23 Jun 2022

Manage group permissions in Collaborate

Topics Managing users, permissions and security, 2022-Q2

Product Filter HighQ Collaborate

Product Area Filter Admin, Permissions, Files

This article assumes that you have created and named the groups required by your organisation.

To edit a group, either click the name of the group within the Groups screen, or navigate to the More actions button for the group you want to edit. Refer to Manage site groups in Collaborate for more information.

Changing a group's permissions

To view and change a group's permissions, navigate to More actions > Set group permissions:

The Set group permissions - screen is displayed:

Here, each module is displayed and the permissions granted for each module. The Files module is set to View as default, but the others will not be set.

If any Digital Rights Management options have been enabled for the site you are in, then two additional columns will be displayed in the Files section of the table (Disable print and Watermark). This allows DRM features to be enabled or disabled for any folder or file listed.

The Set group permissions - screen is split into two tabs, Modules and Files. The Modules tab is shown above. Here, you can give View and/or Edit permissions for most of the modules. The Files tab is shown below:

This tab shows the permissions for the File content that applies to the selected security group. These available columns are as follows:

Inherit - This determines if a folder inherits the permissions of its parent folder
Folder Permissions (these are only applicable to folders, not files):
- View - This determines whether or not that a folder can be viewed. This permission level is necessary for a group to gain access to any of the content within the specific folder or any of its subfolders. Without the view folder permissions, no other permissions can be granted on the folder. By itself, view folder permissions do not allow a group to view any of the files in that folder
- Add Files - This determines whether or not that the user can add files to the folder, as well as whether they can edit file metadata or add a new version, regardless of who uploaded those files. If a group has the add files permissions, they can also view files in that folder
- Admin - This includes all of the permissions attributed to add files, along with the ability to sort and bulk upload files and folders
File Permissions:
- View - This determines whether you can view and download files within a folder, but not make any metadata changes or add new versions
- Disable print - This column is only displayed if DRM options are applied. By default, when DRM options are applied, users with less than add files permissions can no longer download the native files. (With the PDF/FileOpen DRM option, only the encrypted PDF version of the file can be downloaded.) By disabling printing, users with less than add files permissions will also no longer be able to print a file. Additionally, the Printing disabled watermark will be added to every page of the file
- Disable Save - This column is only displayed if DRM options are applied. By disabling saving, users with less than add files permissions will no longer be able to save a file. However, this checkbox can be deselected in order to permit a certain group of users to download the native version of all of the files in a given folder or just specific files, if file-level security has been enabled.

The Disable Save option must be enabled at the system level in order for this to be displayed.

Please contact your account manager to have this feature enabled.

Watermarks - This column is only displayed if DRM options are applied. By enabling watermarks, the email address and IP address of the viewing user will be added to each file. Both the Disable Print and Watermarks settings require that the view files setting is also applied, but it is possible to use any combination of these settings:
- Enable printing and do not apply watermarks (files can be printed without watermarks);
- Disable printing and do not apply watermarks (files can be viewed but not printed, without watermarks);
- Apply watermarks and enable printing (files can be printed with watermarks); or
- Apply watermarks and disable printing (files can be viewed by not printed, and watermarks will be shown)

The precise permissions and actions available to each type of folder and file permissions are provided in the Matrix of File and Folder Rights (this will download an Excel file).

The key concepts applicable to this page:

Inheritance - For each folder, there is a flag that indicates whether the folder inherits the permissions of its parent folder (a grey folder) or not (a yellow folder). If the checkbox is selected for a subfolder, then any changes made to the permissions of the parent folder will flow down to the subfolder (and any of its subfolders and files) automatically. For example, if a subfolder inherits security and Add Files permissions are removed from the parent folder, this change will be applied to the subfolder and all of its subfolders and files, unless one of those subfolders has broken inheritance. Also, for any object that inherits permissions, the checkboxes under each permission setting (such as Add Files) will be greyed out, as they cannot be changed unless inheritance is disabled
Breaking Inheritance - Once inheritance has been disabled, a subfolder can have different permissions from its parent folder. Permissions at the subfolder level can be more restrictive than the parent. For example, Group A can add files to the parent folder but only view files in the subfolder.

Permissions can be less restrictive as well. For example, if the parent folder does provide Group B with folder admin permissions, these permissions can be granted to Group B within the subfolder. This way, a group that cannot access files in a parent folder can be given access to those files in a subfolder

Changing Inheritance - Inheritance can be toggled on or off for a folder using the checkbox in the Inherit column. The important thing to understand about inheritance is that it applies to all groups. Either a subfolder does or does not inherit the permissions of its parent folder. If it does, then inheritance applies to all groups and for a given group, they will have the same permissions for all subfolders and files. If inheritance does not apply, then different permissions can be given to different folders for the same group. Accordingly, if inheritance has been disabled on a folder and there is an attempt to reenable inheritance, the following message will be displayed: This action will inherit the folder permissions for this group as well as other groups that have access to this folder. Are you sure you would like to continue with this operation? This warning appears because once inheritance is reenabled, any unique permissions that may have been provided to a group for any subfolders or files will be reverted, which will impact all groups. On the other hand, disabling inheritance does not lead to such a warning, because there is no immediate change in the permissions on any subfolders or files

Once changes have been made, click Save to save your changes.

Any changes that are made will take effect immediately.

Exporting a group's file permissions

You can export a copy of every group's current File permissions to Excel. Click Permission report within the Groups screen:

The Group permissions report screen will be displayed:

Please wait for the report to be generated. Once the report has been generated, the screen will look like this:

Click either Click here to download or Download to download your report.

The report will look similar to the image below, but please note that the sample data is small compared to what most reports will look like:

Copying a group's file permissions

There are situations where it can be useful to give one group the same file permissions as another. For example, if an existing group is being split in two, both groups should have the same permissions to start but over time they will diverge. To do this click More actions for the group whose permissions you want to copy and click Copy group permissions to:

The Copy permission to screen will be displayed:

Which lists all groups you can copy to, the group type and the number of users.

After selecting the group to copy to, click Copy. The group will now be copied.

A few caveats about this feature:

If the group that will receive new permissions already has its own, unique file permissions, those permissions will be overwritten

This is a one time copy. Any changes made in the future to the permissions of the source group will not apply to the permissions of the receiving group. The permissions of the two groups will be unlinked going forward

This change does not apply to the permission settings of non File modules, as the security settings on those modules are typically much less complex

Multiple groups and permissions

If a user is a member of multiple groups, with different permissions, permissions are aggregated - the user is granted the highest level of access defined for each item.

Restrictions (e.g. 'Disable print') are always applied unless the user is granted admin access that negates the restrictions.

In the example below, members of the 'normal users' groups may view folders and files, but may not add files or print. If they are also a member of the 'All' group, then they are granted Admin and 'Add files' rights; the 'Disable print' restriction from 'normal users' is removed, as this is not applicable to users with admin rights (note that the selection boxes are greyed-out).

As of 5.7, we have introduced a more granular file permissioning, allowing for our users to be a lot more strict with which users get which specific permissions when uploading and downloading documents.

These new changes are as follows:

The Add File permission is split into Upload File, Update File and Delete File
Upload File means that a user can upload a new file once but cannot edit or add version after that
Update File means that a user can add a version to file, edit that file (including its metadata), but can't change the files permissions
Delete File means that a user can delete this file, but can't change the permission of the file
Disable Save will be now independent of DRM. Meaning, regardless of whether DRM is ON or OFF, this option will be available to the user

File module capabilities such as Collaborative editing using Office Online and eSignature etc. that create a new version of a document are only available for a user that have the Update file permission and above.

These changes will be visible in the following places: