I have a requirement where we need to create a Tridion group, let's call it "Limited Production Support", that can only administer users in Tridion. Their activities would be limited to:

  1. adding new users into Tridion
  2. assigning users to existing groups
  3. enabling/disabling users

Can this be achieved without having to grant Administrator privileges, e.g. by creating a special group?

The reason for this requirement is that the Production Support department has some team members who are not so savvy with Tridion and have a record of doing stuff they're not supposed to in Production environments. So we don't want them to "accidentally" mess up existing configurations.

3 Answers 3


Yes - it is possible to do what you want, but not in the way you describe. Assuming that the groups are created/configured by a Tridion system administrator, you can manage all of those things in an external directory using Tridion's LDAP integration functionality. Taking your requirements in turn:

Adding new users

Ensure that Group synchronisation is configured, add your new user to a group that is mapped in Tridion, and the user will be added on first logon.

Assigning users to existing groups

Add the user to a group in the directory (obviously also one with a Tridion mapping)

Enabling/disabling users

As long as all your permissions are granted via an external mapping, then removing all group memberships will effectively disable a user.

Obviously, you'd want to work through your design in detail to check that all your needs are met, but that's it in broad strokes.


Unfortunately this is not possible OOTB. You may need to create a separate UI for user/group management - good candidate for a power tool IMHO.


Apart from @Nuno answer, I want to add one more suggestion.

Create a Core Services Page for Production Support Department which should allow

  • Adding new users
  • Assigning users to existing groups
  • Enabling/disabling users

Restrict this page with a specific user group access, so that no other user can misuse this page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.