The User Groups configuration page defines the named permission groups used throughout the system. Groups are referenced by users, pages, alarms, events, Python scripts, and design objects to control who can see and interact with specific areas.
A user account may belong to multiple groups. The user receives the combined permissions of all assigned groups.
The built-in Administrators group has full access to the configuration area. All other groups have runtime-only access by default, with additional restrictions applied per page, variable, or design object as configured.
User Group Settings
Each User Groups row represents one access group. The row shows Group Name and Description directly and these values can be edited in place.
Create a new user group with the Add button in the toolbar. The Add dialog contains all group settings organized in the sections General, User Group Settings, and Active Directory, with default values already filled in. Enter at least the Group Name and press Create.
Press the Settings icon on a group row to open the User Group Settings dialog, which contains the same sections and all settings of the group, including alarm rights, session behavior, and Active Directory integration. Press Save to apply the changes.
| Setting | Description | Example | Units / Format |
|---|---|---|---|
| Group Name | Unique name for this user group. Referenced across pages, alarms, variables, and design objects. | Operators | Text |
| Description | Free text description of this group and its intended role. | Plant floor operators with read and write access | Text |
| Alarm Acknowledge Right | Allows members of this group to acknowledge individual alarms in the Alarm Viewer and with the Acknowledge button of an Alarm Banner. | true | Boolean |
| Alarm All Acknowledge Right | Allows members of this group to acknowledge all active alarms at once in the Alarm Viewer. | false | Boolean |
| Alarm Delete Right | Allows members of this group to delete historic alarm records. | false | Boolean |
| Alarm Remove Active Right | Allows members of this group to remove an individual active alarm from the active list without acknowledging it. | false | Boolean |
| Alarm Remove All Active Right | Allows members of this group to remove all active alarms from the active list at once. | false | Boolean |
| Alarm Shelve Right | Allows members of this group to shelve, extend and unshelve alarms: Shelve, Extend, Unshelve and Unshelve All in the Alarm Viewer, the Shelve button of an Alarm Banner, and the ShelveAlarms and UnshelveAlarms calls of the Runtime API and MCP. Members of the Administrators group always hold this right. The Operators group of a new installation has this right; the groups of an upgraded installation start without it until an administrator grants it. | false | Boolean |
| Event Delete Right | Allows members of this group to delete historic event records. | false | Boolean |
| User Edit Right | Allows members of this group to edit their own user account settings at runtime. | false | Boolean |
| User Delete Right | Allows members of this group to delete user accounts at runtime. | false | Boolean |
| Device Connection Control Right | Allows members of this group to restart a device from a page or from the runtime API. A restart closes the device connection, reads the device configuration again and starts the connection over. Members of the Administrators group always hold this right. | false | Boolean |
| Recipe Edit Right | Allows members of this group to add, edit, delete, move and import recipes in the Recipe Manager, to add and delete recipe parameters, to change recipe values and to take a Snapshot. Recipe types, target links and Recipe Type Parameters remain reserved for the Administrators group. Members of the Administrators group always hold this right. Groups that existed before this right was introduced keep it after an upgrade; new groups start without it. | false | Boolean |
| Recipe Load Right | Allows members of this group to Apply a recipe to a target in the Recipe Manager and to run the Transfer Recipe action. The write rights on each linked variable still apply. Members of the Administrators group always hold this right. Groups that existed before this right was introduced keep it after an upgrade; new groups start without it. | false | Boolean |
| Schedule Edit Right | Allows members of this group to add, change, enable, disable and delete schedules through a Scheduler Object on a runtime page. Only schedules whose Operator access is Edit can be changed; View schedules stay read-only. Administrators always have this right. | false | Boolean |
| Screen Note Edit Right | Allows members of this group to add Screen Notes on runtime pages with Allow Screen Notes, and to move and remove any note. Only the author of a note changes its text, Color and Remove After. Members of the Administrators group always hold this right. The Operators group of a new installation has this right; the groups of an upgraded installation start without it until an administrator grants it. Quick Trend needs no right. | false | Boolean |
| Session Timeout | Inactivity timeout after which a user in this group is automatically logged out. | 600 | Seconds |
| AD Group | Active Directory group name to map to this EnvisionSCADA user group. Members of this AD group are assigned this group automatically on login. | DOMAIN\Operators | Text |
| AD Home Page | Home page assigned to users who log in through Active Directory and are mapped to this group. | Overview | Text |
| AD Default Language | Display language applied to users who log in through Active Directory and are mapped to this group. | en-US | Text |
No rows match the filter.
Rights Matrix
Press Rights Matrix in the toolbar to review and change the rights of all user groups in one dialog. Each row is a right, grouped under Alarms, Events, Users, Audit Trail, Devices, Schedules, Recipes and Screen Notes. Each column is a user group.
Select or clear a check box to grant or revoke a right for one group. A changed cell is highlighted and the footer shows the number of pending changes. Changes are applied only when you press Save; Cancel or closing the dialog asks before discarding pending changes.
Press a group name in the column header to grant all rights to that group, or to revoke all of them when the group already holds every right. Press All next to a right to grant it to all shown groups, or to revoke it when all shown groups already hold it.
The Search field shows only the groups whose name contains the search text. All next to a right affects only the shown groups.
The Administrators group is shown with every right selected and cannot be changed in the dialog.
Save stores only the groups with changes. When a group cannot be saved, the dialog stays open, lists the group with the reason, and keeps its changes pending; the other groups are saved.
Notes
The Administrators group is reserved and always has full access to the configuration area. It cannot be renamed, modified, or deleted, and no other group can be renamed to Administrators.
Group names are case-sensitive when referenced in page, alarm, variable, and design object settings. Use consistent naming throughout the project.
Apply user groups to pages, alarms, and design objects to restrict visibility and interaction to the intended operator roles.
Active Directory integration is configured on the Parameters page. The AD Group, AD Home Page, and AD Default Language settings on a user group are only used when Active Directory authentication is enabled.