User Management

Any individual that needs to interact directly or indirectly with your Issuetrak system is a User. Users that can log into your Issuetrak site may interact directly. Users that cannot log in may interact indirectly through other users and/or email. Every user must be given an Agent or End User designation from a dropdown. Any user granted an Agent designation can then be granted any of the Agent specific permissions.

---

 

Terminology

It’s best to be familiar with several terms going forward:

Term	Definition
User Record	Used to associate who reported, who worked on, and who can view an issue. Each User Record has a record type, a user type, and permissions defining what that user can do.
Record Type: User	A user record that can have a role on an issue, view issues in searches and reports, be the site administrator, log in to the site, or send emails that create issues.
Record Type: Template	A user record used when creating another user account to pass setup information, permissions, and group membership. Templates can’t have a role on an issue or log into the site.
User Type: End User	A user in Issuetrak with no agent-level permissions.
User Type: Agent	A user able to be granted agent-level permissions including one or more of the following: can assign or be assigned issues, can assign or be assigned Next Action, can submit on behalf of another user, or handle the administration of the site. The number of users that can be designated as agents is controlled by your software license.
User ID	A unique identifier used to log into the Issuetrak site. Can contain letters and numbers, but no spaces. Only able to be changed using the User ID Maintenance section of the Administration menu by another user with administrative permissions.
Group	Allows you to associate users together. Members of a group inherit the permissions granted to the group.

---

 

Creating Users

Users can be automatically added through authentication and Identity Management as well as incoming email messages using Incoming Email (IEM), or the optional Self-Registration feature.

Each of the above methods requires the use of templates to set the default permissions and group membership for the users. Templates are also utilized when agents need to create new users when submitting issues on behalf of a user that doesn’t yet exist on the site.

Users can also be manually added from:

• Click the Settings lightbox (gear) icon in the upper right > click on Users beneath Entities > click on Add on the right context menu.
• Click the Settings lightbox (gear) icon in the upper right > click on Users beneath Entities > click on Clone By ID on the right context menu.
• Submit New Issue screen
• API

Users may also be created through a user import process. This is done with the assistance of the Support team and may have a fee involved. For more information, please see our information about Data Services.

---

Click here to see more of our training videos.

The table below shows an overview of the information contained in User Records:

Section	Description
Basic Information	End-User or Agent designation, user ID, password, name, email, phone, address, and time zone
Security Details	Authentication Type (on the Edit User screen), Password Satus, Last Login, "Manage Multi-factor Authentication" button, "Close User's Sessions" button
Extended details	Authentication Type (on the View User Details screen), Phone Number, Email Address, (Physical) Address, Organization, Department, Location, Time Zone, Information stored in User Defined Fields
Attachments	Documents or images in any electronic file format
Permissions	What the user can see or do when using Issuetrak
Memberships	Any larger entities the user belongs to

All user records include a view issues link to a list of all issues submitted by and on behalf of the user. If Record all login attempts setting is activated in Defaults, they also include a history link to all login attempts by the user. If using the Asset Management (AM) Module, they also include a view assets link to a list of all assets related to the user.

---

Using Add option

The most common is by adding them through the Settings Lightbox. In this method, you can grant permissions directly to that specific user. Once created you can add the user to a group to more effectively manage permissions.

To add a new user with no pre-existing details or permissions:

1. Click the Settings lightbox(gear) icon in the upper right > click on Users beneath Entities > click on Add on the right context menu.

2. Select User as the Record Type.

3. Choose the appropriate User Type. If you have a Team license, then this step doesn't apply since the field will not be visible.

4. Enter the new User ID. The password can be set later if desired.

5. (Required) Enter their First and Last Names. The Display Name will automatically populate. However, you may enter a different display name if you choose.

6. If this user is allowed to log in, select Can Log In.

7. Under the "Security Details" header: Select the Authentication Type this user should have. Authentication types other than "Issuetrak" require additional configuration.

8. Under the "Extended Details" header: Enter their Phone number, Email address, and Mobile/SMS Email address.

9. If no system-generated email notifications should be sent to this user, select Suppress All Email.

10. Select the appropriate Organization memberships by clicking Select Organization(s) (this field is required). Keep in mind the following:

    1. You must select a primary organization for this user (designated by a "Star" icon). This organization will determine a large degree of information visibility for the user.

    2. If desired, you can add organization memberships beyond the primary organization. You can find organizations by typing part of their name into the "Search & Filter..." field.
       
       If an organization's name contains the sequence of characters you entered, it will appear in the "Available Organizations" column.
       
       For each organization membership you add can optionally add "Edit Issues" for this user (subject to "Can Edit Issues" permission), designated by the "Pencil" icon. Additionally, toggling the "People" icon on an organization membership will allow this user to have the ability to list users belonging to this organization.
       
       You can add organization memberships...

       1. By clicking Add Visible, which will add every organization currently displayed in the "Available Organizations" column (up to its 100 organization limit) to the "Organization Memberships" column.

          • If there are more than 100 organizations in the site, the next available batch of previously-undisplayed organizations will populate the "Available Organizations" column. You can keep clicking Add Visible until all organizations have been added to the "Organization Memberships" column, if you wish.

       2. By clicking and dragging the available organizations to the Organization Memberships column.

11. Select the appropriate Department and Location memberships, if applicable.

12. (Required) Select their TimeZone.

13. Enter their mailing Address.

14. Enter/Select any user-defined details, if applicable.

15. Under the "User Permissions" header: Select any Menu Options/Pages Allowed to display for these users.

16. Select the Default Home Page to display.

17. Select Redirect To screen to be displayed immediately after submitting an issue. This value defaults to a new submit screen. Choose between Submit screen, Issue View (displaying the newly entered issue), Dashboard, or Issue Hub screen.

17. If the user type selected was Agent, select Agent (license-related) Permissions.

    • An Agent license must be available for each user created from this template to have any of these permissions.

18. Select any administration-related permissions.

19. Select any data access-related permissions.

20. Select any task-related permissions.

21. Select any issue maintenance-related permissions.

22. Select any reporting-related permissions.

23. Select any email-related permissions.

24. Click Save.

    • Clicking Reset will clear all current entries and selections.

A confirmation message will appear when this process is complete.

---

Using Clone Option

Cloning an existing user brings over common information like organization, permissions, and group memberships.

When users are cloned, their permissions and details can be changed before their records are saved. However, no changes to the original user or user template will be applied to records already created from them.

The following field information is cloned:

To add a new user by copying details and permissions from an existing user or user template:

1. Click the Settings lightbox(gear) icon in the upper right > click on Users beneath Entities > click on Clone By ID on the right context menu.
2. Enter the User ID of the existing user or template to copy and click Clone. (Clicking Reset will clear any current entry.) This will open the Add User screen with the details and permissions that have been copied.

1. From the View or Edit User screen of the existing user or template record to copy > View User Details > Clone beneath Edit User - <User ID> section on the right context menu.
2. This will open the Add User screen with the details and permissions that have been copied.
3. Verify that the User is selected as the User Type and enter the new user’s ID and password.
   
   If you have a Team license, then the User Type field will not be visible.

3. Enter the user's first and last name (required). Their display name will automatically populate. However, you may enter a different display name if you choose.

4. Modify any appropriate details and/or permissions copied from the original record.

5. Click Save.

   • Clicking Reset will clear all current entries and selections.

A confirmation message will appear when this process is complete.

---

Using the Submit Issue Screen

To add a new user using the Submit Issue screen:

1. Click the add link next to the Caller field. This will open the Add New Caller window.

2. Enter the new user's ID.

3. If name values were entered prior to clicking add, these values will be pre-filled when the window opens. If no value appears, enter their first and last name (required). Their display name will automatically populate. However, you may enter a different display name if you choose.

4. Enter/Select their Organization (required), Department, and Location memberships. The Organization may be prefilled for you if entered prior to clicking add.

5. Enter their phone number, email address, and mailing address.

6. Click Add New Caller. (Clicking Cancel will close the Add New Caller window.)

The message "The User ID of the caller is entered onto the Submit Issue page – This window will close in 5 seconds" will then appear in the Add New Caller window. This window will then close and you will be returned to the Submit Issue screen.

---

 

Managing Users

Users are maintained primarily from the Settings Lightbox menu. The Users Management menu includes Summary, List All, Clone By ID, Search, User Defined Fields, and User ID Maintenance sub-menu options. Users with Sys Admin, Can access and maintain Administration functions, or Allowed Read Only access to Administration information permissions may access these options, however, those with read-only access will not be able to add, edit or delete information.

Menu Option	Description
Summary	From here, you may click on the number next to a specific summary item to open the item’s User Summary List. You may click on a column heading to sort the User Summary List by a column’s values. You may click on a user ID to view the user’s record. You may use the edit or del links next to a user ID to edit or delete the user.
List all	This menu option displays a list of all existing users and user templates available. From here, you may select a Search On option, enter a search value, and click Search to filter/search the list. The list will re-populate with users/templates matching the criteria. You may use the previous and next buttons to page through the list. You may click on a column heading to sort the list by the column’s values. You may click on a user ID to view the user’s record. You may use the edit or del links next to a user ID to edit or delete the user.
Clone By ID	This menu option will open the Clone User screen. User records may also be cloned directly from the View or Edit User screens as mentioned above.
Search	This menu option allows you to perform detailed user searches. User search output options include: Brief List, Count Only, Detail to Excel, and Email to User List. Brief List will display the search results in a format similar to the List All Users screen – where user records may be viewed, edited, and/or deleted. Count Only will display only the total number of users in the search results. Detail to Excel will export the search results to Excel. Email to User List will open a screen where you can compose and send an email message to users with an email address in their record based on the search results. If using the Surveys Module, your output options will also include the Email Survey Invitations User List. This option will open a screen where you can compose and send an email message that includes a survey invitation to users with an email address in their record based on the search results.
User Defined Fields	If using one or more list user-defined fields in your user records, you can access these settings by performing the following steps: Click the gear icon in the upper right. Click on Users beneath Entities. Click on Settings beneath User Defined Fields section on the right context menu. This is where the drop-down values for these fields are maintained. Within the User Defined Fields sub-menu, select the option that corresponds to a field’s label to maintain its values. This will open the List screen. From here, you may select the Add option that appears below the field’s sub-menu option to add a new value to the field. You may use the edit or delete links next to an existing value to edit or delete the value.
Maintenance	This menu option offers two utilities that allow you to Merge Duplicate Users and Change User's User ID.

Existing user records can be manually edited to adjust contact details or individual permissions from

1. Settings Lightbox(gear) icon > Users beneath Entities.
2. If you need to add permissions to multiple users, you can create a Group to grant them. If you need to remove permissions from all users in a group, simply remove the permission from the group itself.

If you’re using the Identity Management module, then any changes to contact details must be done within your identity provider. Permissions must be changed either on the template used to do the import and update or on the groups that the user belongs to.

Deleting users is not recommended. When a user is deleted, any references are eliminated, causing missing data and errors on issues. This can also cause corruption in your database, and stop issues from reporting properly. If a user no longer needs access to your site or needs removal, the user record should be edited, and the “active” checkbox disabled.

---

Using Settings Lightbox > Users

To edit an existing user or user template using the Settings Lightbox and subsequently the right context menu:

1. Click the gear icon in the upper right > click on Users beneath Entities > click on List on the right context menu.
2. Perform a Quick Search for the record by selecting a Search Users List option, entering a search value, and clicking Search. The list will re-populate with users/templates matching the criteria.
3. Click the Edit link next to the user ID. The Edit User screen will then appear.

1. Click the gear icon in the upper right > click on Users beneath Entities > click on Search beneath User Search section on the right context menu.
2. Perform an advanced search for the record by entering criteria, selecting the Output Option of Brief List, and clicking Search. The Users Search Result screen will then appear.
3. Click the Edit link next to the user ID. The Edit User screen will then appear.

1. From the View User screen, select the Edit sub-menu option on the right context menu.
2. To deactivate, unselect Active.
3. To add or remove login permissions, select/unselect Can Log In.
4. To grant full access to all System menu options, select Sys Admin.
5. To add attachments, use the Attachments sub-menu option.
6. Modify any other appropriate details and/or permissions.
7. Click Update.
   • Clicking Reset will return all entries to the values defined during the most recent save/update.

You will then be returned to the View User screen and the message User successfully updated will appear.

---

Using issue-related screens

To edit an existing user using issue-related screens:

1. Click on the user's name from any of the following screens:
   • View Issue
   • Add Note
   • Assign Issue
   • Next Action
   • Close Issue screen
2. A popup window will then open with the user’s details. Click Edit User in the lower right. The Edit User screen will then appear.
3. Modify the appropriate details and/or permissions.
4. Click Update.
   • Clicking Reset will return all entries to the values defined during the most recent save/update.

You will then be returned to the View Issue screen and the message User successfully updated will appear.

---

User ID Maintenance

The User ID field is protected during routine user record edits as it is used by many other records throughout the system. This utility offers two options that allow you to update a User ID.

If a user has been duplicated and you would like to merge two records with different User IDs into one record,

1. Click on the Merge Duplicate option beneath the Maintenance section on the right context menu.
2. Enter the User ID for the user you wish to keep as the primary user. This User ID will be used to replace all occurrences of the secondary User ID, effectively transferring all of their records to the primary User. While all records such as issue submissions and assignments will be transferred to the primary user, the user records themselves will not be modified.
3. If you wish to delete the secondary user record after the transfer, check the Delete after Processing option.
4. Click the Merge button.

The Change User’s ID option is more likely to be used if an employee has a name change or if the User ID was entered incorrectly. In this case, all records containing the old value will be updated to the new User ID value. The user record is then updated with the new User ID value.

---

User Memberships

What a user can see and do can be influenced by their Memberships within larger entities. You can add a user to a number of other entities, including:

Entity	Description
Organization	A primary organizational unit (companies, subsidiaries, etc.)
Department	The functional unit (accounting, administration, marketing, IT, etc.)
Location	Physical/geographic unit (cities, sites, buildings, offices, rooms, etc.)
Group(s)	Role-based unit (end users, managers, technicians, etc.)

These entities structure the user base to provide the overall framework for capturing and reporting information related to users and issues within your system.

Using entities to influence a user’s experience is also optional. For example, users that belong to a certain organization may see a different Site Title and Site Colors. Users that belong to a certain department may see only issues submitted by or assigned to other members of their department. Users that belong to a certain group may see additional Issue Templates, Issue Types, and Tasks that cannot be seen by other users.

The table below shows the field and object filters that can be controlled at the entity level.

You can define user access to specific...	Based on Organization	Based on Department	Based on Location	Based on Group
Issue Types & Subtypes	✔	✖	✖	✔
Issue Templates	✔	✖	✖	✔
Tasks	✔	✖	✖	✔
Assets	✔	✖	✖	✖
Users	✔	✖	✖	✖
Issues	✔	✔	✖	✖
Global Issues	✔	✖	✖	✖
Knowledge Base Articles	✔	✖	✖	✔
Projects	✔	✖	✖	✖
Site Title and Logos	✔	✖	✖	✖
Site Colors	✔	✖	✖	✖

---

Notes on User Authentication

Third Party Authentication

Users that authenticate to Issuetrak via a third-party identification provider (AD Federation Services, Azure AD, OAuth 2.0 / OpenID Connect) will have some extra fields displayed when viewing their account in Issuetrak:

• Domain:  This is the domain they are authenticated to.
   
• Authentication User ID:  This is the key identifier (such as email or SID) used by the identification provider to uniquely identify this user.

---

Multi-factor Authentication (MFA)

MFA has its own article to inform and show you what's involved with configuring it.

---

Closing Thoughts

If you have any questions or would like the assistance of our product experts, please do not hesitate to contact us with any questions.

A Group can be defined as a set of multiple users that all need to interact with your Issuetrak system in the same way. Groups allow you to establish and control role-based Permissions collectively without manually granting individual users the same permissions over and over.

---

 

Terminology

It’s best to be familiar with several terms going forward:

Term	Definition
Group	Allows you to associate users together. Members of a group inherit the permissions granted to the group.
Group Membership Type: Any	Any user record may belong to this group. This group cannot be granted any agent-level permissions.
Group Membership Type: Agent	Only users with the type of Agent can belong to this group. This group can be granted agent-level permissions.
Group ID	A unique identifier for your group. Can contain letters and numbers, but no spaces. It’s recommended to include the term “group” or “team” within the ID for it to remain clear when selecting or searching. The Group ID cannot be changed without the assistance of the Support Team.

---

 

Purposes of Groups

Groups have four main purposes that are all related to linking users together. Users can be associated with one or more groups. The users within a group inherit the permissions from that group. If a user belongs to several groups, then the user receives the permissions from all of the groups. While groups are not required, they can be a powerful tool.

The use of Groups is optional. However, controlling common permission sets at the group level instead of the user level makes user administration easier and more consistent. In addition, Group Restrictions allow you to control access to specific Issue Templates, Issue Types, Tasks, Knowledge Base articles, and other values based on group membership(s). We strongly recommend using groups whenever possible.

Example:

Create a Managers group with permissions to run reports, view all issues and administrative information, as well as assign issues and tasks.

Create a Technicians and CSRs group with permissions to view and submit issues for other users, create and maintain Knowledge Base articles, as well as be assigned issues and tasks.

Create a Customers group with permissions to only view and submit their own issues and access your Knowledge Base.

When working with your site, think about what your users need to do within Issuetrak. Do they need different permission levels? Do you need to assign issues or tasks to more than a single person? Do you need to notify specific users when certain things happen? Do certain Knowledge Base articles, issue types, or Issue Templates need to be restricted? These questions help you decide what groups to create and which users should belong to each group.

---

Role-Based Groups

Some users have a specific purpose in the site or require a certain set of permissions. Every site normally has an End User group for users that may only need to login, submit, and view their own issues. You may have managers that need to view all issues, access the Dashboard, or run reports. You might create a group to grant agent-level permissions to all your agents. It’s important to include only the necessary permissions, keeping the permissions for each group to a minimum. Users can be associated with multiple groups. Additional permissions can be granted by adding the user to more granular groups. This can cover the different roles that each user needs to play on your site.

---

Assignment-Based Groups

The purpose of these is to assign an issue or task to more than one user. For example, if you have six people in your customer service department, you could create a customer service group with all six people as members. When an issue is assigned to your customer service group, all members of the group are notified and responsible. You may have agents with multiple areas of responsibility. In that case, you can use groups to create queues used for automatic assignment and reporting. We recommend using the word “group” or “team” in your group names. This makes it easier to differentiate between users and groups when assigning issues, in searches, or in dropdown lists.

---

Email Distribution Groups

These are for creating Issue Subscribers on your site. As an example, let's say that you need to set up workflow or issue notifications to go to a number of managers. Rather than add each one individually, create a group to add them all at once. This is especially helpful in times of staff turnover, or position changes. Instead of needing to update every notification list, you can simply update the group.

---

Restriction Groups

The purpose of these is to set “restrict to” values on issue types, subtypes, and Issue Templates when submitting issues. These groups effectively limit which values a user may select when submitting or maintaining issues. This does not impact the overall visibility of the issue. A group can also be used to restrict knowledge Base articles and categories. It’s also important to remember that these are "restrict to" values, not "restrict from" values. "Restrict to" means that if you’re a member of the group, you can see the item or value.

---

 

Group Permissions

Users can inherit all of their permissions through group membership(s). Or, inherit additional permissions to those already applied through a template or selected in their user records.

As users are added to a group, their inherited permissions will appear in a read-only format on their user records. These permissions cannot be changed without changing the entire group’s permissions or removing the user from the group.

Permission options on group records are almost identical to those on user records. However, there are additional properties that must be considered.

A group cannot log in or submit issues as if they were an individual user. But a group can:

Permission	Description
Be assigned issues	The individual group members may be assigned issues if they have Can be assigned issues permission.
Be assigned Next Actions	The individual group members may then be assigned Next Actions; if they have Can be assigned Next Action permission.
Be assigned Tasks	The individual group members may also then be assigned Tasks; if they have Can be assigned Tasks permission.
Be added to Subscribers	The individual group members will then be sent notifications to the email address in their user record. Notifications will also be sent to the address in the group record if one has been defined.
Be added as Project members	The individual group members will then be included in the project.

Groups are not valid for the assignment of Issues, Next Action, or Tasks without having active members added.

---

 

Group Restrictions

You may allow members of certain groups (or organizations) to view and select additional values not available to other users through Group Restrictions. This includes:

• KB Articles

• KB Categories

• Issue Types

• Issue SubTypes 1-4

• Tasks

• Task Groups

• Issue Templates

Some examples of restrictions in practice are:

Restricting the Issue Template New Hire to your Manager Group. Then no employee other than a member of management can view and select it on issues.

Restricting the subtype Server to your IT Group. Then no employee other than a member of IT can view and select it on issues.

Restricting the Task Group QA Analysis to your Development Group. Then no employee other than a member of development can view and select it on issues.

---

 

Maintaining Groups

In order for a group to work, it must contain at least one active user. Users can only be added to a group from the Edit Group screen. Groups can be added and edited by any user with the Sys Admin parameter or Can access and maintain Administration functions permission.

---

Adding a Group

Steps:

1. Click the gear icon in the upper right > click on Groups beneath Entities > click on Add beneath Groups on the right context menu. The Add Group screen will then appear.

2. Select the Membership Type.

3. Enter a Group ID. It cannot be modified once a record is saved. If no group ID is entered, a numeric group ID will be assigned by the system.

4. Enter a Display Name(required).

5. (Optional) Fill in the phone, email, and SMS email values. These are for informational purposes only and have no bearing on email notifications.

   • If no system-generated email notifications should be sent to any member of this group, select Suppress All Email.

6. Select a default Organization (required).

   • If the organization selected is marked as Internal Only, then only issues, users, and other groups within this organization will be available to members on issues and in reporting mechanisms. If this group has members outside of this Internal Only organization, then these users will be allowed to see issues pertaining to this group only.

7. (Optional) Select a Department value for the group.

   • Any assignments made to the group will show up in reporting for the department selected. If the department selected is marked Internal Only, then only issues, users, and other groups within this department will be available to members on issues and in reports. If this group has members outside of this Internal Only department, then these users will be allowed to see issues pertaining to this group only.

8. (Optional) Select Round Robin Assignments, if desired.

9. Select any Menu Options/Pages Allowed to display to all members of this group.

10. Select any permissions that all members of this group are to inherit.

    • A license must be available for each member to have any Agent permissions.

11. Click Save.

    • Clicking Reset will instead clear all current entries and selections.

A confirmation message will appear when this process is complete.

---

Editing a Group

Steps:

1. Click the gear icon in the upper right > click on Groups beneath Entities. This will open the Group List screen.

2. Perform a Quick Search for the record.

Once you're on the Edit Group screen, you can perform the following changes as needed:

1. To deactivate, unselect Active.

2. To add or remove members, use the View/Maintain Member List link.

3. Modify any other appropriate details and/or permissions.

4. Click Update.

   • Clicking Reset will instead return all entries to the values defined during the most recent save/update.

You will then be returned to the Group List screen and the message "Group successfully updated" will appear.

---

Group ID Maintenance

The Group ID field is protected during routine group record edits as it is used by many other records throughout the system. This utility offers two options that allow you to update a Group ID.

If a group has been duplicated and you would like to merge two records with different Group IDs into one record:

1. Click on the Merge Duplicate Groups beneath the Maintenance section option on the right context menu.

2. Enter the Group ID for the group you wish to keep as the primary group. This Group ID will be used to replace all occurrences of the secondary Group ID, effectively transferring all of their records to the primary Group. While all records such as issue submissions and assignments will be transferred to the primary group, the group records themselves will not be modified.

3. If you wish to delete the secondary group record after the transfer, check the Delete after Processing option.

4. Click the Merge button.

The Change Group’s ID option is most likely to be used when the Group ID was entered incorrectly. In this case, all records containing the old value will be updated to the new Group ID value. The group record is then updated with the new Group ID value.

---

Click here to see a complete list of our training videos.

Permissions control what users can do or access within Issuetrak. With over 50 permissions available, it can be challenging to understand what separate permissions do and how to best manage them. These guidelines are meant to assist you in managing the permissions for your user accounts.

---

 

User Type

Every user must be designated as either an Agent or an End User. This determines what permissions your users have access to. Certain permissions require a user to be an agent, while others can be granted to either agents or end-users.

---

 

Permissions, Parameters and Access Rules

Permissions, parameters, and access rules may control what a user is able to access in Issuetrak.

• Permissions – Control what each user can do within Issuetrak.
• Parameters – Determine whether the user is active, can log into the site, and whether the user is a System Administrator (Sys Admin).
• Visibility Rules – Establish which issues and users can be seen on the site. 

Permissions can be:

• Applied from a default User Template based on how the record is created.

• Copied from an existing user or user template through Cloning.

• Inherited through one or more Groups.

• Selected directly on a user record.

---

 

The following users can manage permissions

 

• System Administrators – a designated agent user with the parameter “Sys Admin” is granted almost all permissions by default. A System Administrator has unlimited access to every area of the site and can change system-wide settings. No restrictions set within the site apply to the System Administrator.

• Admin/Administrator users – a designated agent user with the permission “Can Access and maintain Administration Functions”. These users have the same default permissions as System Administrators except they are not allowed access to the “System Settings” portion of the Administration menu. This prevents them from making changes that enable or disable features and functionality within the site. As with System Administrators, no restrictions set within the site apply to Administrators.

• User Administrators - These users have been granted “Can access and maintain users in this user's Organizations”. They can manage the permissions of the users in their own organization. These users can only manage permissions by changing group memberships for the users that they maintain.

---

Best Practices

• Define your Groups to match the roles your users will have on your site. Customer, End User, Technician, Customer Service Rep, Administrator, Managers, Supervisors, Help Desk, and Service Desk are common examples.

• Grant as few permissions as possible to the individual user account. It’s recommended to grant only “Issue Hub” to the individual user and let the groups control all other permissions.

• If you are manually creating new users, it helps to clone existing users. By cloning an account, the permissions and group memberships are brought over to the new account. This allows users with similar functions to have the correct permissions with little overhead.

• Use a good naming convention for templates. It’s suggested to give a template the last name “Template”. This allows for easier searching and identification.

• Active Directory setups need to only use one template for all users. Additional permissions should be granted through Issuetrak groups.

• There are two permissions that reference read-only access: Allowed Read Only access to Administration information and Allowed Read Only access to Asset Management information. These permissions allow users to view the specified areas, but not to add, edit, or delete values.

  • If these permissions are mixed with Can access and maintain Administration functions or Can access and maintain Asset Management Module functions, then the ability to change any information is overridden.  Permissions cannot be set on the individual user account. These conflicting permissions could be inherited by membership in two separate groups.

• There is another scenario where permissions can contradict each other, and it involves Can access and maintain users in this user's Organizations, which is the permission that enables User Administrator.  The following two permissions cannot be set on an account with the aforementioned permission:

  • Can access and maintain Administration functions

  • Allowed Read Only access to Administration information

---

 

Parameter-based Permissions

 

Permission	Description
Active	An active user can interact with the Issuetrak site. A user that is not active will not be able to log into Issuetrak, and will not appear in selectable user lists in the application. Active users count toward user counts.
Can Log In	If enabled, then this user can log into Issuetrak. A user can be active and still not be able to log in.
Sys Admin	If enabled, then this user can view the Administration menu option and view/use ALL of its sub-menu options. They can also view the Billing, Asset Management, and Surveys menu options and view/use all of their sub-menu options when these modules are activated. Regardless of membership within an Organization or Department marked Internal, they can also view ALL issues in the system in any of their reporting mechanisms.
Show Debug	If enabled, then this user can view specific information when needed by Issuetrak Technical Support. This should only be selected if specifically requested by Issuetrak Technical Support.
No AD Authentication (Only present in pre-11.13 releases)	This permission is only used when Active Directory is enabled. A user record with this permission is not verified with Active Directory. All permissions are granted through other means. In addition, the password for this user account is controlled in the application.; It is recommended that at least one Sys Admin account uses this permission in the event that there is a problem or change with Active Directory that requires updating Issuetrak's Active Directory settings.
Issuetrak Authentication (11.13 and later)	User records with this selected only authenticate against the credentials stored in the Issuetrak database, and are not governed by Active Directory. It's a good idea to have at least one Sys Admin account with this authentication selected, in case problems arise with authenticating to AD.

---

 

Agent Permissions

 

Permission	Description
Can assign issues	If enabled, then this user can manually assign issues to users/groups with "Can be assigned issues" permission.
Can be assigned issues	An active user can manually and automatically be assigned issues. With "Activate link allowing self-assignment of next available issue in an unassigned queue," they can use a link on the Issue Hub screen to assign unassigned issues to themselves without Can Assign Issues.
Can submit issues on behalf of other users	If enabled, then this user can submit issues in which they are the Enterer and another user is the actual Submitter.
Can access and maintain Administration functions	Except for License and System Settings, view the Administration menu option and view/use all of its sub-menu options. Regardless of membership within an Organization or Department marked Internal, they can also view ALL issues in the system in any of their reporting mechanisms.
Can assign Next Action	Provides the ability to assign Next Actions to users/groups with Can be assigned Next Action.
Can be assigned Next Action	Enables the ability to manually and automatically be assigned Next Actions.
Can authenticate with the API v2	Grant this user the ability to interact with and authenticate to API v2. Only visible if API v2 is enabled. Not visible if API v2 is merely installed.
Can create/manage/use own Quick Notes and use shared Quick Notes	Provides the ability to use and interact with Quick Notes.

---

 

Administration Permissions

 

Permission	Description
Can access and maintain Billing Module functions	If enabled, then this user can view the Billing menu option and view/use all of its sub-menu options when the Billing Module is activated.
Can access and maintain Asset Management Module functions	If enabled, then this user can view the Asset Management menu option and view/use all of its sub-menu options when the Asset Management Module is activated.
Can access and maintain Surveys Module functions	If enabled, then this user can view the Surveys menu option and view/use all of its sub-menu options when the Surveys Module is activated.
Can access and maintain all Projects	If enabled, then this user can view/add/edit any Project, including those marked Exclusive.
Can access and maintain users in this user's Organizations	Activate the User Administrator functionality for this user.

---

 

Data Access Permissions

 

Permission	Description
Allowed Read-Only access to Administration information	Except for License and System Settings, view the Administration menu option and view/use limited sub-menu options related to existing Administration information. Regardless of membership within an Organization or Department marked Internal, they can also view ALL issues in the system in any of their reporting mechanisms.  This permission will override other Administration permissions granted to a user.
Allowed Read-Only access to Asset Management information	If enabled, then this user can view the Asset Management menu option and view/use limited sub-menu options related to existing Asset Management information when the Asset Management Module is activated.  This permission will override other Administration permissions granted to a user.
Can view and add Private Notes in issues	If enabled, then this user can view Notes marked Private in issues, email notifications, and any of their reporting mechanisms. They can also add Private Notes on issues.
Can view and enter content in Private User Defined Fields	If enabled, then this user can view User Defined Fields marked Private in issues, email notifications, and any of their reporting mechanisms. They can also select/enter values for Private User Defined Fields on issues.
Can view and select from Private Issue Templates when submitting issues	If enabled, then this user can view/select Issue Templates marked Private on the Submit Issue screen.
Can view Assigned To information in issues and email notifications	If enabled, then this user can view Assigned To and Next Action field and value in issues, email notifications, and any of their reporting mechanisms.
Can view issues submitted by other users	Except for issues filtered by membership within an Organization and/or Department marked Internal, view issues in which they have no role in any of their reporting mechanisms.
Can view Private Knowledge Base Articles	If enabled, then this user can view Knowledge Base Articles marked Private.
Can add, edit and delete Knowledge Base Articles	If enabled, then this user can add/edit/delete Knowledge Base Articles. With "Can view Private Knowledge Base Articles," they can also add/edit/delete Knowledge Base Articles marked Private.
Can add, edit and delete Knowledge Base Categories and Sub Categories	If enabled, then this user can add/edit/delete Knowledge Base Categories and Subcategories.
Can add, edit and delete Custom Record Table records	If enabled, then this user can add/edit/delete Custom Record Table records when the Custom Record Table feature is activated.
Can change their own password	If enabled, then this user can reset their Issuetrak password. If authenticated by AD, they will need to contact their organization's support team to have their AD password reset.

---

 

Tasks Permissions

 

Permission	Description
Can be assigned Tasks	If enabled, then this user can manually and automatically be assigned Tasks.
Can view Tasks in issues	If enabled, then this user can view Task Manager details in issues, email notifications, and any of their reporting mechanisms.
Can assign Tasks	If enabled, then this user can manually assign Tasks to users/groups with "Can be assigned Tasks."
Can edit Tasks in issues	If enabled, then this user can edit task details for any task the user has access to.

---

 

Issue Maintenance Permissions

 

Permission	Description
Can add Notes to closed issues	If enabled, then this user can add Notes on issues after they have been closed.
Can close issues	If enabled, then this user can close issues.
Can close issues: Limit to issues submitted by this user	If enabled, then this user can close only issues the user has submitted
Can delete issues and issue related attachments	If enabled, then this user can delete issues and issue attachments.
Can edit issues	If enabled, then this user can edit issues, including changing Class values, delete attachments, add/edit notes, change Subject and Description fields, change UDF values, status, substatus, and labor hours.
Can enter Labor Hours when entering Notes/completing Tasks	If enabled, then this user can add/edit Labor Hours for Notes and Tasks on issues.
Can enter Line Items from Billing Module in issues	If enabled, then this user can add/edit/delete Line Items and view/print Work Orders on issues when the Billing Module is activated.
Can modify submitted date when submitting Issues	If enabled, then this user can edit the submitted date as issue is being entered.
Can modify Closed Date in issues	If enabled, then this user can edit Close Date on the Close Issue screen. Close Dates cannot be modified after issues have been closed.
Can modify First Response Time entered in SLA issues	If enabled, then this user can edit First Response Time on SLA-related issues when the Service Level Agreements feature is activated.
Can select Priority when submitting and maintaining issues	If enabled, then this user can select Priority on issues.
Can select Severity when submitting and maintaining SLA issues	If enabled, then this user can select Severity on issues.
Can select Substatus when submitting and maintaining issues	If enabled, then this user can select Substatus on issues.
Can view and select from Assets when submitting and maintaining issues	If enabled, then this user can view/select Asset on issues.
Can view and select from Issue Templates when submitting issues	If enabled, then this user can view/select Issue Template on the Submit Issue screen.

---

 

Reporting Permissions

 

Permission	Description
Can add, edit and run shared Saved Searches	If enabled, then this user can mark their own Saved Searches as Shared, and edit Saved Searches created by other users marked Shared.  Note, that you may only view shared searches created by members of your own organization.
Can add, edit and run Report Writer Reports	If enabled, then this user can view/use the Report Writer sub-menu option.
Can run built-in Summary Reports	If enabled, then this user can view/use the Summary Reports sub-menu option

---

 

Email Permissions

 

Permission	Description
Will receive an email notification on Escalation of ANY/ALL issues	If enabled, then this user can be notified via email of every Escalation event.
Will receive an email notification on Submission of ANY/ALL unassigned issues	If enabled, then this user can be notified via email of every Submission event in which an Assignment does not occur. If a manual assignment of an issue is made, then the user with this permission will not receive an email.
Will receive an email notification when Note Added to ANY/ALL issues	If enabled, then this user can be notified via email of every Add Note event.

Everything a user can do within the system is determined by permissions and their End User/Agent designation. User Templates are a predefined set of menu options and End User permissions that the system uses to create new user records.

The User Template will be used to assign these predefined menu options and End User permissions for users created by the below processes:

• Submit Issue screen
• Login screen using the Self-Registration feature
• Authentication and imports from AD using the AD Module
• Incoming email sent to the system using IEM

You may also set up different templates based on each of these processes.

When users are created from these processes, their initial permissions cannot be changed before their records are saved. If a default template is not set up, no permissions will be applied. If a default template is set up, only the permissions on the template will be applied. In both cases, users must be edited or added to a group to change their initial permissions. In addition, no changes to a default template will be applied to records already created from them.

---

 

Editing a User Template

Issuetrak comes with an EndUser Template that can be modified to grant everything your basic users need when created from AD. The template can be modified using the steps below.

Steps:

1. Click the gear icon in the upper right > click Users beneath Entities.
2. In the right context menu click on Search beneath Search User.
3. Change the Record Type from User to Template.
4. Click Active Records Only.
5. Click Search.
6. Click Edit for the EndUser template.
7. Adjust the menu options, permissions, and group memberships as necessary.
8. Click Update.

A confirmation message will appear when this process is complete.

---

 

Adding a User Template

If you don’t want to use the built-in template, you can create a new template using the below steps.

Steps:

1. Click the gear icon in the upper right > click Users beneath Entities.
2. In the right context menu click on Add beneath Users.
3. Change the Record Type to Template.
4. Enter a name for the template in the User ID field.
   • If you do not enter a name in the User ID field, Issuetrak will automatically assign a number as the user ID.
5. Enter a generic first and last name (e.g. “EndUser/Template,” “External/User”).
6. To allow users created from this template to log in – select Can Log In.
7. To prevent users created from this template from being sent system-generated email notifications – select Suppress All Email.

8. Select the appropriate Organization memberships by clicking Select Organization(s) (this field is required). Keep in mind the following:

   1. You must select a primary organization for this template (designated by a "Star" icon). This organization will determine a large degree of information visibility for the users derived from this template.

   2. If desired, you can add organization memberships beyond the primary organization. You can find organizations by typing part of their name into the "Search & Filter..." field
      
      If an organization's name contains the sequence of characters you entered, it will appear in the "Available Organizations" column.
      
      For each organization membership, you add can optionally add "Edit Issues" for this template (subject to "Can Edit Issues" permission), designated by the "Pencil" icon. Additionally, toggling the "People" icon on an organization membership will allow users derived from this template to have the ability to list users belonging to this organization.
      
      You can add organization memberships...

      1. By clicking Add Visible, which will add every organization currently displayed in the "Available Organizations" column (up to its 100 organization limit) to the "Organization Memberships" column.

         1. If there are more than 100 organizations in the site, the next available batch of previously-undisplayed organizations will populate the "Available Organizations" column. You can keep clicking Add Visible until all organizations have been added to the "Organization Memberships" column, if you wish.

      2. By clicking and dragging the available organizations to the Organization Memberships column.

9. Select a Department (optional).
10. Select a Location (optional).
11. Select a default Time Zone (required).
12. Adjust the menu options, permissions, and group memberships as necessary.
13. Click Save (Reset will clear this screen of all current entries/selections.).

A confirmation message will appear when this process is complete.

---

 

Defining the New Submitter default template

Steps:

To define a default template for new users added from the Submit Issue screen:

1. Click the gear icon in the upper right > click Defaults beneath System.
2. Scroll to the New Submitter Defaults section and click the template search ( 🔍 ) next to Create From -OR- Defaults.
3. Select the appropriate template in the Select User Record window that appears. This window will then close and you will be returned to the System Defaults screen.
4. Click Update.

   • Reset will reset this screen to the values defined during the most recent update.

A confirmation message will appear when this process is complete.

---

 

Defining the Self Registration default template

Steps:

1. Click the gear icon in the upper right > click Features beneath System.
2. Scroll to the Self Registration section and select Activate Self Registration.
3. Click the template search ( 🔍 ) next to Create From.
4. Select the appropriate template in the Select User Record window that appears. This window will then close and you will be returned to the Features screen.
5. Click Update.

A confirmation message will appear when this process is complete.

---

 

Active Directory Module considerations

• As a best practice, we recommend mapping all Active Directory users to the same basic User Template, then assigning User Groups within your site to manage additional permissions.

• The User Template will be re-applied whenever a user logs in or they are re-imported via AD Imports. Any menu options or permissions that are not granted by either a User Group or the User Template will be lost.

This article explains the various methods a password reset can be performed for a user’s account.

There are three methods with which a password can be changed depending on the configuration of the Issuetrak site and the permissions granted to the users and/or administrators.

1. Using Active Directory, a user can reset their password using the company-approved password reset method, once reset, the user will be able to log in with the new password.
2. An Administrator or User Admin can perform a password reset from within the Issuetrak site. Please see the steps below to perform this procedure.
3. The user can perform a Self-Help Password Reset if the feature is enabled.

---

 

Permissions and Requirements

In order to have the ability to perform a Self-Help Password Reset the following requirements must be met:

• The user permission Can change own password must be enabled on the user profile.
• The user must have a valid email address populated in their profile.
• The user’s profile must not be set to suppress all emails.
• The site must have the Outgoing Email enabled.
• The site must have the setting Activate Self Service Password Reset enabled.

In order to be able to change a password on behalf of another user, the Administrator must have one of the following permissions enabled for their account:

• Sys Admin
• Can access and maintain Administration functions
• Can access and maintain users in this user's Organizations

---

 

Administrator Password Reset

Administrators and Organization Administrators have the ability to perform a password reset on behalf of a user or can also send an email to have the user perform their own password reset.

Steps:

1. Click the gear icon in the upper right > click on Users beneath Entities.
2. Locate and edit the user’s account.
3. On the right context menu, there is a link to Change Password.

You will be presented with 2 options for a password reset.

---

Option 1: Set a password manually.

1. Fill out the New Password and Confirm New Password fields, paying attention to the password requirements fields that will change from red to green as the requirements are met.
2. Confirm that you want to change the user’s password by entering the password for the administrator’s account that is currently performing the password reset in the Authorize Password Change box.
3. Once all 3 fields are filled out, click on Continue to change the password.

A confirmation message will appear once the process is complete.

---

Option 2: Send an email to the user.

1. Select the option Let the user change their password (sends an email).
2. Click on Continue.
3. This will send the email and the user would follow the same steps as the Self-Service Password Reset as though they had clicked on the Forgot / Reset your password? option on the login screen.

A confirmation message will appear once the process is complete.

This article is intended to inform administrators on how to configure MFA in Issuetrak. If you are not an administrator, then you should instead view the steps for configuring MFA as a user in the My Settings article.

Issuetrak natively supports multi-factor authentication (MFA) for users that use Issuetrak authentication.

There are two supported methods of MFA. You may select only one method to use per user account:

• Time-based One-Time Passcode (TOTP) - An app such as Google Authenticator or Authy generates a 6-digit passcode that the user must enter in addition to their issuetrak credentials.
   
• Email-based one-time passcode - Upon entering their credentials, they will be emailed a one-time passcode that must additionally be entered to access Issuetrak. This requires that the user has a valid email address and that Issuetrak has Outgoing Email configured and functional.

Additionally, you may decide to require all of your users to use MFA. Note that once you set the option to require MFA in your site, all Issuetrak-authenticated users with valid email addresses that haven't configured MFA will then be enrolled in email one-time passcode MFA. Users who do not have MFA set up and don't have an email address will not be able to log in.

---

Time-Based One-Time Passcode (TOTP)

One of the available MFA options is to configure a mobile device to provide a new six-digit one-time passcode every 30 seconds, which users will enter on a screen following the usual Issuetrak login prompt.
 

---

How to Configure

You can assist an Issuetrak-authenticated user with configuring TOTP if they are able to visit your workstation in person, or if you are able to share your screen.

Steps:

1. Sign into Issuetrak as an administrator.
2. Click the gear icon in the top-right corner to open the Settings lightbox.
3. Click Users under the Entities header.
4. Find and view the user account that needs TOTP configured.
5. Under the Security Details header, click on Manage Multi-Factor Authentication.
6. In the pop-up that appears, under the Authenticator header click on Configure. Note that if Email one-time passcode is already configured, you'll receive a pop-up asking for you to confirm that you are invalidating that MFA method for this user.
7. Have the user open their chosen MFA app on their phone (Google Authenticator, Authy, etc) and scan the QR code that appears on your screen.
8. Have the user provide the 6 digit number from the app. You will need to enter it on the screen underneath the Verify header, then click on Pair Device.
9. The screen will pause for a moment and then display this user's Backup Codes. Each backup code can be used once to bypass the MFA prompt. Provide these codes to the user and ask them to keep these in a safe place.
10. (Optional) Have the user test the functionality: They should authenticate to Issuetrak as they normally would. Once they enter their credentials and click Sign In, another screen will appear and they will be prompted to enter the 6-digit number from their authentication app. After successfully entering that number, they should be presented with their Issuetrak home screen.

---

Backup Codes

At the end of configuration in step 9 above, the user is presented with ten backup codes. The purpose of these is to be used in place of the app-generated passcode. A backup code can only be used once. If all backup codes get used for a user account, then it will be necessary to configure MFA for that user account again to generate new codes.

---

Email One-Time Passcode (OTP)

The other available MFA option is to have your Issuetrak instance generate and email each user a one-time passcode when they correctly enter their Issuetrak credentials at the login prompt. After successfully entering their Issuetrak credentials, they will be presented with an MFA screen prompting them to enter the code they were emailed to complete the login process. This process will re-occur every time they sign into Issuetrak.

---

How to configure

It is only possible to use Email OTP if Outgoing Email is properly configured in your site, and the target user has a valid email address associated with their user account. You can assist an Issuetrak-authenticated user with configuring an email OTP by triggering an initial passcode email to the user and then getting in touch with them to obtain the passcode.

Steps:

1. Sign into Issuetrak as an administrator
2. Click the gear icon in the top-right corner to open the Settings lightbox.
3. Click Users under the Entities header.
4. Find and view the user account that needs TOTP configured.
5. Under the Security Details header, click on Manage Multi-Factor Authentication.
6. In the pop-up that appears, under the Email header click on Configure. Note that if an Authenticator App one-time passcode is already configured, you'll receive a pop-up asking for you to confirm that you are invalidating that MFA method for this user.
7. Have the user provide you with the passcode they were just emailed.
8. Enter the passcode and click Verify.
9. If successful, their account is now configured to email them a new passcode each time they successfully authenticate to Issuetrak.
10. (Optional) Have the user test the functionality: They should authenticate to Issuetrak as they normally would. Once they enter their credentials and click Sign In, another screen will appear and they will be prompted to enter the one-time passcode from their email. After successfully entering that passcode, they should be presented with their Issuetrak home screen.

---

Remember Me (30 days)

When users are entering their MFA code to sign into Issuetrak, they can choose to check the box next to Remember me (30 days). Selecting this option will prevent Issuetrak from prompting the user for an MFA code for the next 30 days.

There are scenarios where it is advantageous to have a user with limited administrative capabilities in Issuetrak, without needing to take up an agent license to do so. Beginning with Issuetrak 11.2, it is possible to give permission to an end-user account for the limited administration of other users within their organization. When a user is provided with this permission, we then refer to them as a User Administrator or User Admin. The User Administrator is capable of limited provisioning of new and existing users in Issuetrak.

In summary, a User Administrator:

• Does not take up an Agent license
• Has the ability to create non-AD user accounts within their own organization memberships, add them to groups, and set their password
• Is limited to viewing and editing End User accounts that have primary membership in common with the User Admin's own organization memberships
• Does not have the ability to edit or set user permissions directly, but can grant group membership

Necessary Permissions

The only necessary permission to make an account into a User Admin is Can access and maintain users in this user's Organizations.

However, there are two permissions that the account cannot have if they are a User Admin:

• Allowed Read Only access to Administration information
• Can access and maintain Administration functions

If either of the above permissions is selected for a user that already has Can access and maintain users in this user's Organizations permission, then Issuetrak will warn that the permissions are mutually exclusive.

Abilities

User Admins can perform the following actions on users within their own organization:

• Edit user data within their own organization memberships
• Manage membership for group types of Any within their own organization
• Clone user accounts
• Set and change passwords for end-users in their organization
• Create new End User accounts
• View user permissions
• View user type
• Create user administrators via group membership
• Configure MFA methods

Limitations

User admins cannot:

• Search AD
• Clone AD-authenticated users
• Change whether users are authenticated via AD
• Clone, grant, or edit user permissions
• Delete users
• Change user types
• Edit a Sys Admin or users with Can access and maintain Administration functions permission
• Add a user to a group outside their organization
• View users outside of their own organization
• Close user sessions

Additional Limitations

• All users created by a User Admin will have the No AD Authentication checkbox (pre-11.13 releases) or Issuetrak Authentication (11.13 and later) dropdown set on their account.
• User Admins will only be able to add users to groups that already belong to the same organizations that the User Admin is a part of.
• Although User Admins will have access to the Settings Lightbox it will have access to Users beneath Entities.
• After clicking on the Users item from the Settings Lightbox, the items List All, Add, and Search will appear in the right context menu.
• When viewed by a User Admin, the User Summary page will be filtered to display only those users that have membership in their Organization.
• The Subscriptions link is not shown on the User View screen.
• The ability to Email to User List and Email Survey Invitations User List options will not be present on the User Search screen.  

Legacy Upgrade Considerations

Customers running Issuetrak 9.9.6 or older and using the Organization Administrator feature can run a SQL script to export a list of their existing OrgAdmin users prior to upgrading. This list of users is temporarily stored in a table in the Issuetrak database that is left untouched by the intermediate 10.x - 11.1 upgrades.  The 11.2+ deployment tools have an import process that checks for this table, grants the listed users the User Administrator permission, and subsequently deletes the table. 

---

You may include electronic documents as attachments in user records if Attachments have been enabled on your site.

---

 

Adding Attachments

1. Click the gear icon in the upper right > click on Users beneath Entities.
2. Search for the user using either the Summary, List All, or Search.
3. Click Edit once you have the user selected.
4. Click Attachments on the righthand menu.
5. Click Choose File.
6. Browse to where the file is located using the pop-up window.
7. Select the file and click Open.
8. Click Save.

A confirmation message will appear when this process is complete.