Tenant administrators can assign the Restricted Integration User role.

To assign this role, tenant administrators must:

  • Assign the Restricted Integration User role to a user.
  • Assign workspaces where the restricted integration user can manage connections and integrations.
    Tenant administrators must select at least one workspace.

Note: When the tenant administrator selects workspaces for the restricted integration user, this action doesn't grant the user access to the workspaces themselves, or to the workspace models.

To get access to both the workspaces and models, workspace administrators can add users to a workspace from within model.

To assign the Restricted Integration User role and workspaces:

  1. Access Administration from the Application menu.
  2. Select Users > Internal.
  3. Select a user from the list.
    Note: If you want to create an internal user, you must be a user administrator.
  4. Select the Roles tab from the right-hand panel.
  5. Turn on the Restricted integration user toggle.
  6. Select at least one workspace for the user to manage.
    You can also:
    • Search for a workspace in the Find a workspace field.
    • Choose Select all or Deselect all to select or deselect all listed workspaces.
  7. Select Save.

The restricted integration user also needs access to the workspaces you selected for them, as well as appropriate model role permissions for the models they have access to. To get both workspace and model access, a workspace administrator can add the restricted integration user to a workspace from within a model.

To run a CloudWorks integration, the model role set for the user:


  • If Dynamic Cell Access is enabled when an integration is run by a restricted integration user, the integration uses the permissions associated with that user.
  • If Selective Access is enabled for a list: 
    • The appropriate read/write permissions must be enabled for the restricted integration user. 
    • The restricted integration user doesn't use the permissions from the Internal (Full Access) alias (role).

For more information, see these pages: