Managing mutliple portal Creator accounts - data security and permissions acoss groups

[WaterAdminNSW_Dept__Industry__]

Hi team, moving to a fresh portal install and my agency is concerned that Creator level licences will be able to modify/delete content in other teams / groups / creator accounts?

Untested but i imagine this may be treated by:
* creator licences being assigned to a group? 
* registered data sources only to particular goups/users? - ie access only to your own data/DB.
* DB / schema credentials and assignement? 

* or, some other simple in app solution? 

Is anyone able to comment? 

[MarleyGeddes]

Hi there!

To answer this, I'm going to define what user types, member roles and privileges are and how they together detemine what a member can do within an organization.

All organization members must be assigned a user type and a member role.  The user type assigned to a member determines what capabilities (level) they have within the organization and what app licenses they have by default. The member role is a set of privileges and further defines this to what access members have within the organization. It is the combination of user type and privileges assigned through a member role that determines what members can do within an organization.

Members assigned a Creator or GIS Professional user type can be assigned any member role, including the default Administrator role, which can edit and delete other members content. However, you can assign a member role that does not have administrative privileges to edit or delete other members content, such as the default Publisher role.

You may find the following documentation topics helpful in this area:
https://enterprise.arcgis.com/en/portal/latest/administer/windows/user-types-orgs.htm
https://enterprise.arcgis.com/en/portal/latest/administer/windows/member-roles.htm
https://enterprise.arcgis.com/en/portal/latest/administer/windows/privileges-for-roles-orgs.htm

Hope this helps!
Marley