Each object and user of the platform is linked to a geographical and organizational unit. These units allow a hierarchical structure to be defined in order to give users a filtered view. A user's unit defines their access level for different platform objects.
If a user is not linked to any unit, that user will not be able to connect to Adobe Campaign. If you would like to restrict access for a particular user or group of users, do not link it to the All unit.
A user has read-only access to all of the objects in the parent units. He has read and write access to all objects of his unit and child units. A user does not have access to objects in parallel branches.
When the user is assigned geographical and organizational units, these units will always be applied to the objects the user created.
If we take a user linked to the NAM geographical unit (North America). This user has read-only access to objects linked to the Americas and ALL units. He also has read and write access to the objects linked to his unit and child units: NAM, Canada, US, and Mexico. The user does not have access to other branches in the hierarchy (LATAM, EMEA, APAC).
When a user is in several groups linked to different units, certain rules are applied. For more information, refer to the Managing groups and users section.
Note that new Campaign Standard instances, as well as existing instances with no geographical units created, cannot have the geographical unit capability implemented starting 18.7 release.
Geographical and organizational units allow you to filter your tenant depending on the country or organization your users are linked to.
Here, we previously created security groups with different roles to two users: one user is assigned the security groups Administrators and Europe, the other user belongs to the security groups Standard user and France. See Creating a security group and assigning users for the full example.
We now need to create the geographical and organizational units for the France and Europe security groups:
To see the impact of assigning different units to different security group, the user assigned to the Administrator and Europe groups will create two email templates to see what the other user assigned to Standard User and France can or cannot access.
The user assigned to the Standard User and France groups will be able to see both templates. Because of the hierarchical structure of the geographical units, he will have read and write access to the template linked to the France unit and only read-only access to the template linked to the Europe unit.
Since the France unit is a child unit of Europe, the following message appears when the user tries to modify the Europe template:
Geographical and organizational units can restrict the access to different products such as profiles. For example, if our France user access the Profiles tab, he will be able to fully access and modify the profiles with the France geographical unit.
Whereas the profiles with the Europe geographical unit will be read only, the following error will appear if our user tries to modify one profile: You do not have the rights needed to modify the 'profile' resource of ID.
If your organization needs to isolate the profiles contacted by each of your different brands, you can partition your profiles by their organizational or geographical units.
By default, the organizational or geographical unit fields are not available on your profiles and need to be added.
We recommend adding this option before importing any profiles. If you have already imported your customer database, an update is necessary in order to set the organizational and geographical unit values on the already imported Profiles.
The organizational and geographical unit fields are added to your profiles in the Access authorization section.
In this example, we want to add new profiles but also update existing ones and reconcile their countries with the corresponding geographical units in Adobe Campaign.
To do so, we will import in a Load file activity, a file containing new or existing profiles with the following information: first name, last name, email, country and birthdate. The profiles will then be added or updated with the Update data activity.
This example assumes that all needed geographical units are already configured in Adobe Campaign. Note that new Campaign Standard instances, as well as existing instances with no geographical units created, cannot have the geographical unit capability implemented starting 18.7 release.
Here, in the imported file, four profiles are detailed: two new profiles and two existing ones which will be updated with their respective geographical units.
The new profiles have been added with geographical units corresponding to their countries and existing profiles have been updated with the corresponding geographical units.