Understanding Global Permissions


This functionality is currently available only on browser.

Global permissions control user access to Enterprise-level operations and information. Only the enterprise administrator or another user with administrator rights can grant Global permissions to users. The user who creates the Enterprise account becomes the first administrator of the account and is assigned the Enterprise administrator global permission.

Global permissions dictate what access to (and control over) the enterprise account is available to specific users. These permissions are for users who should have some control over the account, and not intended for non-administrative users. Typically, what non-administrative users are able to do to a document is determined by the properties of Projects and Permission schemes.

To set up your enterprise account quickly using the Onshape-supplied defaults, review Getting Started as an Enterprise Administrator.

Assigning global permissionsCopy link

Global permissions are not attached to any particular resource (e.g. document), instead they generally apply to certain operations (like adding and removing users).

  1. Select Enterprise settings from the User menu.

    With the Users tab selected on the left, notice that any users you had in your Professional subscription are still present. If you are not upgrading from a Professional subscription with users, see Adding and Administering Users for instructions on adding users.

  2. Select Global permissions from the left menu pane.
  1. Right-click on a Global permission and select Manage users.
  2. In the dialog, select the email addresses of the users you wish to associate with those particular permissions and click Add. You can also select teams of users when you have teams set up.

Step 4 for assigning global permissions

The Global permissions include:

  • Enterprise administrator - Grants the users assigned to this global permission full control and full permission over all of the enterprise’s resources. Users with this Global permission will see the following tabs when accessing Enterprise settings: Users, Teams, Global permissions, Authentication, Project roles, Permission schemes, Custom properties, Preferences, and Details.
  • Manage users and teams - Grants the users assigned to this global permission the ability to add and remove users from the enterprise account as well as view and modify teams. Users with this Global permission will see the following tabs when accessing Enterprise settings: Users, Details, and Teams. Also allows transitioning enterprise members to guest users and guests users to enterprise members.
  • Invite guest users - Grants the users assigned to this global permission the ability to add and remove guest users in the enterprise. This does not, however, allow transitioning enterprise members to guests or guests to enterprise members. For more information about guest users, see Adding and Administering Users.
  • Manage role based access control - Grants the users assigned to this global permission the ability to view and modify Project roles and Permission schemes. Users with this Global permission will see the following tabs when accessing Enterprise settings: Users and Details.
  • Permanently delete - Grants the users assigned to this global permission the ability to permanently delete any resources that have been placed in Trash and also to permanently delete a workspace. Users with this Global permission will see the following tabs when accessing Enterprise settings: Users and Details.

    When deleting a workspace, a warning dialog displays and the action, if taken, cannot be undone. If there are versions on the branch, the branch will remain and you can create a new workspace from any version on that branch.

  • Analytics administrator - Grants the users assigned to this global permission the ability to fully control reports and analytics, including creating reports and sharing those reports with other users.
  • Create projects - Grants the users assigned to this global permission the ability to create projects; the All enterprise users team is automatically assigned to this Global permission. Add and remove users (even guest users) and teams as desired.
  • Create documents and folders in "My Onshape" - Allows users in the enterprise to create documents and folders within the "My Onshape" filter on the Documents page from within their enterprise account.
  • Create Releases - Grants the users assigned to this global permission the ability to create Release candidates. The default users assigned to this global permission is the All enterprise users team. Enterprise admins can edit this permission.
  • Approve Releases - Grants the users assigned to this global permission the ability to approve or reject release candidates and be listed in the Approver field of the release candidate form. You can add Guests users to this global permission.
  • Allow access to the App store - Grants the users assigned to this global permission the ability to sign in to the App store and subscribe to applications.
  • Allow access to public documents - Allow users in the enterprise to view, open, and copy public documents from within their enterprise account.
  • Share for anonymous access - Grants the users assigned to this global permission the ability to share documents by an anonymous link to people outside of the enterprise and outside of Onshape. These links provide read-only access to the document shared. When a user is associated with this global permission, they have an additional option in the Share dialog. For more information, see Share Documents.

Users not associated with any global permissions see only the Users tab and the Details tab when accessing Enterprise settings.