Assign group and roles
- Last UpdatedJan 08, 2026
- 2 minute read
-
Once the database is created, click the vertical ellipsis icon , and select Manage roles.

-
Under the Groups tab, select Assign group. Create the required groups.
-
You require at least an Admin group and a Reporting Database group. Add the following:
-
Group name
-
Group description
-
Users
Note: The only special character allowed is an underscore ‘_’.
If you are added to the AVEVA Intelligence AD for the first time, accept the invite you will receive via email. However, if you are already in Azure AD, you will not receive an email. Follow the instructions:
-
-
Visit https://portal.azure.com/d9bde4ea-8859-4e11-9efa-491b97c4db44 in an incognito mode tab.
-
Log in with your credentials.
-
Accept the invite.
-
Under the Roles tab, select Assign role. It is compulsory to add the following roles:
-
Datastore Administrator role – Only users/groups with the Datastore Administrator roles can view the tenant model builder.
-
Reporting Analytics User role – Only users/groups with the Reporting Analytics User role can view the reporting database information and later configure a database.
Important: To allowlist reporting databases, ensure that the Reporting Analytics User role is assigned for the reporting database.
-
Important: 1:1 mapping is only allowed within the same account. A BI Gateway role can be assigned to only one group and one tenant. The tables below demonstrate the 1:1 mapping within two accounts:
|
Account |
Tenant |
Role |
Group |
Mapping Eligibility |
|---|---|---|---|---|
|
Account1 |
Tenant1 |
Datastore Administrator |
Grp1 |
Allowed |
|
Account1 |
Tenant1 |
Datastore Administrator |
Grp2 |
Not allowed |
|
Account1 |
Tenant1 |
Reporting Analytics User |
Grp1 |
Not Allowed |
|
Account1 |
Tenant1 |
Reporting Analytics User |
Grp2 |
Allowed |
|
Account1 |
Tenant2 |
Reporting Analytics User |
Grp2 |
Not allowed |
|
Account1 |
Tenant2 |
Datastore Administrator |
Grp1 |
Not allowed |
|
Account1 |
Tenant2 |
Datastore Administrator |
Grp3 |
Allowed |
|
Account1 |
Tenant2 |
Reporting Analytics User |
Grp4 |
Allowed |
This demonstrates the 1:1 mapping within the first account. The same process can be repeated for another account. For example,
|
Account |
Tenant |
Role |
Group |
Mapping Eligibility |
|---|---|---|---|---|
|
Account1 |
Tenant1 |
Datastore Administrator |
Grp1 |
Allowed |
|
Account1 |
Tenant1 |
Datastore Administrator |
Grp2 |
Not allowed |
|
Account1 |
Tenant1 |
Reporting Analytics User |
Grp1 |
Not Allowed |
|
Account1 |
Tenant1 |
Reporting Analytics User |
Grp2 |
Allowed |
|
Account1 |
Tenant2 |
Reporting Analytics User |
Grp2 |
Not allowed |
|
Account1 |
Tenant2 |
Datastore Administrator |
Grp1 |
Not allowed |
|
Account1 |
Tenant2 |
Datastore Administrator |
Grp3 |
Allowed |
|
Account1 |
Tenant2 |
Reporting Analytics User |
Grp4 |
Allowed |