Manage Users and Permissions

Why user management matters

Controlling who can create, edit, approve, and publish content is essential for governance. Too few permissions and your team is bottlenecked on a single admin. Too many and you risk unauthorized content going live. This guide covers both identity management (who can log in) and content permissions (what they can do once logged in).

Invite users via Opti ID

Opti ID is the identity layer for all Optimizely products. Users are managed at the organization level.

1. Log into the Optimizely portal
2. Navigate to Organization → Users
3. Click “Invite User”
4. Enter the user’s email address
5. Assign product roles (CMS Editor, CMS Admin, etc.)
6. Click “Send Invite”

The user receives an email invitation and creates their Opti ID account.

CMS roles reference

Role	What they can do
CMS Admin	Full access: manage content types, settings, scheduled jobs, users
CMS Editor	Create, edit, and publish content within permitted areas
CMS Approver	Review and approve content in workflows
CMS Reader	View content in the editor but cannot make changes
Web Admin	Manage site settings, visitor groups, and configuration

CMS 12, 13

On CMS PaaS, roles are managed through both Opti ID (for login) and the CMS Admin interface (for content permissions). The CMS Admin → Access Rights panel controls what users can do with specific content.

Set content-level permissions

Beyond roles, you can set permissions at any level of the content tree. Permissions are inherited downward — setting permissions on a folder applies to all pages within it.

1. In the CMS editor, navigate to the content item or folder
2. Open “Set Access Rights” (right-click → Access Rights, or via the properties panel)
3. Add users or groups
4. Set permission levels:
   • Read — Can view the content in the editor
   • Create — Can create child pages or blocks
   • Edit — Can modify content
   • Delete — Can remove content
   • Publish — Can publish content live
   • Administer — Can change permissions on this content

Best practice: Set permissions on folders, not individual pages. Create a content tree structure that mirrors your organizational permissions.

Configure approval workflows

Workflows ensure content is reviewed before publishing. To set up a basic approval workflow:

1. Navigate to CMS Admin → Content Approval
2. Select the content area where approval is required
3. Define approval steps — each step has one or more reviewers
4. Set the scope — which content tree branches require approval
5. Save the workflow

When an author submits content for review:

• The assigned reviewer receives a notification
• They can approve, request changes, or reject
• Approved content moves to the next step (or publishes if final step)

Enterprise SSO integration

For organizations using an identity provider (Okta, Azure AD, Google Workspace):

1. In the Optimizely portal, navigate to Organization → SSO Settings
2. Configure SAML 2.0 or OpenID Connect with your identity provider
3. Enable SCIM provisioning for automatic user sync
4. Set MFA policies (required for all users, or specific roles)

With SSO configured, users log in with their corporate credentials. No separate Optimizely password is needed.

Common tasks

Task	Where to do it
Add a new user	Opti ID portal → Users → Invite
Change a user’s role	Opti ID portal → Users → Edit roles
Remove access	Opti ID portal → Users → Deactivate
Set content permissions	CMS editor → Right-click → Access Rights
Configure approval workflow	CMS Admin → Content Approval
Set up SSO	Opti ID portal → Organization → SSO Settings

Related content

Continue your journey with these related pages.

📖Understand the concepts

• Opti ID and Optimizely One
• What is Optimizely CMS?

🔧Follow a guide

• Configure Visitor Groups