Feedback on Group Administration capabilities (available in Preview)

[MariamPa]

Hi everyone ! I am the Product Manager for the Workfront team that recently delivered Group Administration capabilities (already available in Sandbox Preview), and I am very keen to hear your feedback on: whether you are planning to use Group Administration features once they are available in Production with 18.1 release (if not, why) what you like and dislike about capabilities given to Group Administrators (currently known as Group Owners) what other permissions you need Group Administrators to possess in the system (please provide some context) whether you intend to decrease the number of Workfront System Administrators, and if the new Group Administrator capabilities will help you with that I am looking forward to receiving your feedback soon. Thanks ! Mariam Paronyan, PMP Product Manager Workfront

[DavidCo3]

Hi Mariam, You asked for feedback even if we don't use the group admin functions. At this point we are not large enough to need to decentralise/delegate our Workfront administration functions. For reference we have around 230 users but it is not too onerous to manage. We already have enough issues with standardising usage that we don't want to open the door to more uncontrolled customisation.:) Regards, David Cornwell

[MariamPa]

Hi David, Thanks for your feedback, and sharing some insight into your Workfront use case. What I would like to note is that Group Administration capabilities have been designed not only for large customers using the same instance of Workfront across multiple departments, but also for those customers wishing to delegate to selected users some administrative functions without actually granting them full System Administrator rights. Let me know if you have any questions. Thanks again ! :) Mariam Paronyan, PMP Product Manager Workfront

[LindsayCa1]

Hi Mariam. This might be helpful to us as we continue to grow. I had question on if there was a limit to the number of administrators you can have. Is it unlimited - they just need to have a plan license? Thanks! Lindsay Carpenter Adecco NA

[MarieKe1]

Mariam, I am glad to see additional Admin functionality being rolled out. Currently it is quite a risk when I provide someone else Admin rights. Like David previously relayed, we are not ready to roll out Group Admins because we already have enough issues with standardization, and don't want to open the door to more. Thanks, Marie Marie Kelly The MetroHealth System

[AnthonyPe]

I think we'll be assigning a few Group Admins at my organization. Having more than one go-to person to recover deleted items and troubleshoot will be helpful. It may also have the side effect (I hope, anyway) of getting more people looking "under the hood" of WF to have a greater knowledge base. We will likely pull some Sys Admins, largely due to the fact that our instance serves multiple agencies under a common umbrella and we need to maintain a firewall with some of our Account teams. Anthony Pernice Healthcare Consultancy Group

[VincentGo]

Hi Mariam, Yes, we are looking forward to using the Group Administrator function. We currently have 3 different departments all co-existing in our instance, and we're looking to onboard more in 2018. We currently have to give full System Administrator access for each person who heads the department to manage their area of Workfront, but we don't like that we have to give them full access to our global Workfront settings. In last week's Roadmap webinar, the speaker vocalized this same problem, and I appreciate that Workfront is looking for ways to reduce the need for a System Admin in each department. The Group Administrator sounds like a great start to helping non-System Admins manage their users and workflow, without exposing the more technical aspects of our instance. I like that the Group Administrator will be able to: Edit custom statuses for their area Create subgroups for their group Add users to groups and subgroups when editing existing ones. Associate users with groups when editing user profiles. Create layout templates Reset passwords Log-in-As users from their group. I personally would like to see the user management go farther and have the Group Admins be able to do the following for their group members: Create job roles for their group's users Create Access Levels for their users Create teams for their users If these features were added, I think we could definitely scale back to just 1-2 System Admins with a lot of Group Admins. Vincent Goodwin The Capital Group Companies

[Kelly_Wehrmann]

Hello, I like the direction that you are taking with Group Admin. However, we really need to see some refinements to this new feature in addition to having a few gaps closed up before we use it. To give you some context with our existing implementation, we have a couple of other departments, outside of our IT Group that are using Workfront to manage their own request queues and projects. These groups also submit requests to our groups and occasionally work on our projects so having everyone in the same instance is helpful. We want to keep Resource Administration centralized in our group with our System Admins due to the nature of some of the custom fields that are heavily relied on for financial reporting for our Accounting Group. So we wouldn't want Group Admins to have access to resources. We would really like Group Admins to have the ability to manage forms that belong to their group, that way they could have the freedom to create new ones or edit existing ones without needing to rely on one of our System Admins to do it. However, we noticed some gaps with this feature that could be a disaster for other Groups. We found that although a Group Admin only has the ability to view/edit forms that belong to their group, there is NO restriction to the fields / sections that they can access/modify. Currently, a Group Admin can alter any field/section, even if it is not included on a form that they own. This gives them full access to hide, add, remove values, even delete fields/sections, that are used exclusively by other groups. There needs to be more security around this before we could allow them to manage their own forms. I would like to see the application: 1) restrict them from editing/deleting any fields/sections that their group doesn't own or originate. 2) allow them to view the full library of fields/sections so they can select to use a field that is already created and not have to duplicate a field/section for their own group if one already exist; but with the understanding that someone else controls/owns it. 3) allow a system admin to restrict modifications to specific fields/sections where they may be in use on forms belonging to more than one group. We would like to be able to control the specific Group Admin features that display on the left menu bar in the Settings tab. For example, We would not want them to have ability to update Scorecards, however, that option displays in the setup. Thanks! Admin Kelly-Wehrmann SSFCU

[MariamPa]

Thanks everyone for the provided feedback ! That's incredibly important to us, and we are excited to know that some of you will be using Group Administration capabilities once released to Production. We also appreciate your ideas on what other permissions Group Administrators should have in order to empower them to administer Workfront for the department they are in charge of. To answer some of questions/concerns: Question from Lindsay Carpenter : Is there a limit to the number of administrators you can have. Is it unlimited - they just need to have a plan license? Answer: there is no limitation on the number of Group Administrators in the system. The idea is that each Group will have at least one Group Administrator (currently known as Group Owner) who will benefit from capabilities available to Group Administrators with 18.1 release, and will take care of some administrative tasks for that Group without possessing System Administrator rights for the whole instance. You are right, only users with a Plan license can be set as a Group Administrator. Feedback from Kelly-Wehrmann: Group Administrators should have restricted permissions to custom forms, custom fields and sections. Answer: Thanks for the detailed feedback. I will conduct some research around this area, and will get back to you asap. Kind Regards, Mariam Paronyan, PMP Product Manager Workfront

[JohnSe1]

The new "Sub Admin" addition as many above stated is an interesting and welcome add. But, as a couple of my peers stated - we need to verify the level of permission on a very specific scope creep. A few concerns I have for my own instance which I believe is quite large: Ability to reset passwords - since we use SAML/SSO this is not needed but could be an issue if the group admin creates a user/password that can bypass SSo. Since we don't force SSO. Which I get is its own unrelated topic. Ability to login as, nice to see they can only login with access equal or lesser than their own. Testing on expose is being done on my side as it relates to finance concerns. To create new custom status levels, in my organization department and company re-orgs occur with semi common frequency. It is hard enough to manage the groups as is. Adding in custom status levels might be a bad idea. WOULD LOVE to have the ability to warden off forms and fields as suggested - that would be the only real feature I'd want to push out on day one. John Seitz ESPN

[MariamPa]

Thanks for the feedback, John ! Please be aware there is a way to prevent Group Administrators from resetting password on behalf of users, and logging as other users . These permissions can be controlled through the new User Admin (Group Users) option available on Access Levels > Edit Users dialogue . For more details please refer to Access Level Setup Options for Group Administrators topic at "https://support.workfront.com/hc/en-us/articles/115004059953-2018-1-Beta-3-Release-Activity"> 2018.1 Beta 3 Release Activity page. We do consider providing more granular controls for permissions granted to Group Administrators. We are just awaiting more feedback from customers. Mariam Paronyan, PMP Product Manager Workfront

[SuzyPa]

Our current WF footprint covers 1 program, 50+ application teams and cross-functional teams, 650 folks which we manage with 2 admins. Our 650 users are peanuts relative to the over 60,000 employees of our corporate organization. We now have 4 organizations outside of our program looking to implement Workfront. We're hoping to use the Group Admin feature to allow designated SMEs at each site to handle some of the customizations for their specific use as well as user and subgroup admin. We want each org to use some standard fields that we've created so that reports can be rolled up across multiple parts of the organization and definitely don't want the group admins monkeying with those fields- that's a bit concerning. I'm hoping to spend some focused time tomorrow investigating it more thoroughly. Suzy Park Partners Healthcare System, Inc.

[pco88]

We would prefer to have this admin by company level than group. Presently, we have 3 departments in our instance and possibly more to come. Each have their own "company" and I don't think anybody wants to give up their full administrator access in exchange for group administrator. As master agreement holder of our instance, we try to corral the administrators under a governance structure but it is difficult to ensure that nobody is stepping on anybody's toes as everyone had paid for their own licenses and technically should be able to use WF as they want/need. Polly Co

[WendyWh]

We are looking to use Group Administration capabilities for the System Admins we are having their license access dropped down. Currently we have too many system admins and need to start limiting access to the configuration. The new Group Administration capabilities will give us an access level that allows these users to help troubleshoot issues without changing configuration settings. I've been testing with the settings in Preview, but I'm not seeing the option for the group admins to log in as another person. Is there a setting that I need to set to allow these users to log in as someone? Thanks! Wendy White AmeriCredit Financial Services, Inc. dba GM Financial

[MariamPa]

Hi Wendy, Can you please make sure that User Admin (Group Users) option is enabled on Edit Users dialogue box on Group Administrator's Access Level? Please refer to the following Help article for more details on User Admin (Group Users) setting: "https://support.workfront.com/hc/en-us/articles/115004059953#access-level-setup-options-for-group-administrators" title="2018.1 Beta 3 Release Activity">2018.1 Beta 3 Release Activity Hope this helps. Will you have more questions, please let me know. Thanks.