This documentation supports the 18.08 version of BMC Atrium Core.

To view the latest version, select the version from the Product version menu.

Roles and permissions

You can assign users to groups and roles in the AR server to control users' access to the application based on the tasks they need to perform. If you are creating custom groups and roles and not using the default groups created when installing AR, the overall process of providing access has the following basic steps:

The process does not include the first step if you are using groups and roles that were automatically created during installation. 

Groups are permissions specific to a server while roles are used exclusively in applications. You must map a role to a group based on the level of access you wish to provide to that group.


A user is any person to whom you give permission to access BMC CMDB. Users can be members of multiple groups or no group at all. Users in BMC CMDB range from an administrator who maintains the entire system to employees who only view data.


Groups are collections of BMC AR System users who are given access to perform specific tasks. Groups are specific to a server. A group has access to an object, a field, or a request, and any user added to that group inherits the same access. You can map a role to a group. You can also designate an entire group to be notified of a certain action. Installation of BMC AR System automatically creates some default groups and you can also define additional custom groups.

BMC AR System includes a public group and eight other special groups that are essential for access control within the system. You can define additional groups based on a common profile and assign access. For example, you might create a Sales group and allow members to view the status of a request but not to change it. A group can also be a general category, such as Browsers. 


Roles are permissions like groups, except that they belong to a particular application, instead of a particular server. Roles are used exclusively in deployable applications. Installation of applications such as ITSM automatically creates roles that you can later map to specific groups. You can also define roles when you need them.

You can map roles to different groups on different servers, depending on how the groups are defined on each server. This enables you to develop and test the application on one server and deploy it to many other servers without having to redefine permissions on each server. You can also map roles to different groups for each development state, such as testing or production.

Related topics

AR System: Creating users, groups, and roles Open link

AR System: Regular, computed, and dynamic groups Open link

AR System: Access control Open link

Adding support staff in ITSM Open link

Providing users with permissions to access the new CMDB UI using groups and roles

Was this page helpful? Yes No Submitting... Thank you


  1. Jan Sierens

    "You must map a role to a group based on the level of access you wish to provide to that role." should be "You must map a role to a group based on the level of access you wish to provide to that group"?

    Feb 19, 2019 06:56
  2. Jan Sierens

    In previous (pre 9.1.4) there was a section: "BMC Atrium Core permission roles within applications". Why was this deleted?

    Feb 19, 2019 08:02
    1. Maithili Deshpande

      Hi Jan, 

      Thank you for your comments. Will check with the SME and respond at the earliest!



      Feb 20, 2019 05:49
    1. Maithili Deshpande

      Hi Jan,

      I have fixed the link as suggested. Regarding the section "BMC Atrium Core permission roles within applications", we are revising the content and it should be available soon. In case you are looking for anything specific from that section, please let me know.

      Thank you!



      Feb 22, 2019 02:53