ACCESS MANAGEMENT
Understand OpenGround access
Access is assigned at different scopes. Understand the hierarchy before granting roles or project permissions.
OpenGround user and access guides Current article: Access Levels & Roles
| Get ready | Bentley account prerequisites |
| Create users | Create and manage users |
| Access overview | OpenGround access: quick overview |
| Understand access | Access Levels & Roles |
| Assign access | System administrator · System-level access · Project access |
| Protect projects | Manage confidential projects |
OpenGround access is assigned at three scopes. System Administrator access is the broadest; System-level access applies across the environment through selected security groups; Project-level access is assigned for individual projects.
System Administrator access
This is the highest access level and provides unrestricted access to OpenGround functions, controls, and projects. Grant it only to trusted administrators who need organization-wide control. Restrictions cannot be applied to this access level.
Procedure: Assign System Administrator.
System-level access
System-level security groups are assigned to a user independently of a particular project. Their roles apply across the environment. For example, a Project Creator group can provide the Create Project role. Use the smallest set of roles needed for the user's responsibilities.
Procedure: Assign System Level Access.
Project-level access
Project-level groups are assigned for a specific project. A user can have different groups on different projects, for example View on one project and Project Manager on another.
Procedure: Manage Project Access.
Security groups and roles
Security groups bundle individual security roles. System-level and project-level groups can contain different role options. Review group membership before assigning it; OpenGround does not allow deletion of a group that is already assigned to a user.
Permission precedence: Roles assigned through System-level access can override more restrictive Project-level access. For example, a system-level Edit Data role can allow editing even when a project-level group only grants View Data. Review overlapping roles carefully and avoid broader system roles unless they are required.
View your access
Users who are not System Administrators can review their project security groups from the Preferences tab by selecting View Access. The dialog is read-only and lists projects and their associated groups.
If the user can sign in but cannot download Launcher or use a licensed module, contact the Bentley Account Administrator to check download roles and entitlements. See Bentley account prerequisites.