Admin Guide: Managing Users & Permissions

This guide covers both types of user accounts in the DAM system: backoffice users (administrators) and portal members (end users). It explains the permissions model, permission presets, and how to manage access.

1. Understanding the Two User Types

Backoffice Users: Administrators who access the Umbraco CMS. Managed via Umbraco's Users section. Use User Groups for permissions.
Portal Members: End users who access the portal (at /portal). Managed via the DAM's Members tab in the backoffice. Use Member Groups for permissions.

These are completely separate. A person can be both a backoffice user and a portal member, but the accounts are independent.

2. Portal Member Permissions Model

Portal member capabilities are controlled by Member Groups. When a member belongs to a group, they gain that group's capability.

Member Group	Capability	What It Controls
DAM Downloaders	Asset Download	Download original files and size presets.
DAM Uploaders	Asset Upload	Upload new assets to the library.
DAM Asset Editors	Asset Edit	Edit metadata, manage tags, upload new versions.
DAM Asset Archivists	Asset Archive	Archive and restore assets (reversible).
DAM Asset Deleters	Asset Delete	Move assets to bin and restore from bin.
DAM Sharers	Collection Share	Share collections and assets with other portal users.
DAM External Sharers	External Share	Create public share links accessible without login.
DAM Collection Managers	Collection Create	Create, edit, and delete collections.
DAM Transfer Managers	File Transfer	Create and manage file transfers.
DAM Analytics Viewers	Analytics View	Access the analytics dashboard.
DAM Moderators	Bypass Moderation	Uploaded assets skip the approval queue and are published immediately.
DAM Super Admins	All Permissions	Full access to all portal features.

Always available (no group needed): viewing assets and viewing collections. Any logged-in member can browse the library.

3. Permission Presets

Instead of assigning individual groups one by one, use presets to quickly assign a common combination of permissions.

Preset	Groups Included
Read Only	DAM Downloaders
Standard User	DAM Downloaders, Collection Managers, Sharers, Transfer Managers
Contributor	All Standard User groups + Uploaders, Asset Editors, External Sharers
Power User	All Contributor groups + Asset Archivists, Asset Deleters, Analytics Viewers

DAM Moderators and DAM Super Admins are never included in presets. They must always be assigned manually for safety.

4. Applying Presets to Members

Go to the DAM section and click the Members tab.
Select the client to filter the member list.
Find the member by name or use the email search.
Each member row shows their current DAM group memberships as chips.
Select a preset from the dropdown on the member's row. You can view the existing presets by opening the 'Preset Reference' accordion. You can also create new presets, or edit existing ones on the 'Presets' tab.
Click Apply. The member's groups are updated with the preset's groups, but this action is additive only. It will not remove any previous groups the member belonged to.
The member's group chips refresh inline to confirm the change.

5. Manual Group Assignment

For fine-grained control, you can also manage member groups directly in Umbraco's Members section.
Open a member's profile and edit their group memberships.
This is useful when a user needs an unusual combination of permissions not covered by presets.

6. How Portal Members Are Created

Microsoft SSO: When a user logs in via "Sign in with Microsoft", their member account is auto-created based on their email domain mapping (e.g. @stmagency.co.uk users are assigned to the STM client).
Password-based: Members can also be created manually in Umbraco's Members section.
New members are created with minimal permissions. An admin must assign groups or apply a preset to grant capabilities.

7. Backoffice User Permissions

Backoffice users (CMS administrators) are managed via Umbraco's Users section.
DAM-specific backoffice groups:
- damsuperadmin: Full access to all DAM backoffice features including asset purge.
- damadmin: Full access except asset purge.
Standard Umbraco admin users also have full DAM access by default.
Assign backoffice users to clients using User Client Assignments (see the Client Management guide).

8. Tips

Start new members with the Standard User preset and upgrade as needed.
Use presets for consistency -- they ensure members get the right combination of permissions.
Review member permissions periodically, especially when team roles change.
The Moderators group should only be given to trusted users who do not need their uploads reviewed.
Super Admin is the highest permission level -- assign it sparingly.