Users and Groups on Brand Portal

AEM Brand Portal, being an Experience cloud product, gets its users and groups created and managed through Admin Console.

1. Once an organization is provisioned on AEM Brand portal, the administrator can create product profiles under product AEM Brand Portal. These product profiles are user to segregate users. AEM Brand portal reads these product profiles as Groups in Brand Portal. 
   Q. How and when these profiles get created on Brand Portal?
   A. Once the administrator creates product profiles in Admin Console, AEM Brand portal reads them using a sync job every 8 hours. So AEM Brand portal syncs any changes done in Admin Console to Brand portal's system every 8 hours. A Product Profile created in Admin Console will be visible in Brand portal latest by 8 hours under Tools→Users → Groups.
2. To on board Users, administrator can configure federated ID which uses organization's SSO and identity management for authentication. In this case, Admin console authenticates users using organization's identity management system and doesn't require to register/enroll every user for AdobeID. One can achieve this using https://helpx.adobe.com/enterprise/using/set-up-identity.html.
3. If the organization wants its users to use Adobe's authentication then they can use AdobeID. In this case, every users to whom the organization's administrator wants to give access should have a valid AdobeID. The administrator can then add the user to any one of the product profile he has created as mentioned above in point#1.
   Q. in what cases the users doesn't need to belong to a product profile, yet can access brand portal.
   A. If administrator adds a user with a system administrator privilege he doesn't need to add this user to any product profile. Since this use is system administrator he gets the administrative rights over the organization's every product.
   If administrator adds a user with product administrator of AEM Brand portal product, then also this user doesn't need to belong to a product profile in order to be able to access brand Portal. In all other cases, user can't access Brand Portal until he belongs to any one of the product profile (Group in AEM Brand Portal).
4. User and Group Listing in AEM Brand portal: 
   1. When a valid user (who has access to brand portal product in admin console) logs in to AEM Brand portal url, his user node is created in AEM Brand portal system. Until a user logins to Brand Portal, Brand portal doesn't have any information about this user. Brand portal creates this user in its repository only when the user logins for the first time. so it is quite possible that the user lists n number of users in admin console but Brand Portal lists only n-m users in its user listing because of the same reason.
   2. Groups listing in Brand Portal depends upon the UserGroupSyncJob which runs every 8 hours. This job updates the content on Brand Portal if 
      1. A new product profile is added/deleted from admin console
      2. Any user is added/deleted from any product profile in admin console.
   Q. I have "N" users in admin console, "m" out of the "N" users have logged into Brand Portal at least once but still I see less number of users (<m) in Brand portal's user listing, what might be the reason?
   A. If all the "m" users have logged into Brand portal at least once, then probably the users which are not listing might have been deactivated. refer to user deactivation/activation below. the User listing in brand portal lists only the current active users.
   Q. I have created some product profiles in admin console but those don't show up under groups listing in brand portal?
   A. Please wait for sometime, when the next userGroupSyncJob runs, the product profiles will be synced to AEM Brand portal as Groups. 
5. User Activation/Deactivation in Brand portal :
   1. If  a user is removed from all the product profiles i.e. his access is revoked from the product in admin console, this use is marked inactive when any one of these event is triggered first
      1. the user tries to login to Brand Portal
      2. The userGroupsSyncJob runs
   2. Inactive users though remains in the system but are not listed on users listing in Brand Portal. The same is true for all user personas admins and non-admins.
      1. If a system administrator doesn't have the administrator privilege in adminconsole, and doesn't have a product profile associated also, then he is marked inactive.
      2. A product administrator doesn't have product administrator rights in admin console anymore and doesnt have a product profile associated, then he is marked inactive.
      3. any other user if doesn't have any product profile assigned to him then he is marked inactive in brand portal.
   3. Inactive Users can't login to Brand Portal and see a request access page when they try to login. Using this page, they can submit an access request. this access request shoots an email and a pulse notification to all the administrators of that organization.
   4. To activate the user, administrator of the organization needs to do any one of the following
      1. assign him system administrator rights in admin console
      2. assign him product administrator right for product AEM Brand Portal in adminconsole
      3. assign him to one or more product profiles.
   5. whenever the user logins to Brand portal, the user gets activated again. Once activeuser starts to receive all emails and pulse notifications according to his current user persona.
   6. User count: shown on top of this page is the total number of active users in Brand Portal. so it excludes the users who have not yet logged in to brand portal at least once or are not active. the list below the count displays details of these users.
6. User's Effective Role:
   1. In AEM Brand Portal a User can hold one of the following roles at a time
      
      1. admin : all the capabilities 
      2. editor : no admin tools
      3. viewer : no sharing capability
   2. The effective Role of a user is listed on Tools→ Users→ users tab. Similarly a group also has one of the 2 roles Editor or Viewer.
   3. Role is specific to AEM Brand Portal and doesn't have anything to do with adminconsole. so Role is the upper layer of the persona a user has in admin console. 
   4. Role is applicable to non-admin users only. All admins (system or product) have all capabilities available in Brand portal.
   5. A user gets his role from the group he belongs to, If a user is member of multiple groups he holds the highest role he has in any of those groups.
      1. Example1: user1 has editor role in group1 and has viewer role in group2 so user1's effective role will be editor.
      2. Example2: user1 has viewer role in group1 and has viewer role in group2 so user1's effective role will be viewer.
   6. Changing User's Role: If a User has viewer role, admin can change its role to editor. But if the user has editor role admin can't always change its role to viewer.
   7. If a user is editor in any one of the groups, admin can't change its role to viewerwithout changing the group role to viewer.
   8. User Role change is immediately effective and doesn't depend on the userGroupSyncJob to run.
7. User Roles in collection settings: whenever a user shares a collection further, the effective role of the user always applies and not the role you mention while sharing the collection.
8. Viewer can create collection and hence becomes owner of that collection. But since he doesn't have rights to see what other users are there in his organization hence when he tries to share the collection he created he sees only his email and the groups which he belongs to. So he can share collection with his groups but not with individual members of the organization.
9. Original Download Restriction on Group: If the admin , restricts any group to download original rendition then irrespective of the user's role (editor or viewer) all users belonging to that group won't have access to original renditions of the images.
10. Original download restriction is applied on group level for non-admin users and not on folder basis. 
    1. Example1: admin shares folder1 and folder2 with group1. group1 has restricted access to download originals. Now consider 3 users , user1, user2, user3 all belonging to group1 , the behavior for images in both the folders will be like
       1. user1 : viewer role: can't download original renditions of images in any of the folder. 
       2. user2: editor role: can't download original renditions of images in any of the folder. 
       3. user3: admin : can download original renditions of images in any of the folder, since he is admin.