User Security

From Genesys Documentation
Jump to: navigation, search
This topic is part of the manual Workforce Management Administrator's Guide for version Current of Workforce Management.

Use roles and privileges to fine-tune user access to specific functionality and views in WFM.

Related documentation:

The Workforce Management (WFM) user security modules Configuration > Roles and Configuration > Users in WFM Web for Supervisors, enable you to fine-tune the type of access each user has to WFM views, objects, and functions. For example, you can:

  • Limit certain users so that they can view only certain sites or teams.
  • Limit certain users so that they can read the schedule but not change it.
  • Limit access to reports.
  • Limit access to WFM configuration settings views, such as Contracts and Time Off Rules.

Securing schedule changes

User security enables you to control who can make changes to schedule scenarios and to the Master Schedule. Users might be able to enter changes to the Master Schedule, but unable to commit or approve changes. These changes are in Pending status. An authorized user can then review the changes, and either commit/approve them or roll back/delete the changes.

This enables contact center managers to provide Master Schedule access to certain users who might not ordinarily have access. For example, supervisors who manage teams of agents, but who don’t normally have any scheduling responsibility, can enter team meetings or other exceptions into the schedule. Workforce-scheduling professionals can then review these to ensure that coverage is not adversely affected.

Genesys Administrator security

The information in this section is added for information purposes only, contact your Genesys Professional Services representative if you have questions about how user security is managed in your environment.

The security setup in Genesys Administrator also applies to Workforce Management. WFM has its own security/access rights system but also implements tenant security for the objects that are shared with Genesys Administrator. For example, a user who is logged in to Web for Supervisors, but does not have permission to view certain objects/users in the Genesys Administrator, will not be able to view those objects/users in Web for Supervisors.

A user's ability to see, interact with, and synchronize agents and skills in WFM matches that user's tenant-based access permissions in the Genesys Administrator. In other words, in order to access an agent or skill in WFM, you must be able to access them in Genesys Administrator.

This access permission is tenant-based. If you are working in a multi-tenant environment, this behavior affects every display of agents or skills in WFM. Tenants exist only in multi-tenant environments.

Managing dual-role assignments

Workforce Management (WFM) supports the capability to assign two roles (Agent and Supervisor) to a single agent.

At times, there are people in your contact center who require multiple role assignments. For example, an agent who is promoted might sometimes be required to perform a supervisor's tasks, which would require them to be assigned both Agent and Supervisor roles.

This topic describes how to create and manage dual-role assignments.

There are two types of role assignments within the scope of this functionality: Supervisors and Administrators.


Assign this role to agents who are being promoted to a supervisor's position.

In Genesys Administrator Extension (GAX), this Person object is configured with the Agent check box enabled. In Agent Setup, this Person object is configured with the Agent Workspace Agent check box enabled.

After logging in to WFM, this user:

  • Sees the WFM Web for Supervisors homepage.
  • Can open the Agents UI in a separate browser window by clicking Open Agent in the Supervisors UI.
  • Can work in Supervisors UI and Agents UI simultaneously.
  • Has implicit access rights to the team to which he belongs and the objects in his/her assigned site.
  • Is assigned the WFM Role. If the WFM Role is not preconfigured (in GAX or Agent Setup), this user has minimum access rights to the Configuration > Organization views.
  • In the Web for Agents UI:
    • In the Other Schedules view, can see agents and trade schedules within his/her own team and agents who have no assigned team.
    • In the Bidding > Schedule > Scenarios view, can bid on all agents' schedule profiles, except agents from other teams.
    • In the Browse Shared Transport view, can see agents' shared transport from his/her team and agents who have no assigned team.
If the promoted agent is not assigned to any team, in the Web for Agents UI:
  • Other Schedules view—Can see and trade schedules only with agents who have no assigned team.
  • Bidding > Schedule > Scenarios view—Can bid on his/her own schedule profile and agents' schedule profiles who have no assigned team.
  • Browse Shared Transport view—Can see agents' shared transport that have no assigned team.

If this agent needs to trade schedules, bid on schedule profiles, or see agents' shared transport from other teams or sites, you must grant access rights to the appropriate teams or sites in the Web for Supervisors Configuration > Users > Access Rights view.


Assign this role to a person who is initially hired as a WFM Supervisor. In this case, the person does not have a dual-role, but instead, is automatically imported into WFM as WFM Supervisor after the first login.

In GAX, this Person object is configured with the Agent check box disabled. In Agent Setup, this Person object is configured with the Agent Workspace Agent check box disabled.

After logging in to WFM this user:

  • Is automatically imported into WFM
  • Sees the WFM Web for Supervisors homepage.
  • Has access rights to all teams, sites, and business units, and the objects therein
  • Is assigned the WFM Role. If the WFM Role is not preconfigured (in GAX or Agent Setup), this supervisor has maximum access rights to all WFM views.

Set up dual-role agents and provide access rights

The following procedures describe how to set up dual-role agents in Agent Setup and WFM Web for Supervisors:

You can use either Agent Setup or GAX to create roles. However, the optional step 2 in Create the Genesys roles cannot be done using GAX.

1. Create the Genesys roles

  1. In Agent Setup, create the WFM Administrator and WFM Supervisor roles.
    In Azure, you must specify these exact names.
  2. (Optional and cannot be done in GAX) Map each role to a specific WFM role:
    1. Select Role and then, click Annex.
    2. Add a section named wfm.
    3. Create the option wfm.role with a value equal to the WFM role created in WFM Web for Supervisors.
      After logging in, the user is assigned a specific WFM role.

2. Assign the roles

  1. In Agent Setup, create dedicated Access Groups (for example, WFM Administrators or WFM Supervisors)
  2. Add Person objects to either one of these groups.
    Do not add the same Person object to both access groups.
    • Add the WFM Administrators Access Group to WFM Administrator Role Members.
    • Add the WFM Supervisors Access Group to WFM Supervisor Role Members.
Using GAX in Amazon Web Services (AWS), you can assign Person objects directly to roles without using Access Groups.

3. Configure WFM to support dual-role agents

  • In Azure, do nothing. This part of the setup is configured by default.
  • In AWS, some configuration is required for this part of the setup. Contact your Genesys Account Representative for assistance.

Remove dual-roles from users

This applies only to agents who were promoted to a Supervisor role.

To remove the Genesys role assignment from the agent:

  • In Agent Setup or GAX:
    • Remove the agent from the WFM Supervisors Access Group.
  • In GAX only:
    • Remove the agent from the role, directly.

Changes take effect the next time the agent logs in.

Comments or questions about this documentation? Contact us for support!