.
  • A user has the same role, and the same permissions, in every product environment they can access.
  • This option isn't displayed if all the users you're adding are Master admins, because Master admins always have full control in all product environments.

The role and product environment access you set apply to all the users you add in the same form. To give users different roles or access, complete a separate form for each.

You can also add users in these ways:

• SAML provisioning: Use the legacy role values in the User.CloudinaryRole attribute. See SAML assertion fields.
• Provisioning API: Add and manage users programmatically. See Provisioning API.

Additional options for users with the Media Library user role

• User groups: Assign the new user to one or more groups to inherit their folder and collection access permissions. In the legacy system, groups can only be used to manage folder and collection access for users with the Media Library user role. You can assign a group one of several permission levels for each folder and collection, rather than configuring access for each Media Library user individually.

• User permissions: Displayed as toggles when adding users with the Media Library user role. These apply to all new Media Library users you're adding:
  • Create collection: Enables a Media Library user to create non-dynamic collections.
  • Share collection: Enables a Media Library user with Owner, Can share, or Can manage permissions on a non-dynamic collection to share that collection both internally and externally.
    Note

    Without these permissions, a Media Library user can still view or contribute to collections shared with them, but they can't create collections or share collections with others, even if they're assigned Owner level permissions for a collection.

    These permissions allow Media Library users to create and share only non-dynamic collections to help protect against unintended asset exposure.

  • Show delivery URL: Allows a Media Library user with Can edit or Can manage folder permissions to edit the asset's public ID. It also sets the main action on the card to Copy Delivery URL, which users can change individually.
    Note

    Depending on your setup, the Show delivery URL permission might not be available in your product environment. If it's not, Media Library users can edit the public ID with only Can edit or Can manage permissions on the folder. To add this permission and control public ID editing, contact support.
  • Moderate asset: Enables the Media Library user to moderate assets in any folder that they have Can edit or Can manage permissions to.
    Note

    To enable Media Library users to access the moderation queue, contact support.
  • Create proof: Enables Media Library users to start a new proof and manage proofs they created. This permission is available only for Enterprise plans with the creative approval premium feature enabled. For more information, see Manage Creative Approval proofs.

Updating users

The Edit form on the User Management page lets you update a user's details, role, and permissions in one place. If a user is a Master admin, the Product Environment value is All (full access) and can't be changed without first changing the user's role.

Other user management tasks, such as deleting users, resetting passwords, and managing additional user subscriptions, work the same way in both permissions systems. See Users and groups.

Legacy folder permission levels

Folder permission levels apply to users with the Media Library user role and to the groups they belong to. Admin roles have full access to all folders.

When you share a folder in the legacy system, you can set one of the following permission levels, which apply to the folder and all its subfolders: Can view, Can contribute, Can edit, and Can manage.

Users with any admin role, or users with the Media Library user role and Can manage permissions on the folder, can share the folder with others.

The table below summarizes the actions available at each legacy folder permission level.

Legacy collection permission levels

Collection permission levels apply to users with the Media Library user role and to the groups they belong to. Admin roles have full access to all collections.

When you invite teammates to a collection in the legacy system, you can set one of the following permission levels: Can view, Can share, Can collaborate, and Can manage.

You control what these users can do with collections by assigning specific user permissions:

• Create: Requires the Create collection permission.
• Invite teammates and publish: Requires the Share collection permission, and the user must be the collection creator or have Can manage permissions on the collection.

The Create collection and Share collection permissions act as overrides. Without them, a Media Library user can't create collections or share them with others, even with Can manage permissions on a collection. With them, users with Can share or Can manage permissions can share collections both internally and externally.

The table below summarizes the permissions available to each level: