The Packaged CCE deployment of Unified CCE Administration offers extensive flexibility in the configuration of administrator users and in ways to limit their system access.
Administrator access is controlled by the roles and department tools on the Access tab of the Packaged CCE System > Access menu. Only administrators with the SystemAdmin role can access the tools on the Access tab.
Administrators' access to the system can be restricted by their roles, the departments to which they are assigned, and whether they have full or read-only permission.
An administrator must have a role, which can be one of the four built-in roles (SystemAdmin, ConfigAdmin, ScriptAdmin, or AgentAdmin), or one of more than two dozen custom roles. These roles specify which menus and tools an administrator sees.
Packaged CCE offers the option to create departments. A contact center for a university might have a department for each academic area, a department for admissions, a department for alumni, and so forth. An administrator can be associated with one or more departments or can be a global administrator who is assigned to no departments and who therefore has access to all departments. Departmental administrators can add and edit objects only for the departments they administer.
An administrator's role and department associations are configured when the administrator is created. A SystemAdmin can change them.
Packaged CCE allows you to create departments and to associate an object with one department. For example, a university might have department for Admissions, Billing, and each academic area.
The add/edit pages for those objects have a Department drop-down list. If you do not want an object to have a department association, you have two options:
Do not create departments.
Create departments, but select Global from the Department drop-down menu to give the object "global" status.
In the table below, Skill Group One is associated with the Admissions department. Skill Group Two is associated with the History department. Skill Group Three is global and belongs to no department.
Table 1 Object and Departments
Skill Group One
Skill Group Two
Skill Group Three
When you create or edit an administrator, you can either check Access to All Departments, which gives an administrator "global" access to all departments, or associate the administrator with one or more departments. To establish a department association for an administrator, click Add next to the List of Allowed Departments and select one or multiple departments.
An administrator with the SystemAdmin role cannot be a departmental administrator.
In the following table, Administrator One can work with objects in the Admissions department. Administrator Two can work with objects in the History department. Administrator Three is a global administrator and can work with all objects in all departments.
Table 2 Administrators and departments
Limit administrator access by roles and permissions
An administrator must be assigned one of four built-in roles or one of more than two dozen custom roles. (An administrator with no role cannot sign in to Unified CCE Administration.)
These roles specify which menus and tools an administrator sees. Every administrator has a read-only check box. This means that two administrators could have a role that allows them to see the tools under Manage > Agent , but with different permissions. One could have that role with read-only checked; this administrator could see the lists in each tool, unless restricted by departmental association. The other administrator could have that role with read-only unchecked; this administrator could see the lists in each tool and could also add, edit, and delete objects on those lists, unless restricted by departmental association.
Table 3 Impact of role and permissions
Script and Call Tools only
Administrator One, whose role and administrator settings allow Read-Only access to Agent tools and who is associated with the Admissions department, can see Skill Group One and Skill Group Three.
Administrator Two, whose role and administrator settings allow full access to Agent tools and who is associated with the History department, can see, edit, and delete Skill Group Two. This administrator can add History Department agents to Skill Group Two, add global agents to Skill Group Two, and see Skill Group Three but cannot edit or delete it.
Administrator Three, who is not associated with any department, cannot access the Manage > Agents menu and cannot work with any of the skill groups— this administrator's role allows access to Script and Call tools only.
Roles specify which menus and tools an administrator can see and use. An administrator can be assigned to one of four built-in roles or to one of more than two dozen custom roles. (An administrator who has no role cannot sign in.)
Every administrator has a read-only check box. This means that two administrators could have the same role but with different permissions. One could have that role with read-only checked; the administrator could see the lists in each tool that for that role. One could have that same role with read-only unchecked; the administrator could see the lists in each tool and could also add, edit, and delete objects on those lists.
Feature access for roles is defined by check boxes. You cannot alter the feature access for the built-in roles (all allowed features are checked), but you can create additional roles to define customized sets of feature access.
AgentAdmin is the most restrictive built-in role. An administrator with this role can only see the tools under Manage > Agent.
SystemAdmin is the built-in role that allows full access to all tools. An administrator with this role can see all tools and is a global administrator.
When you create a new (custom) role, check the tools that you want administrators with that role to be able to see and use. Checking a category of tools checks all tools in that category. You can uncheck individual tools. For example, you can select Agent Tools and then uncheck Precision Queues and Skill Groups.
You cannot add Access tools (Administrators, Departments, Roles) to a custom role.
Continue to the Administrators tab to assign the role, or save the role without assigning administrators.
Click Add to open the Add Administrators popup window.
The row for each administrator has three columns: a column that is either blank or that shows an
"i" icon, a column with the administrator's username, and a column with the administrator's domain.
If an administrator already has an "i" icon indicating that the administrator has a role, hover over the icon to see the name of that role. Clicking an administrator who already has a role removes that role and reassigns this role.
If an administrator has no icon and has a blue row, that administrator already has this role.
If an administrator has no icon and has a white row, that administrator has no role. To assign the role to an administrator, click the administrator.
Click Save to return to the list of roles, where a message confirms the successful creation of the role.
Click the x icon to remove a role from an administrator.
You have the option to create departments if doing so facilitates contact center operations. A contact center for a hospital might create departments for Surgery, Radiology, Obstetrics, and other operational units. A contact center for a university might create departments for Admissions, Alumni, and Registration. Departments are not required, and there are no built-in departments.
If you do not create departments, all administrators and objects are global, meaning that they are not associated with a department.
If you create departments, you have the option to associate a department with each administrator and object. These are called departmental administrators and objects. Your Packaged CCE configuration can include a mix of global administrators, departmental administrators, global objects, and departmental objects.
You can creating routing scripts for a department by referencing objects from that department in the scripts.
The following objects can be associated with a single department. If departments are configured, the List screens for these objects have a Department column. The New and Edit windows for these objects have a Department field.
Network VRU scripts
Relationships between global and departmental objects
You can create relationships between objects in your configuration. For example, you can associate an agent with skill groups, a call type with a dialed number, and so on. An object's department assignment controls the relationships it can have to other objects.
The rules for creating relationships between objects are as follows:
A global object can be associated with any global or departmental objects. For example, a global agent can be associated with global skill groups and skill groups in any department.
A departmental object can be associated with global objects or with objects in the same department. For example, an agent in Department A can be associated with global skill groups and skill groups that are associated with Department A.
These rules are summarized in the following table.
Table 4 Rules for relationships between global and departmental objects
Can be associated with Global object?
Can be associated with Departmental object?
yes, with objects from any department
yes, with objects from same department only
The only exceptions to these rules are for the relationships between the following objects:
Teams and agent: A global agent can belong only to a global team. A departmental agent can belong either to a global team or to a team that is associated with the same department.
Teams and supervisors: Global supervisors can supervise both global and departmental teams. Departmental supervisors can supervise only teams that are associated with the same department.
These exceptions prevent departmental supervisors from modifying global agents, and are summarized in the following table.
Table 5 Rules for relationships between teams and agents and teams and supervisors
Agent - Global
Agent - Departmental
Supervisor - Global
Supervisor - Departmental
Team - Global
Team - Departmental
yes (same department only)
yes (same department only)
Select a department for an object
The search and select popup lists for departmental objects are limited to global objects and to objects that are in the departments that the administrator can access. For example:
For a global object (or a new object where the department field has not yet been set), a departmental administrator for Departments A and B sees all global objects and objects that are in Departments A and B in the List windows for that object. The administrator cannot see any objects in Department C.
For an object assigned to a department, the departmental administrator sees global values and values that are in that department.
When you change the department for an object, relationships with objects in the original department are cleared; relationships with global objects and objects in the new department remain intact. For example, if you change an agent from Department A to Department B, any skill groups in Department A that had been associated with the agent are cleared.
For some objects, such as call type, the Edit window does not show all related objects. If you try to change the department for those objects, you see an error indicating that you cannot change the department because a related object is in the original department. For example, you see this error if you try to change a call type from Department A to Department B and it is related to a dialed number in Department A. You must change the department of the dialed number before you can change the department of the call type.
System-wide settings and global objects
System-wide settings are configured in the System > Settings tool. Administrators with permissions to use this tool can specify defaults for General, Agent, and Call Reporting settings. The following settings can be set to global objects only:
Agent tab: Desk Settings
Call Reporting tab: Bucket Intervals and Call Type
Have read and write access to departmental objects and global objects on all tools and menus that are allowed for their role. Administrators configured as read-only have read-only access to those objects. For example, global administrators with the AgentAdmin role cannot access global or departmental Dialed Numbers, because they cannot see the Manage > Call menu. (See Roles.)
Can associate a global object with a global object Can associate a departmental object with a global object
Can associate a global object with a departmental object. For example, they can associate a global attribute with a departmental agent
Can associate a departmental object with a global object. For example, they can associate a departmental attribute with a global agent.
Can use Script Editor or Internet Script Editor to modify routing scripts.
Can be associated with multiple departments. They have read and write access to objects in their departments, provided those objects are configured in tools and on menus allowed by their role. Administrators configured as read-only have read-only access to those objects. For example, departmental administrators with the AgentAdmin role cannot access Dialed Numbers in their departments, because they cannot see tools on the Manage > Call menu. (See Roles.)
Have read-only access to global objects.
Can associate a global object with a departmental object. For example, they can associated global attributes with departmental agents
Can associate a departmental object with a global object. For example, they can associate departmental attributes with global agent
Can use Internet Script Editor to modify scripts that reference objects associated with their departments. Departmental administrators cannot log into Script Editor. See Administrator privileges in Internet Script Editor for a full list of Internet Script Editor departmental administrator permissions.
A departmental administrator with the ConfigAdmin role has read-only access to the General tools on the System menu: Information, Settings, Deployment, and Agent Trace.
An object can be "global" (assigned to no department), or it can be assigned to one department. The department association controls the relationship one object can have to another.
An agent in Department A can be added to a team in Department A, skill groups in Department A, and global skill groups.
An agent in Department A cannot be added to a team in Department B or to a global team. The agent cannot be added to a skill groups in Department B.
A global agent can be added to any global or departmental skill group. A global agent can be added to a global team only; he cannot be added to a departmental team.
Administrators can be "global" (assigned to no department) or can be assigned to multiple departments. Administrators' department associations controls their access and actions.
Departmental administrators for Department A can see and modify all objects in Department A. They can see—but cannot modify—global objects. They can create an agent in Department A and associate that agent with any global objects, except a global team. The agent can be associated only with a team in Department A.
Global administrator can see and modify all objects in all departments, as long as those objects are allowed for their roles.