System Center Orchestrator Runbooks Permissions

Question

Good afternoon!

I have a question with regards to Runbook's permissions and hope to find help here.

I have created some Folders to represent departments in Orchestrator Runbook Designer and there are 1 runbook in each folder as an example. I have also created some other Administrative User Accounts to be used to execute some of the Runbooks. My question is?

My objective is to allow specific Administrative Account to see only their respective Runbooks in the Orchestrator Console (Web). Can these be achieved?

As I have tried assigning permission for those Administrative Accounts to only their Respective Folders and Runbooks but once they are logged in to the Web Console, all Folders and Runbooks are visible.

Thank you and appreciate any advise.

Ronald

Answer 1

Hi,

you do NOT need SQL Logins for each user/group of the Orchestrator Web Console.
If you have

-Runbooks
|-Folder A
|--- Folder 1
|--- Folder 2
|- Folder B

and the Runbooks for Web Console are in "Folder 1" which is under "Folder A":

The user need Read Permissions for Runbooks, Folder A and Folder 1 and also "publish" for Folder 1.

The setting is perhaps not visible immediately: https://support.microsoft.com/de-de/help/2738490/orchestrator-runbooks-folders-and-or-statistics-are-not-displayed-or-u
Run this after the changes:

TRUNCATE TABLE [Microsoft.SystemCenter.Orchestrator.Internal].AuthorizationCache

Answer 2

Hi! Stefan,

As always, thank you for enlightening me.

Thank you and have a great week ahead.

Best regards.
Ronald