User Management and Roles
The problem: uncontrolled CMS access
Section titled “The problem: uncontrolled CMS access”Every person on your team needs different capabilities. Editors write and publish content. Marketers run experiments. Administrators configure the system. Without clear role assignments, you get one of two bad outcomes: either everyone has full admin rights (risky), or people lack the permissions they need (slow).
Optimizely CMS solves this with a role-based access model. You assign each user a role that matches their responsibilities. The CMS enforces what they can see and do.
How roles work in Optimizely CMS
Section titled “How roles work in Optimizely CMS”A role is a named set of permissions. When you assign a role to a user, that user gains all permissions the role grants. Users can hold multiple roles, and the permissions stack — a user with both Editor and Marketer roles gets the combined permissions of both.
Built-in CMS roles
Section titled “Built-in CMS roles”Optimizely CMS ships with several predefined roles:
| Role | What it can do | Typical user |
|---|---|---|
| CmsAdmins | Full system access — manage users, configure settings, deploy content types | IT administrators, technical leads |
| CmsEditors | Create, edit, and publish content across the content tree | Content editors, copywriters |
| CmsReaders | View content in the CMS editor but not modify anything | Stakeholders, reviewers |
| VisitorGroupAdmins | Create and manage visitor groups for personalization | Marketing leads |
| WebAdmins | Manage site settings, scheduled jobs, and system configuration | Site administrators |
These built-in roles cover the most common needs. For more granular control, you can create custom roles that combine specific permissions.
Custom roles
Section titled “Custom roles”When built-in roles do not match your team structure, create custom roles. A common pattern is to split editing rights by section:
- Blog Editor — Can edit content only under the Blog section
- Product Manager — Can edit product pages but not marketing content
- Regional Editor — Can edit content for a specific market or locale
Custom roles combine a name with a set of content-tree permissions. You define the role, then assign access rights to specific parts of the content tree.
Opti ID: centralized identity management
Section titled “Opti ID: centralized identity management”Opti ID is the identity platform for Optimizely One. It provides single sign-on (SSO) across all Optimizely products — CMS, Experimentation, Data Platform, and Commerce.
CMS roles vs Opti ID organization roles
Section titled “CMS roles vs Opti ID organization roles”This distinction matters and causes confusion. Here is the difference:
| Scope | CMS roles | Opti ID organization roles |
|---|---|---|
| What they control | Permissions inside CMS (edit, publish, admin) | Access to Optimizely products (CMS, Experimentation, etc.) |
| Where you manage them | CMS Admin interface | Opti ID portal |
| Granularity | Content-tree level | Product level |
| Example | ”Can publish pages under /blog" | "Can access CMS and Experimentation” |
Use Opti ID roles to decide which products a person can access. Use CMS roles to control what that person can do inside the CMS.
When to use which
Section titled “When to use which”- A new team member needs access to both CMS and Experimentation — assign Opti ID organization roles
- An editor should only edit blog content, not product pages — assign a CMS role with restricted access rights
- A contractor needs temporary read-only access to CMS — assign the CmsReaders role in CMS and grant CMS access in Opti ID
User provisioning
Section titled “User provisioning”Best practices for user management
Section titled “Best practices for user management”- Start with built-in roles. Only create custom roles when the defaults do not fit your workflow.
- Follow least privilege. Give each user the minimum permissions they need. Promote to higher roles only when justified.
- Audit regularly. Review user lists quarterly. Remove accounts for people who have left the team.
- Use groups when possible. If ten editors need the same access, assign them a shared role rather than configuring permissions individually.
- Document your role model. Keep a record of what each custom role grants and why it exists. This prevents role sprawl over time.
Common patterns
Section titled “Common patterns”| Scenario | Recommended approach |
|---|---|
| Small team (fewer than 10 CMS users) | Use built-in roles only |
| Departmental content ownership | Custom roles per department with content-tree restrictions |
| Multi-market organization | Custom roles per market or locale |
| Agency or contractor access | CmsReaders role with limited content-tree access |
| Enterprise with SSO | Opti ID with SAML/OIDC integration, CMS role mapping |
1. A new team member needs access to both CMS and Experimentation, but should only be able to edit content under the /blog section. Where do you configure each of these permissions?
Opti ID organization roles control which Optimizely products a user can access (CMS, Experimentation, etc.), while CMS roles with content-tree permissions control what the user can do within CMS specifically.
Opti ID organization roles control which Optimizely products a user can access (CMS, Experimentation, etc.), while CMS roles with content-tree permissions control what the user can do within CMS specifically.
Review this topic →2. Your organization has a small content team of eight people who all work across the entire site. There are no departmental content boundaries. Which role strategy is recommended?
For small teams under 10 users without content ownership boundaries, the built-in roles are recommended. Custom roles add complexity that is not justified when everyone edits everything.
For small teams under 10 users without content ownership boundaries, the built-in roles are recommended. Custom roles add complexity that is not justified when everyone edits everything.
Review this topic →