Skip to main content

Managing users & permissions at Pega

Project Leader

The Getting Started Guide

Managing users & permissions at Pega

Admins at Pega are responsible for managing user access, roles, and permissions across their organization's Pega tools.

Understanding our Model

How access works at Pega

Pega supports two ways to manage user access.
Which one you use depends on your account configuration and needs.

Only User Roles

Default Setup

Direct role assignment

All roles are assigned directly to users. These roles are managed in one place, and users receive access across the organization or the account depending on the role. 

  • Simpler management for smaller teams

  • Ability to see all users assigned to a role

In this setup, granular access control is available for Pega Cloud roles, and these roles can be assigned to individual users at the route-to-live level, limiting their permissions to these specific environments.

A person sitting at their desk using a computer
Roles & Access Teams (Coming Fall 2026)

Optional Setup

Team-scoped access

Support and Pega Cloud roles can now be assigned within Access Teams, each team is associated with one or more Routes-To-Live (RTLs), allowing access and notifications to be scoped to specific environments.

  • Role, permissions, and notifications are limited to specific RTLs

  • Team Admins manage access for their own teams

  • Support and Pega Cloud roles are not applied to the entire account

Important: Access Teams do not introduce new roles. They change where certain roles are assigned.

4 people sitting at a table working together

Roles & Permissions

Roles & permissions explained

Roles at Pega fall into three main levels.
Understanding these levels helps you know what each role controls and where it applies.

Organization-level

These roles are applied broadly across your organization and are not affected by accounts or Access Teams. These roles typically support global administration, training, and partner management.

This role is designed for client-side users who are responsible for managing administrative access and key operational capabilities across their organization’s relationship with Pega.

Provides access to Who can assign this role
My Support Portal
My Pega Cloud
My Pega Success Console
 		Originally assigned by Pega, then Client Admins can assign this role other users

This role is intended for Pega Partnership Leads. This role allows leaders to view their Pega partnership and cross-organization activity within My Pega, apply for and manage Program Distinctions, view Deal Registrations across the organization, register and edit Delivery Projects, assign Pega Academy training, and Manage User access for Partner resources. 

Provides access to Who can assign this role
My Pega Partner Tools
My Support Portal
 		Originally assigned by Pega Support, then Client Admins can assign other users

Your company's Organizational Governance Admin has access to control branding, sharing, and data residency settings for your organization as well as view reports of Blueprints created by anyone within your organization

Provides access to Who can assign this role
My Pega

Users with this role can assign and track progress of Pega Academy training to individuals in their organization. 

Provides access to Who can assign this role
Training Admin Portal
Global Client Admin
Global Partner Admin

Users with this role have drill-down access in My Pega to view training and skill achievement data for other users within their organization. 

Provides access to Who can assign this role
My Pega (Enablement Drilldown)
Global Client Admin
Global Partner Admin

This role is for Partner Delivery Leads. It provides the user access to create, view, and edit Partner Delivery Projects in My Pega. 

Provides access to Who can assign this role
My Pega Partner Tools
Global Client Admin

This role is for users who need to be aware of Delivery Project statuses but are not responsible for editing in-flight projects. It provides the user access to View Partner Delivery Projects in My Pega. 

Provides access to Who can assign this role
My Pega Partner Tools
Global Client Admin
Account-level

These roles apply across an entire account. Larger organizations may have multiple accounts with Pega and these roles are limited to those accounts.  

The Support Administrator role provides the ability to add or remove support contacts and assign roles for any user within the account. Additionally, Support Admins can create/remove Access Teams and add/remove Team Administrators to those Access Teams. 

Note: This role will be renamed to Account Administrator this fall. 

Provides access to Who can assign this role
My Support Portal
My Pega Cloud
My Pega
 My Pega Features: Success Console (Elevated access) Manage Users 		This role is initially assigned by Pega after a user completes this form and forwards it to [email protected]. After this, Account Admins can assign this role to other users
Also assigned by Global Client Admin

The user roles that Account Administrators  can assign,  varies depending on whether the Pegasystems support account is qualified as an on-premises Pega product account, a Client-Managed Cloud account, or a Pega Cloud® services account.

We recommend you have multiple users assigned to this role for contingency. 

As an Account Administrator, you should review and update the user roles for your Pegasystems account:

  • At least quarterly
  • When you renew your support contract
  • When personnel changes occur

Be sure to remove users who are no longer support contacts.

This role inherits all permissions from General Support User

The General Support Access role grants the user permission to create, view, update, and subscribe to support tickets, download Pega software, download Security related hotfixes, and monitor the performance and health of applications, for both on-premises and cloud environments.

Provides access to Who can assign this role
My Support Portal (MSP)
My Pega
Predictive Diagnostic Cloud (PDC)
 My Pega Features: Success Console (Support access) My Software (order and download on-premise software) My Security Hotfixes (download Security related hotfixes)
Global Client Admin
Global Partner Admin
Account Admin

The Security Contact role designates the user as an official security contact for the account. Senior managers or similar authorities should be assigned this role. You must have at least one Security Contact assigned to your account at all times.

Provides access to Who can assign this role
My Pega Cloud
My Support Portal
PDC
My Pega
Global Client Admin
Global Partner Admin
Account Admin
If your systems are on-premise

This role receives periodic security alerts from Pegasystems.
If your systems are on Pega Cloud

This role includes all responsibilities described in the on-premise section. By default, this person is also responsible for approving Cloud Change (CC) requests for cloud systems and managing inbound allow lists in My Pega Cloud. Some Cloud Change (CC) request types require written approval from the client’s security team. For more information, see the Change Management process.
This role inherits all permissions from General Support Access

Users with this role receive notifications on Pega-generated incidents that indicate, to Pega, a potential or actual degradation of service to the Account or Access Team(s) that these users belong to. Since these alerts are informational, you do not need to take any immediate actions. We share these alerts as part of Pega’s commitment to proactive and transparent communication. 

This contact must be configured with a telephone number and email address to facilitate contact.

 

Provides access to Who can assign this role
My Support Portal
PDC
My Pega
Global Client Admin
Global Partner Admin
Account Admin

The Proactive Incident Contact receives system status alerts for the following situations:

  • Incidents detected during routine environment monitoring - Pega identified incidents.
  • Cloud system status messages from Pegasystems - Cloud Support needing urgent attention from the client.

Proactive Incident Contacts receive notifications from Pega for both product and cloud incidents. They can unsubscribe from communications by setting their Notification Preferences, as described in My Support Portal Frequently Asked Questions, Communicating on tickets.

This role inherits all permissions from General Support Access

The Cloud Operations Specialist is responsible for creating Cloud Change requests (CC), Cloud Assistance requests (SR), downloading log files, and waking environments that are in a hibernated state. 

Provides access to Who can assign this role
My Support Portal (MSP)
My Pega Cloud (MPC)
Predictive Diagnostic Cloud (PDC)
Global Client Admin
Global Partner Admin
Account Admin
This role inherits all permissions from General Support Access

The Cloud Deployment Specialist has the same rights as the Cloud Operations Specialist. In addition, in My Pega Cloud they are responsible for approving activities in the Action Center and restarting environments. For clients on Pega Cloud 3 there is the additional ability to reschedule maintenance tasks.

Cloud Deployment Specialists also have access to Deployment Manager to start an assignment and complete assigned tasks, view pipeline and access manage keys.

Provides access to Who can assign this role
Deployment Manager
My Support Portal (MSP)
My Pega Cloud (MPC)
Predictive Diagnostic Cloud (PDC)
Global Client Admin
Global Partner Admin
Account Admin
This role inherits all permissions from General Support Access

This role provides users with secure, read-only access to invoices associated with their organization. It is designed for individuals who need visibility into billing and financial records without the ability to modify or manage invoice data 

Provides access to Who can assign this role
My Pega
 My Pega Features: Success Console (Invoices access) My Invoices page 		Only assigned by your Pega Accounts Receivable Representative. This role must be requested, it is not automatically assigned.

Note: If your account uses Access Teams, Pega Cloud and Support roles must be assigned through an Access Team. To grant these roles account‑level access, users must be added to the Pega Cloud or Non‑Pega Cloud Account Access Teams.
Access Team-level (Coming Fall 2026)

When Access Teams are enabled, many support and Pega Cloud roles can be assigned within Access Teams. These roles apply only to the RTLs associated with the team.

The Access Team Administrator can manage users and role assignments within the Access Team they administer.

To be made a Team Administrator, the user must first have a role on the team they want to be the admin of. If a user is removed from all roles on the team, they will also be removed as the Team Administrator. 

Provides access to Who can assign this role
My Pega
 My Pega Features: Access Teams
Global Client Admin
Account Admin

The General Support Access role grants the user permission to create, view, update, and subscribe to support tickets, download Pega software, download Security related hotfixes, and monitor the performance and health of applications, for both on-premises and cloud environments.

Provides access to Who can assign this role
My Support Portal (MSP)
My Pega
Predictive Diagnostic Cloud (PDC)
 My Pega Features: Success Console (Support access) My Software (order and download on-premise software) My Security Hotfixes (download Security related hotfixes)
Global Client Admin
Global Partner Admin
Account Admin
Team Admin

The Security Contact role designates the user as an official security contact for the account. Senior managers or similar authorities should be assigned this role. You must have at least one Security Contact assigned to your account at all times.

Provides access to Who can assign this role
My Pega Cloud
My Support Portal
PDC
My Pega
Global Client Admin
Global Partner Admin
Account Admin
Team Admin
If your systems are on-premise

This role receives periodic security alerts from Pegasystems.
If your systems are on Pega Cloud

This role includes all responsibilities described in the on-premise section. By default, this person is also responsible for approving Cloud Change (CC) requests for cloud systems and managing inbound allow lists in My Pega Cloud. Some Cloud Change (CC) request types require written approval from the client’s security team. For more information, see the Change Management process.
This role inherits all permissions from General Support Access

Users with this role receive notifications on Pega-generated incidents that indicate, to Pega, a potential or actual degradation of service to the Account or Access Team(s) that these users belong to. Since these alerts are informational, you do not need to take any immediate actions. We share these alerts as part of Pega’s commitment to proactive and transparent communication. 

This contact must be configured with a telephone number and email address to facilitate contact.

 

Provides access to Who can assign this role
My Support Portal
PDC
My Pega
Global Client Admin
Global Partner Admin
Account Admin
Team Admin

The Proactive Incident Contact receives system status alerts for the following situations:

  • Incidents detected during routine environment monitoring - Pega identified incidents.
  • Cloud system status messages from Pegasystems - Cloud Support needing urgent attention from the client.

Proactive Incident Contacts receive notifications from Pega for both product and cloud incidents. They can unsubscribe from communications by setting their Notification Preferences, as described in My Support Portal Frequently Asked Questions, Communicating on tickets.

This role inherits all permissions from General Support Access

The Cloud Operations Specialist is responsible for creating Cloud Change requests (CC), Cloud Assistance requests (SR), downloading log files, and waking environments that are in a hibernated state. 

Provides access to Who can assign this role
My Support Portal (MSP)
My Pega Cloud (MPC)
Predictive Diagnostic Cloud (PDC)
Global Client Admin
Global Partner Admin
Account Admin
Team Admin
This role inherits all permissions from General Support Access

The Cloud Deployment Specialist has the same rights as the Cloud Operations Specialist. In addition, in My Pega Cloud they are responsible for approving activities in the Action Center and restarting environments. For clients on Pega Cloud 3 there is the additional ability to reschedule maintenance tasks.

Cloud Deployment Specialists also have access to Deployment Manager to start an assignment and complete assigned tasks, view pipeline and access manage keys.

Provides access to Who can assign this role
Deployment Manager
My Support Portal (MSP)
My Pega Cloud (MPC)
Predictive Diagnostic Cloud (PDC)
Global Client Admin
Global Partner Admin
Account Admin
Team Admin
This role inherits all permissions from General Support Access

Deep Dive

Understanding Access Teams

Access Teams are an optional feature available to accounts with one or more Pega Cloud Routes-To-Live.

  • Activating Access Teams is easy with our automated setup tool

  • Assign teams to the routes-to-live they work on

  • Delegate team management with the new Team Administrator role

What changes when you use Access Teams

  • Support and Pega Cloud roles are moved and can only be assigned with Access Teams

  • Access can be limited to specific routes-to-live (RTLs)

  • A new Team Administrator role manages who has access to specific teams

What does not change

  • All currently available roles still exist

  • Training, finance, and partner roles stay at the organization or account level

  • Users can still be managed without the use of Access Teams

Let's clear things up

Access Teams FAQ

Access Teams are completely optional and are built to support more complex organizations where more granular access control is required. You may not need Access Teams if all of your users work on and should have access to the same Pega environments. 

While custom Access Teams can be configured and limited to fit your team's structure, an Account Access Team will have access to all the routes-to-live within a certain account. This provides dynamic access for those users who should have their role applied to any routes-to-live that both exist today, or may exist in the future. 


There is a Pega Cloud Account Access Team, providing access to all Pega Cloud routes-to-live and a Non-Pega Cloud Account Access team for our users who host their Pega applications elsewhere. 


Note: These teams cannot be renamed or deleted. 

Your Pega Cloud RTLs will be available to be assigned to your custom Access Teams. Any RTL that is not on Pega Cloud, will be a part of the Non-Pega Cloud Account Access Team. When you add someone to the Non-Pega Cloud Account Access Team, the limitation is that you will not be able to select specific RTLs that those users will have access to, that ability is only available for Pega Cloud Access Teams.

The creation of Access Teams is limited to Global Client Administrators and Support Administrators. Team admins can only add or remove users from existing teams. Support Administrators will be renamed to Account Administrators this fall when Access Teams goes live. 

Short answer - yes. A user can belong to multiple teams at the same time.


For example, a user might be:


Added to an Access Team that provides access to a specific route‑to‑live, and Added to an Account Team, which has access to everything in the account.

How permissions work when teams overlap
When a user is part of multiple teams, their access is based on the most permissive level of access they receive from any of those teams.


This means:

If one team gives the user limited access (for example, production only for a specific RTL), and An Account Team gives broader access (for example, all environments for all RTLs in that account),

the user will receive the broader access.


In short, users never lose access because they’re in multiple teams—the system always grants them the highest level of access available across all the teams they belong to.

Not necessarily. Access Teams are enabled at the account level, not the organization level.


If your organization has one account, enabling Access Teams will apply to the entire organization. If your organization has multiple accounts, you can choose to enable Access Teams for some accounts and not others.
abstract background shapes

System Access

System access overview

Roles unlock access to different management capabilities at Pega.
Here's what each system allows and how Access Teams affect scope.

My Support Portal (MSP)

My Support Portal (MSP)

My Support Portal is the hub for users at an organization to submit support tickets with Pega. However, not everyone at an organization has the ability to submit or even view these tickets. A role is required to gain access. Learn how to create a support ticket. 

  • Roles that allow access:

    General Support Access View & create support tickets
    Support Administrator View & create support tickets
    Security Contact Receives notifications for security issues. Approves Cloud Change (CC) requests (Pega Cloud customers only)
    Proactive Incident Contact Recieves notifications from Pega if an incident has been raised on your behalf proactively.
    Cloud Operations Specialist Creates cloud change tickets
    Cloud Deployment Specialist Creates cloud change tickets
    All Support roles include General Support Access permissions.

  • Impacted by Access Teams:

    Access to MSP is limited to the RTLs associated with the Access Team. Users can create and view cases only for those environments. 

    Note: Account Administrators will always have access to all tickets for the account, they are not limited by Access Teams. 
Pega Diagnostic Center (PDC)

Pega Diagnostic Center (PDC)

Pega Diagnostic Center (PDC) is an application telemetry service that monitors your applications at run-time and gathers performance, quality, and diagnostic data for Pega Platform™ applications and components. 

  • Roles that allow access:

    General Support Access PDC Basic User Permissions
    Support Administrator PDC Admin User Permissions
    Security Contact PDC Admin User Permissions
    Proactive Incident Contact PDC Advanced User Permissions
    Cloud Operations Specialist PDC Advanced User Permissions
    Cloud Deployment Specialist PDC Advanced User Permissions

    Understand PDC User Permission Types (Admin, Advanced, and Basic)

    Access to PDC allows users to monitor application health, review alerts and performance data, and collaborate with Pega on operational issues.

  • Impacted by Access Teams:

    User's will be able to see and monitor the routes-to-live associated to the team that they are a part of. Within those teams, users can be limited to specific environment types (Production-only, Non-production only, and All environments). 
My Pega

My Pega

My Pega is the central place for organizations to manage their relationship with Pega such as assigning roles and permissions, to viewing invoices. All users at an organization have a basic level of access to My Pega. However access to specific features and data is limited to specific roles (defined below). 

  • Roles that allow elevated access:

    Global Client Administrator Full access to the Success Console Full access to Manage Users & Access Teams
    Organizational Governance Admin Access to Organization Settings (Update organization branding & Blueprint settings) Access to Blueprint Reporting on the Success Console
    Support Administrator Limited access to Manage Users & Access Teams (Limited to their account) Access to Support & Key Contacts widget on the Success Console
    Team Administrator (New) Limited access to Manage Users & Access Teams (Limited to their team)
    Enablement Manager Full access My Org (Training Information)
    Project Tracking Manager Full access to Partner Projects (create & edit Partner projects)
    Project Tracking Manager Read-only access to Partner Projects
    Invoice Viewer Access to My Invoices Access to Invoices widget on the Success Console
    General Support Access Access to Support widget on the Success Console Access to My Software to order and download Pega software Access to My Security Hotfixes to download Security related hotfixes

  • Impacted by Access Teams:

    The My Pega Success Console will have Support and Cloud information limited to the RTLs that a user's team is assigned to. 
My Pega Cloud

My Pega Cloud

My Pega Cloud is the centralized starting point for your Pega Cloud journey. It provides a unified portal where you can manage all your cloud environments in one place. Users require specific roles to be able to access this portal. 

  • Roles that allow access:

    Security Contacts Manage inbound allow lists & view all environments
    Cloud Operations Specialist View all environments, download log files, and wake environments
    Cloud Deployment Specialist View all environments, download log files, approve action center activities, wake and restart environments

  • Impacted by Access Teams:

    When Access Teams are enabled, the routes-to-live that a user can see (and perform actions on) are limited to the RTLs associated with the teams they are a part of. 
Deployment Manager

Deployment Manager

Deployment Manager service is a Pega-provided tool to automate testing and deployment of changes to client applications built on Pega Infinity™.

  • Roles that allow access:

    Cloud Deployment Specialist Create and access all pipelines and configurations as well as perform administrative tasks (such as restarts, template management, etc.) across the account. This user is also responsible for assigning or delegating additional Deployment Manager-specific roles to users of their organization.

  • Impacted by Access Teams:

    When Access Teams are enabled, the routes-to-live that a user can see (and perform actions on) are limited to the RTLs associated with the teams they are a part of. 
Training Admin Portal

Training Admin Portal

The Pega Training Admin Portal is a specialized tool for organizations to assign Pega Academy missions, create private training events, and track employee progress.

  • Roles that allow access:

    Training Administrator Create and track training assignments for users of your organization.

  • Not Impacted by Access Teams

Additional resources for Admins

Partner Roles

Partner Role Self-Service Guide
Read more about self-service options you have as a user with a Partner role

How to create an Access Team

Before you start

Decide who will manage Access Teams. These users will be able to add or remove members as the teams evolve. These will be your Team Administrators.


Enable Access Teams

Turn on Access Teams for your account. When enabled, the system automatically creates initial Access Teams based on existing access and assignments. Note: You can only enable Access Teams if your organization has at least 1 Pega Cloud route-to-live.

Review Automatically Created Teams

Review the default Access Teams that were created for you. Teams have been created based on your existing setup.
Note: after switching to access teams, some users visibility may be more limited than previously configured.

Adjust Teams to Match Your Organization

Edit the default teams so they reflect how your teams actually operate: Rename teams Combine teams Remove teams you don’t need

Create Additional Access Teams (Optional)

If you need more teams, add custom Access Teams for different groups or responsibilities.
Note: Each route-to-live can belong to only one Access Team, so if all RTLs have been assigned to a team, you will not be able to create a new team. Each team requires you to select a name and at least 1 Pega Cloud route-to-live to associate the permissions of the team to.

Assign Team Administrators

Designate one or more team admins who can manage users and roles within the Access Team. By default, Account Admins have the ability to administer all Access Teams for their account. But you may assign Team Admins to have limited administrative control over who is a part of that specific team.

Add Users and Assign Roles

Add users to the Access Team and assign roles based on their responsibilities.

Set Environment Access (If Applicable)

For roles that support granular environment selection, such as Pega Cloud-specific roles, specify whether users have: Production access Non‑production access Access to all environments

Maintain Access Over Time

Periodically review Access Teams to keep them aligned with organizational or staffing changes. If we suspect someone with an assigned role has left your organization, we will notifiy you on the Success Console or through the Manage Users page. Make sure you have active users assigned to every role within a team.

Which Role is Right for You?

Comparing Pega Cloud Roles

All 3 Pega Cloud-specific roles, have access to Pega Diagnostic Center (PDC) to monitor the performance and health of your applications.

The table below provides an overview of the breakdown in responsibilities for these roles in My Pega (MP), My Support Portal (MSP), My Pega Cloud (MPC) and Deployment Manager (DM) to help you decide which role is the right one for you. 

Tool Permissions Cloud Deployment Specialist Cloud Operations Specialist Proactive Incident Contact Security Contact
MP Download software and security hotfixes (only if General Support Access role is also configured for the user) Yes Yes Yes Yes
MSP View all support tickets Yes Yes Yes Yes
MSP Create incidents, issues, and cloud assistance cases Yes Yes Yes Yes
MSP Create cloud change cases Yes Yes No No
MSP Receive notifications from Pega, for Pega generated incidents No No Yes No
MSP Can approve cloud changes for production No No No Yes
MPC View all environments/projects, upgrade journey, maintenance etc. (My Environments, Message Center) Yes Yes No Yes
MPC Can download logs Yes Yes No No
MPC Action Center Approval Read Only No Read Only
MPC Can Restart Environments (Immediate & Schedule) Yes No No No
MPC Can Wake up Environments Yes Yes No No
MPC Reschedule Maintenance Tasks (Pega Cloud v3 only) Yes No No No
MPC Managing inbound allow lists i.e. add and remove IP addresses (Pega Cloud v3 only) No No No Yes

See Managing inbound allow lists
DM User can start a deployment and complete assigned tasks. User can resolve deployments and tasks that need attention. Yes No No No
DM View the pipeline and status with no access to perform a task. Yes No No No
DM Access to manage keys, pipelines, and deployments. Yes No No No
Important: You must always have at least one Cloud Operations Specialist, one Cloud Deployment Specialist and one Proactive Incident Contact assigned to your Pega Cloud service account. If you have multiple routes-to-live, you may require one or more users assigned to each role for each route-to-live.
  • Select individuals with the appropriate expertise and judgment to serve in these significant roles.
  • The Cloud Operation Specialist and Cloud Deployment Specialist must work with the Security Contact for your Pega Cloud service account. See Cloud Change Approval process for details.
  • The Cloud Deployment Specialist has access to My Pega Cloud to manage cloud environments as explained in Administering your Pega Cloud service. The Cloud Operations Specialist has limited My Pega Cloud access.

Understading Access Teams vs Granular Access

Pega offers two ways to manage restricted access for supported roles:

Granular Access: Available only for Pega Cloud roles, Granular Access is assigned at the individual user level when a user is added to a role. You can limit access by account, route-to-live, and environment (Production only, Non-production only, or All environments). This applies to My Support Portal (MSP) and My Pega Cloud (MPC).

Access Teams: Access is managed for a group of users. You assign routes-to-live at the team level, and users receive roles within that team’s scope. For Pega Cloud roles, you can still apply environment-level access for each user. Access Teams apply across MSP, MPC, Deployment Manager, and My Pega, and support both Pega Cloud and Support roles.

Recommended: For most organizations, Access Teams are the simpler and more scalable way to manage access and notifications.

Please note: Each account can use only one access model: Granular Access or Access Teams.

After you move to Access Teams, you cannot switch back to Granular Access. However, Access Teams provide the same security configuration capabilities, so you do not lose access control flexibility.

Administering User Roles

Manage user access, assign roles, and maintain support contacts for your organization directly in My Pega. Support Administrators can add users, update permissions, review access, and remove users as needed.

Access Manage Users

Open Manage Users

Sign into My Pega Navigate to User Management > Manage Users If you have access to multiple accounts, you will be prompted to select the account that you would like to manage

Alternatively, if you are already in My Support Portal you can access Manage Users from the home page menu, and you’ll be directed to My Pega from there.

Open Manage Users

From the Manage Users page you can:

Task Description
Add Users Grant access to Pega support and self-service resources
Assign Roles Give users the appropriate permissions
Update Roles Modify permissions when responsibilities change
Remove Users Revoke access when no longer needed
Review Access Audit users and role assignments. You may search for specific users or export lists of users to a Microsoft Excel spreadsheet, by role.
View Profiles See user activity and account details

View the History of Your Changes

Select the History tab to view an audit history of your actions.

Select the account to view and the details of all transactions for the account will be displayed. Use the filter available on each column to focus your results. For example, for actions carried out on a specific user, or by a specific administrator. You can Export the table displayed to Excel.
Add Users & Assign Roles

Add Users to Roles

In Manage Users, select the role you wish to add a user to on the left Click the " Add User" button For the user(s) you wish to add either by name or email address. Here you can identify users outside your organization, for example, Pega resources or partners. The users must be have registered Pega accounts to appear in this list. The user(s) found are displayed in a list. You can select one or more users to add to the role. If needed, you must select the appropriate account for each user added. Click the Finish and Add Users button to complete the action.

Assigning roles works similarly inside of Access Teams where each team has roles on the left that you can select and add users to. Be sure to only assign roles required for the user's responsibilities. Role assignments determine access across Pega systems and support resources.

User Notifications

New users are sent an email message welcoming them to Pega when you have added them to your organization. The email will identify you as the Account Administrator who affiliated them to the account and provide a brief overview of the roles they have been assigned. It also provides useful links to Support Self-service resources.

Users are also notified when a new role is assigned to them. 

Who can assign roles?

To assign roles to users in your organization, you need to have the Global Client Administrator, Account Administrator, or Team Administrator role. 

Need help choosing a role? Roles & permissions explained section of this page
Review & Audit Access

Review Users

Use Manage Users to review:

All users assigned to your account Current role assignments Invalid or unreachable email addresses (highlighted via the bounceback status) Overall access coverage for your organization

You can search for specific users and filter users by role.

Edit a user's roles

Search for a user using the search bar at the top of the screen. Select the user you want to edit the roles for by selecting thier name. Bulk-select the roles you want to add or remove from this user. If required, select the account you wish to apply this role to. Be sure to save your changes to update the user's access.

You can search for specific users and filter users by role.

Export User Lists

To make auditing your users easier, administrators can export user information to Excel. Administrators can export users by role. 

Recommended Review Cadence

To keep your account up to date and secure, we recommend reviewing your user access:

Regularly throughout the year Whenever personnel changes occur During support contract renewals Before granting new administrative privileges

Remove users who no longer require access.
Removing Users

When to remove users

Be sure to remove users when they:

Change responsibilities Leave the organization No longer require access

You can search for specific users and filter users by role.

Removing users from roles

When removing a role from a user, you have 2 options available:

Remove role(s) from an individual user

Select a role in the User roles section. For example, Security Contact. In the adjacent column, either select a user from the list displayed or search for a user with this role via the search box. Select the relevant user from the results of the search. From the list of users, click the ellipses icon next to the relevant users and select Remove from role

Remove a role from multiple users in bulk

Select a role in the User roles section. For example, Security Contact. A list of existing users with the selected role is displayed. Click the check box against the users you wish to manage. The Bulk Actions link is displayed at the top of the list, with an indication of the number of users selected. From the Bulk Actions link select Remove users from role

Impact of removing a user

When removing a user, consider whether the user is a primary contact, an additional contact added to a support ticket, or a follower of the ticket.

Their name no longer appears as primary contact for the case, whether the case is open or closed. They no longer see previous Pulse notes in their Pulse feed. They no longer receive new Pulse noted for the case. They no longer receive Pulse email notifications for the case. For open cases, the system automatically replaces the primary contact with the account administrator, wherever the primary contact is removed.

If this is not the appropriate person to work with support resources on the case, you should change this to another resource. You can do this by editing the client contact details on the case.

Their name no longer appears as additional contact for the case, whether the case is open or closed. They no longer see previous Pulse notes in their Pulse feed. They no longer receive new Pulse noted for the case. They no longer receive Pulse email notifications for the case.
They are immediately removed as a follower on the case, whether the case is open or closed. They no longer see previous Pulse notes in their Pulse feed. They no longer receive new Pulse noted for the case. They no longer receive Pulse email notifications for the case.

Before Removing Access

Confirm:

The user no longer requires access Responsibilities have been transferred as needed Another administrator can perform any ongoing administrative duties

Each role should have at least 2 users assigned to it

To ensure business continuity, it is crucial that you have multiple users assigned to each of your roles to make sure responsibilties are covered in the event someone leaves your organization.

View Permissions for an Individual User

Viewing an individual's access

Clicking on a user's name anywhere within the Manage Users experience (either by searching for a user on the top of the page, or by selecting a user from the roles area) will open their User Record. The user record shows all roles that they have been assigned and the Access Teams that they are a part of. You can search for individual users in your organization or look at the users assigned to roles within an account. 

This information can help determine whether users have the access they need or still require a specific role. 

We'd prefer it if you saw us at our best.

Pega Community has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice