Roles and teams
AI summary
Roles define what users can do (from Owner with full access to Reader with view-only access) while teams control which connector data they see. You assign every user one role and one team to control their access in a Workspace. Rencore Governance provides four built-in roles and default teams, and you can create custom roles and teams to fit your needs.
Roles and teams control what each user can do and see in a Workspace. A role grants permissions, and a team grants access to the inventory objects of selected connectors.
Every user has one role and one team. Rencore Governance comes with four built-in rolesBuilt-in roleA built-in role is one of the four roles every Rencore Governance Workspace comes with: Owner, Admin, Contributor and Reader.Read more and a set of default teamsBuilt-in teamA built-in team is a default Rencore Governance team that decides which inventory objects a user can see.Read more, and you can create your own of both.
How it works
Roles
A role is a set of user permissions. The four built-in roles go from most to least access:
| Role | What it can do |
|---|---|
| Owner | Everything an Admin can do, plus creating and deleting EnvironmentsEnvironmentAn Environment is the connected Microsoft 365 tenant inside a Workspace.Read more, managing Subscriptions, roles and auditing, and deleting the WorkspaceWorkspaceA Workspace is the top-level container in Rencore Governance. It holds the settings, users, roles and connected apps for exactly one Environment, the connected Microsoft 365 tenant.Read more. A Workspace can have up to three Owners. |
| Admin | Everything a Contributor can do, plus managing users, teams, API keys and mail settings, and Environment settings such as connectors, consent and scan intervalsScan intervalA scan interval is how often Rencore Governance aims to scan one object type, such as daily or weekly.Read more. |
| Contributor | Creates and edits dashboards, reports, policies, automations, reviews, access reviewsAccess reviewAn access review is a report in the deprecated Access feature that shows who has access to content, for owners to approve.Read more and provisioning. |
| Reader | Reads the home page, inventory, dashboards, reports, policies, automations, reviews and provisioning, without changing them. |
A custom roleCustom roleA custom role is a role you build yourself in Rencore Governance when no built-in role fits.Read more combines any of the user permissions, grouped by area. Roles also carry separate permissions to run actions and automations of low, medium and high criticalityCriticality levelA criticality level, Low, Medium or High, rates how much impact an automation or built-in action has on your tenant.Read more, and you can restrict which built-in actionsBuilt-in actionA built-in action is a ready-made operation you run directly on inventory objects without building an automation, for example adding a user to a Team.Read more a role may run.
Teams
A team decides which data a user sees. Each default team covers the objects of one or more connectors, for example the All Services team covers every connector, and the SharePoint team covers SharePoint plus the users and groups from Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more. A custom teamCustom teamA custom team is a team you build yourself in Rencore Governance to control which inventory objects its members can see.Read more combines the connectors and object typesInventory objectAn inventory object is one item Rencore Governance has scanned from a connector, such as a single Team, SharePoint site collection, user or Power App.Read more you choose.
These Rencore teams are not Microsoft TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more. They are groups of permissions inside Rencore Governance.
Where you manage them
Click “Settings” and then “Users & Roles”. There you invite users, suspend or remove them, and change a user’s role or team. Custom roles and custom teams are created on the same page.
Example
Your SharePoint administrators should build policies and reports, but only for SharePoint. You give them the Contributor role and the SharePoint team. They can create policies on SharePoint sites, and they do not see Power PlatformPower PlatformPower Platform is the Microsoft low-code platform where users build their own apps, flows, reports, agents and websites.Read more or ExchangeExchange OnlineExchange Online is the Microsoft 365 mail and calendar service. Rencore Governance covers it with the Exchange connector, part of the Digital Workplace module.Read more data. Your help desk gets the Reader role and the All Services team, so it can look up any object without changing anything.
How it relates to other concepts
- Roles and teamsRoles and teamsRoles and teams control what each user can do and see in a Workspace. Each user is assigned a role, which grants permissions, and a team, which grants access to inventory objects.Read more are assigned per Workspace. A Virtual EnvironmentVirtual EnvironmentA Virtual Environment is a logical segment of the data in one Microsoft 365 tenant, for example a department, region or subsidiary.Read more has its own permissions on top.
- Teams filter what a user sees in the inventory, and so in the reports and policies built on it.
- The criticality permissions decide who may run high-impact built-in actions and automations.
- Reviews need the Review permissions. See Reviews.
Frequently asked questions
What is the difference between a role and a team in Rencore Governance?
A role is a set of user permissions that controls what a user can do. A team controls which data a user sees, by granting access to the inventory objects of selected connectors. Every user has one role and one team.
Which built-in roles does Rencore Governance have?
There are four built-in roles: Owner, Admin, Contributor and Reader, from most to least access. You can also create custom roles that combine any of the user permissions. A Workspace can have up to three Owners.
Where do I change a user's role or team?
Click Settings and then Users & Roles. There you can invite users, suspend or remove them, and change a user's role or team. Custom roles and custom teams are created on the same page.
How do I let SharePoint administrators build policies only for SharePoint?
How do I let SharePoint administrators build policies only for SharePoint?Give them the Contributor role and the SharePoint team. They can then create policies on SharePoint sites, and they do not see Power Platform or Exchange data.
Are Rencore teams the same as Microsoft Teams?
Are Rencore teams the same as Microsoft Teams?No. Rencore teams are groups of permissions inside Rencore Governance. They decide which connector data a user sees and are not Microsoft Teams.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?
Learn more
- Default roles and permissions and Default teams
- Assign a user a role and team
- Create a custom role and Create a custom team
- Invite users to a Workspace
- Roles reference, Rencore teams reference and Custom role permissions