Advanced access rights management in CodeTwo Email Signatures 365

Advanced access rights management lets you organize CodeTwo email signature and autoresponder rules into teams managed by different people or groups. Watch the video below for a quick overview of this feature or keep reading for more detailed information.

By default, users with the Signature rule admin role in your organization can access the Signatures app and manage all email signature and autoresponder rules in an organization. These users are managed on the Access rights page in the Signatures app (Fig. 1.). We call this Simple access rights management.

Fig. 1. The Access rights page in CodeTwo's Signatures app (Simple access rights management).

In Simple access right management mode, you can delegate signature administration to specific users or groups, but the main limitation is that they will be able to manage every CodeTwo signature and automatic reply in your organization (learn more). If you want more granular access control (e.g. allow different users or groups to manage specific rules or rule settings), you can turn on Advanced access rights management.

This article will help you understand Advanced access rights and decide if it’s going to work for your scenario.

• Simple vs Advanced access rights management
• How to turn on Advanced access rights management
• Manage Access rights admins
• Manage teams
  • Manage Team admins
• Managing rules in the Advanced access rights management mode
• How to switch back to simple access rights
• FAQ

Simple vs Advanced access rights management 

Watch the video below to see what changes in CodeTwo’s Signatures app when you switch to Advanced access rights management in your organization. For more details, check out the table below.

Fig. 2. Access rights admins (A) and Signature rule admins (B) in Simple access rights management.

Fig. 3. Here’s where you'll find Access rights admins (A) and Signature rule admins (B) after switching to Advanced access rights management.

How to turn on Advanced access rights management

Watch the video below or keep reading to learn how to enable Advanced access rights management.

Sign in to app.codetwo.com and go to the Access rights page (you must be an Access rights admin or a Microsoft 365 global admin of your tenant to access this page). Next, click Switch to advanced access rights management, as shown in Fig. 4.

To complete the switch, make yourself familiar with what will change (see the previous chapter if you need more info), check the confirmation box (see Fig. 4.) and click TURN ON ADVANCED ACCESS RIGHTS.

Fig. 4. Turning on Advanced access rights management.

Click OK to close the summary. You’re now using Advanced access rights management (Fig. 5.). The Access rights page has two new sections now (Access rights admins & Teams), and you’re currently on the Access rights admins page that looks similar to what you already know. Let’s explain the Access rights admins first.

Fig. 5. The Access rights admins page (Advanced access rights management).

Manage Access rights admins

Watch the video below to learn more about Access rights admins, or keep reading for all the details.

After switching to Advanced access management, you’ll notice that the Access rights admins page lists your organization’s Microsoft 365 global admins and the users and group members who used to be Access rights admins in the simple mode. These users still remain Access rights admins – they can manage other Access rights admins in your organization (see Fig. 6.). But they can also manage teams (create teams, add team users, assign Team admins, etc.). By default, all Microsoft 365 global admins in your tenant are also Access rights admins with full access and management permissions.

How to add new Access rights admins

Sign in at app.codetwo.com and go to Access rights > Access rights admins (Fig. 6.). Use the ADD button to add individual users and groups (Microsoft 365 groups, distribution lists and mail-enabled security groups) to the list.

Fig. 6. Here, you can specify users or groups that can manage teams and Access rights admins in your organization.

Newly added users/groups have no permissions. By selecting individual checkboxes (see Fig. 6.), you can assign the following permissions:

• Manage Access rights admins – gives users/groups access to the Access rights admins page (see Fig. 6.), where they can add or remove other Access rights admins (except themselves), manage all their permissions, and switch back to the Simple access rights management mode. Learn more about switching to simple mode
• Create teams / Delete teams / Change team order – gives users/groups permissions to perform specific actions on teams. Once any of these permissions are assigned, the users/groups who got them can view all teams and their settings on the Teams page. Learn more about managing teams

Permissions are assigned immediately.

Additional options are available under the ellipsis (…) button (see Fig. 6.):

• Remove – removes a user/group from the Access rights admins list.
• Show user’s/group’s signature rule permissions – opens a pop-up window that shows if this user/group also has permissions related to managing signature and autoresponder rules in your organization (Fig. 7.). This setting is useful if you want to remove a person who no longer works in your organization and need to check all permissions in the CodeTwo ecosystem.

Fig. 7. Showing rule permissions assigned to an Access rights admin.

Manage teams

With Advanced access rights management, you can organize signature and autoresponder rules into teams. Each team can be managed by different users or groups (known as Team admins), and you can assign granular permissions (e.g. read only, edit team settings, edit rule settings, etc.).

By default, when you switched to Advanced access rights management, all your signature and autoresponder rules were automatically grouped into a new team, Default (see Fig. 8.) and your existing Signature rule admins have become the Team admins of this team, with full permissions. Read on for details on how to manage team settings and Team admin permissions.

Create a new team

If you, for example, manage a large organization with offices in different locations (such as New York, London and Berlin), you might want to create a dedicated team for each office, add regional signatures and automatic replies to each team, and assign people who will be responsible for managing those teams. That’s where Advanced access management comes in. Watch the video below or read on to learn how to set up these teams.

Sign in to CodeTwo’s Signatures app (app.codetwo.com), go to Access rights > Teams and click CREATE TEAM (Fig. 8.).

Fig. 8. Adding a new team for grouping signatures / automatic replies in an organization.

The team editing pane opens. In the first step, Name, enter the name of the team (e.g. London) and, optionally, add a description. Click Next to proceed.

In the Team users step, use the top list (Fig. 9.) to specify if email signature and autoresponder rules created in this team should apply to everyone (if you add All users to the list) or only to selected users or members of a specific group in your organization. Use the lower section (bottom list) to add exceptions – rules in this team will not apply to these users.

Fig. 9. Selecting team users – only these users will get signatures / automatic replies created within this team.

In the Team logic step, define how the program should process rules in other teams if a rule in this team is applied or not. These options apply only to cloud (server-side) signature rules and autoresponder rules, which CodeTwo processes in the order they are listed in the Signatures app: from top to bottom. If a rule in this team is applied and you don’t want rules from other teams to apply after that, leave the default settings (see Fig. 10.). If you have a user who gets signatures from multiple teams, then the default settings here will prevent this person from getting double signatures.

Fig. 10. The Team logic step with default settings.

In the last step, Team admins (Fig. 11.), select individual users or groups (Microsoft 365 groups, distribution lists and mail-enabled security groups) who will manage this team and the signature/autoresponder rules grouped in it. To do so, click Add> User or Add > Group and assign rule permissions by selecting them on the list. You will be able to modify these permissions at any time. Learn more about Team admin permissions

Fig. 11. Selecting Team admins for the team and assigning permissions.

When you’re finished, click Save to create the team.

Manage Team admins

Sign in at app.codetwo.com, go to Access rights > Teams and click on any team to edit its settings. Next, go to the Team admins step (Fig. 12.) and add individual users or groups (Microsoft 365 groups, distribution lists and mail-enabled security groups) by clicking Add > User or Add > Group.

Fig. 12. Managing Team admins and their permissions in the Signatures app.

Next, assign permissions by selecting the appropriate checkboxes:

Team permissions (apply to the specific team only):

• View team – gives users/groups permission to check (read only) the team’s settings on the Teams page in the Signatures app. This permission is assigned automatically when you assign other team permissions to a user/group.
• Edit team – gives users/groups permission to edit the team’s name, users and logic, but not team's admins. This permission also doesn’t allow you to change team’s order or delete the team – these actions are managed by Access rights admins.
• Manage Team admins – gives users/groups permission to add or remove other Team admins (including themselves) to/from the team and modify their permissions. It also allows them to check rule permissions assigned to other Team admins in other teams (learn more).

Rule permissions (apply to all rules in the specific team):

• Create/import/export rules – gives users/groups permission to create new rules, including by using the rule import/export, clone and convert options. This permission is also required to move rules between teams. Once a new rule is saved and added to the rules list, you won’t be able to edit the rule unless you are also assigned the Edit rule settings permission.
• Change rule order – gives users/groups permission to change the order in which rules are processed by CodeTwo (learn more).
• View rules & rule settings – gives users/groups permission to check (read only) rules and their settings on the Signatures page in the Signatures app. This permission is automatically assigned when other rule permissions are given to a user/group.
• Edit rule settings – gives users/groups permission to edit rule settings and publish rules. This permission doesn’t allow you to edit templates (email signatures and auto-reply messages) in rules or change the settings in the Design step of the rule creation wizard – you need the Edit rule design permission to do that.
• Edit rule design – gives users/groups permission to edit templates (email signatures and auto-reply messages) in rules or change the settings in the Design step of the rule creation wizard. This permission doesn’t allow you to publish rules. If a rule is unpublished, you need the Edit rule settings permission to apply the rule in your organization.
• Delete rules – gives users/groups permission to delete rules.

One you add users/groups to Team admins and assign them permissions, click Save to apply your changes.

To remove a user/group from Team admins, click the ellipsis (…) button in the Team admins step and select Remove, as shown in Fig. 13.

Fig. 13. Removing users/groups from Team admins.

Check rule permissions for other teams

You can check what rule permissions a user/group has in other teams. To do this, sign in at app.codetwo.com, go to Access rights > Teams and click on any team to edit its settings. Next, go to Team admins, click the ellipsis (…) button next to the desired user/group and select Show user’s/group’s other signature rule permissions (see Fig. 14.). This will open a pop-up window that shows this user’s or group’s rule permissions in other teams (Fig. 14.).

Fig. 14. Checking rule permissions for another user or group.

Change team order

CodeTwo processes teams and rules within teams in the order they are listed on the Signatures page (see Fig. 16.) – from top to bottom. To change the team order, go to the Teams page and use drag-and-drop to move a team to a different position. Alternatively, you can select a team by clicking the checkbox next to it, then click Move up / Move down above the team list (Fig. 15.).

Find out more about rule processing in the Advanced access rights management mode

Fig. 15. Changing the team order.

Delete a team

To delete a team, go to the Teams page in the Signatures app, select the team(s) you want to delete and click Delete. In the pop-up windows that opens, confirm your action and click YES, DELETE THE TEAM, as shown in Fig. 16.

Note that you cannot delete a team if it’s the only one in your organization. If you no longer need teams, consider switching to simple access rights management.

Fig. 16. Deleting a team in the Signatures app.

Managing rules in the Advanced access rights management mode

If you’ve just switched to Advanced access rights management and only have the Default team set up, the Signatures page will look exactly the same as in simple mode (Fig. 17.).

Fig. 17. The Signatures page with one team set up in the Signatures app.

But once you create additional teams, they will also appear in the Signatures page (Fig. 18.). You will then be able to move your rules between the teams.

Fig. 18. The Signatures page showing rules grouped into different teams.

Move rules between teams

The easiest way to move rules between teams is to use drag-and-drop on the Signatures page, as shown in this video. Alternatively, you can select a rule by clicking the checkbox next to it, then click Move to another team above the rule list. Next, select the target team and click MOVE (Fig. 19.). This will delete the rule from the source team and re-create it in the target team, at the bottom of the rules list. Rules that you move keep all their settings and status (published/unpublished). You can move one rule at a time.

Fig. 19. Moving rules between teams.

You can also specify a team when creating a new rule. To do so, click CREATE RULE at the top of the Signatures page, select the rule type – Cloud (server-side), Outlook (client-side) or Autoresponder – then select a team and click CREATE RULE (Fig. 20.). Note that the team selection option is available only if you are a Team admin for multiple teams and have the necessary permissions to create new rules.

Fig. 20. Creating a new rule for a team.

Import/export rules between teams

Here’s how the rule import/export feature works in the Advanced access rights management mode:

• You can export rules from a single team at a time.
• If you have access to multiple teams, you need to select a team when importing rules back to the Signatures app, as shown in Fig. 21.

Fig. 21. Importing rules to a specific team.

Test rules in a team

The signature rules tester helps you check if the signature rules within a specific team are working as expected. Here’s how to use it the Advanced access rights management mode:

• You need to select a team whose rules you want to check, as shown in Fig. 22. You can only select the teams that you manage.
• In the From field, select a user that’s included in the selected team (learn more about team users).

Fig. 22. Selecting a team whose rules you want to test.

How to switch back to simple access rights

Before you switch back to the simple access rights management mode (with no teams), the following conditions need to be met:

• Leave only one team in the Signatures app. Delete other teams if necessary.
• Restore the default settings of the team on the Team users tab (Fig. 23.):
  • In upper section (top list), set the All users condition.
  • Remove any exceptions in the lower section (bottom list).

Fig. 23. The default Team users setting for a team.

Once these conditions are met, you can switch back to simple management. To do so, sign in to app.codetwo.com, go to Access rights > Access rights admins and click the link shown in Fig. 24. To complete the switch, check the confirmation box and click SWITCH TO SIMPLE ACCESS RIGHTS.

Fig. 24. Switching back to the simple access rights management mode.

After the switch:

• Team admins will become Signature rule admins – they will have full access to all rules (email signature and autoresponder rules) in your organization.
• Access rights admins who were not assigned theManage Access rights admins permission will also become Signature rule admins.
• Access rights admins who were assigned theManage Access rights admins permission will remain Access rights admins – they will have full access to rules and will be able to manage Signature rule admins and Access rights admins.

FAQ

1. How do team users and users defined in rules rule relate to each other?
2. How are rules processed in the Advanced access rights management mode?
3. What happens when multiple users edit rules or teams at the same time?
4. What is the Default team for?

1. How do team users and users defined in rules relate to each other?

In the Advanced access rights management mode, you define users for a team in the Team users step (see Fig. 25.). Any email signature and autoresponder rules created in that team will only apply to these users (even if you select different users in the Senders condition of a signature rule or the Reply from condition of an autoresponder rule).

Example:

There are two users in your organization: User 1 and User 2. Only User 1 is included in Team A created in CodeTwo's Signatures app (Fig. 25.). 

Fig. 25. User 1 is included in Team users in Team A, while User 2 is not.

You create a new signature rule in Team A and select both User 1 and User 2 in the Senders step (Fig. 26.).

Fig. 26. Both User 1 and User 2 are specified in a signature rule in Team A.

Based on the setup shown in Fig. 25. & Fig. 26., only User 1 will trigger the rule and receive a signature, because User 2 is not included in Team users in Team A.

2. How are rules processed in the Advanced access rights management mode?

When you turn on Advanced access rights management, you can create teams and organize rules within these teams. The video below explains how CodeTwo processes both teams and rules to apply email signatures or automatic replies. For more details and examples, keep reading this section.

The way rules are processed within a team is handled in the Logic step (see Fig. 27.) of a cloud (server-side) signature rule or an autoresponder rule (as described in this article). On the other hand, the Team logic step (also shown in Fig. 27.) controls how rules are applied across different teams. 

Fig. 27. The Logic step (A) in a signature rule and the Team logic step (B) in a team.

CodeTwo processes rules and teams in the order in which they are listed on the Signatures page in the Signatures app – from top to bottom. So, if you have multiple teams, and each team has its own cloud signature or autoresponder rules, the rules in the first team on the list are processed first. In the example shown in Fig. 28., the order of processing would look like this:

Team A > Rule 1A > Rule 2A > Rule 3A > Team B > Rule 1B > Rule 2B, and so on.

Fig. 28. Rules are processed from top to bottom, starting with the rules in the first team on the list.

Let’s look at how different settings in the Logic and Team logic steps affect rule processing.

Example 1 – the processing of cloud signature rules across teams

There are two teams set up in the Signatures app: Team A and Team B. Each team has its own cloud (server-side) rules, as shown in Fig. 29.

Fig. 29. An example setup of cloud rules in teams in CodeTwo’s Signatures app.

User A is included in both Rule 1A (Team A) and Rule 1B (Team B), while User B is only included in Rule 1B (see Fig. 29.). The Team logic step in Team A (which is at the top of the team list) is configured as follows:

• If at least one cloud signature/autoresponder rule is applied in this team > Process rules in the next team on the list
• If no cloud signature/autoresponder rules are applied in this team > Process rules in the next team on the list

Now, User A and User B send an email that meets the conditions set in both rules. Here’s what happens:

• Rule 1A and 1B are applied to User A.
• Rule 1B is applied to User B.

This means User A gets two signatures, which is correct based on the settings in the Team logic step. If you want User A to get only one signature, you can either reconfigure your rules (e.g. remove User A from one of the teams) or change the settings in the Team logic step in Team A to:

• If at least one cloud signature/autoresponder rule is applied in this team > Do not process rules in other teams

Example 2 – the processing of autoresponder rules across teams

There are two teams set up in the Signatures app: Team A and Team B. Each team has its own autoresponder rules, as shown in Fig. 30.

• If at least one cloud signature/autoresponder rule is applied in this team > Do not process rules in other teams
• If no cloud signature/autoresponder rules are applied in this team > Process rules in the next team on the list

Now, you send an email to User A and User B that meets the conditions set in both rules. Here’s what happens:

• Autoresponder Rule 1A is applied, and you get an auto-reply from User A.
• Autoresponder Rule 1B is not applied – you don't get a second auto-reply from User A.
• Autoresponder Rule 1B is applied, and you get an auto-reply from User B.

Rules are applied on a per-user basis. So, even though the rule from Team A was applied to User A, CodeTwo still processed rules from Team B, but only for the email sent to User B.

3. What happens when multiple users edit rules or teams at the same time?

If one user is editing a rule or team in the Signatures app, the rule/team is automatically locked for others (see Fig. 31.). This prevents one user’s changes from being accidentally overwritten by someone else:

• While a rule is locked, others can't edit it, change the template, or delete/publish/unpublish it. However, they can still move it up or down the rules list.
• While a team is locked, others can't edit its settings, but can still move it up or down the teams list or edit rules in the team.

Fig. 31. A notification shown when a team is locked for editing.

In rare cases, if changes made by one user weren’t synchronized and someone else tries to edit the rule/team, they’ll be notified about outdated information and asked to refresh the page.

4. What is the Default team for?

The Default team is automatically created when you turn on Advanced access rights management. It contains all your rules and has all the default settings applied. Watch this video to learn more about this team. 

When you create new teams, you will probably move all your rules from this default team to other teams. Even if you remove all signatures from this team, you can still keep it (but it's a good idea to move it to the bottom of your teams list to keep your Signatures page clean). This way, if you ever want to switch back to Simple access rights management, all you need to do is move all your rules back into this Default team, delete all the other teams and perform the switch.