Enterprise login and roles

[JonJablonski]

I am configuring Enterprise Login for AGO.  I want the default role for anyone who logs in to be one that can't spend credits.  How do I determine what the default role for an Enterprise-authenticated user will be?

[DavidMedeiros]

I have the same question. How can I verify (and then change) the default role?

I've created a custom user role with limited credit spending abilities that I'd like to be the first role applied to each new account, rather then having to change the roles manually.

[HeathBrackett1]

ESRI still doesn't allow us to assign a default role.  The default role is set as the standard user.  So, we are doing this through a Python script.  We have written a script that queries ArcGIS Online every minute to search for new users.  When it discovers a new user, it then calls update_user_role in the PortalPy module to assign that custom role.  It's currently a bit clunky, but I've got it working and will continue to refine it. 

[DavidMedeiros]

Thanks Heath,

I thought I'd read or heard that AGO admins were able to set the default role to a custom role. I assumed this meant there was a AGO admin feature to change the default role as opposed to needing to script something. Too bad, seems like a simple and obvious add on to AGO control for Esri.

[HeathBrackett1]

I agree, David.  I get the feeling that ESRI is just running around trying to catch up with technology when it comes to updating ArcGIS Online instead of really planning for a good user experience.  Documentation lags far behind functionality in my opinion and I spend a lot of time digging around and experimenting with things before going to ESRI Support or GeoNet to log incidents, which becomes a whole other time-suck.

In our agency, when we want to create custom tools we have the conversations about whether we think ESRI will address that in the near future or whether we should invest the time to find our own solution.  It's a fine line we walk sometimes.

[MikeMinami · Accepted solution]

Jon, David,

I think you want this. On the My Organization tab, click Edit Settings, click Security then Edit Identity Provider. You can set the default role here. This may be a custom role as well.

Thanks,

Mike

[HeathBrackett1]

Nice!  That's new in today's latest release?

[DavidMedeiros]

Thanks Mike,

That looks to be relevant only to the Enterprise Login function, which I don't have set up at the moment. I inherited management of our account and need to investigate the Enterprise function at some point.

That said, I would think this would be a general Roles function and available universally across AGO instead of just under Enterprise.

David

[MikeMinami]

David,

How are you inviting people? You can specify the role when you invite people individually, or through a CSV file.

Invite and add members—ArcGIS Online Help | ArcGIS

Mike

[MikeMinami]

David,

As far as creating a role that limits credit use, there is a Viewer Template you can use when you create a custom role. A custom role based on this would severely limit credit consumption and thus functionality as well.

It may be good to examine what costs credits. A lot of things don't cost many credits, but there are a few that do. Here's a link to the page that lists credit consumtion.

ArcGIS | Service Credits

Many of the big credit consumers are related to data content. Essentially, areas where Esri licenses data and pays royalties.  These include:

Data Enrichment

Demographics

Infographics

Geocoding (batch)

Building tiles can also cost a lot of credits when building tiles for larger scales, as millions of tiles can get created.

So if you limit these privileges in your custom roles, I think you'll find that those users won't consume many credits.

Thanks,

Mike