Managing Users, Roles and their Permissions

Harmony Email & Collaboration is hosted on the Infinity Portal, a web-based interface that hosts Check Point's security SaaS services. Therefore, all administrators with access to the Harmony Email & Collaboration are managed globally in the Infinity Portal.

For more information about managing users, user groups, authentication and Single Sign-On, see Infinity Portal Administration Guide.

Roles and Permissions

Each Infinity Portal user is assigned two types of roles:

• Global Role – Default role for every application in the Infinity Portal.

• Specific Service Role – Roles that are specific for a service. These roles are an addition to the global roles and do not override them.

Note - Only users assigned with an Admin Global Role can add users, delete users and modify their permissions.

For more information about roles, see Infinity Portal Administration Guide.

Specific Service Roles

Harmony Email & Collaboration supports Specific Service Roles. These roles are an addition to the Global Role and applies only to the specific service on top of the Global Role.

Harmony Email & Collaboration supports two types of Specific Service Roles and allows administrators to define custom roles for users.

• Base roles

• Modified Permissions

  For more information about modified permissions, see Modified Permissions.

Available Specific Service Roles:

Role	SaaS Applications	SaaS Applications and Security Engines	Policy Rules	Custom Queries	Events, Quarantine, and Exceptions	Sensitive Data *
Base Roles
Admin	View and connect or disconnect	View and configure	View and configure	View, edit, and take actions	View, edit, and take actions	Can't view (explicit permissions required)
Read-Only	Can not view	Can not view	Can not view	View-Only	View-Only	Can't view (explicit permissions required)
Help Desk	Can not view	Can not view	Can not view	View and edit (no actions)	View and take actions	Can't view (explicit permissions required)

Custom Roles

Harmony Email & Collaboration allows administrators to create custom roles, define specific access levels for users across different pages, and manage the receipt of notifications and reports.

Creating and Editing a Custom Role

To create a new custom role:

1. Access the Harmony Email & Collaboration Administrator Portal.

2. Go to System Settings > Roles.

3. Click Add New Role or select an existing one to clone it.

4. In the Name field, enter the desired name.

5. In the Description field, enter the description for the role.

6. In the Permissions section, select the required permissions for the role. See Custom Roles – Configurable Permissions .

7. Click Save.

To edit a custom role:

1. Go to System Settings > Roles.

2. Select the existing role you want to edit and click the three-dot menu.

3. In the View Role page that appears, modify the required fields and permission. See Custom Roles – Configurable Permissions .

4. Click Save.

Custom Roles – Configurable Permissions

Harmony Email & Collaboration allows you to create custom roles by defining access permissions for various interface pages and managing access to additional features such as notifications and sensitive data.

Permissions for Interface Pages

Harmony Email & Collaboration allows you to configure access levels for various interface pages while defining a custom role using the following options:

1. Hidden – Allows the user to view the page.

2. View – Allows the user to only view the page and export data, but cannot take actions on events, emails, or files etc.

3. View and Actions – Allows the user to perform any available actions in the page.

Note - Some actions are available from multiple interface pages. For example: Users can quarantine an email from both User Interaction > Phishing Reports and Events page. If a user have only View permission to the User Interaction > Phishing Reports, they cannot quarantine emails from that page. If a user have View and Actions permission for Events page, they can quarantine emails from that page.

You can configure user access to the following sections in the interface:

Interface Page	Description	Available Settings
Overview	Access to the Overview page	Hidden, View, View and Actions
Events	Access to the Events page	Hidden, View, View and Actions
Entity Pages	Access to Entity Pages, including the details of individual emails, files, attachments, messages, users etc.	Hidden View only with detections (User can view sensitive data only when the system detects the entity as malicious or a DLP leak) View also without detections
Sensitive Data	Access to sensitive data, including email bodies, downloading emails as EML files, shared files, sent messages, and viewing strings from emails, files, or messages flagged as DLP violations.
Mail Explorer and Custom Queries	Access to the Mail Explorer page and Custom Queries	Hidden, View, View and Actions
User Interaction
Dashboard	Access to the Dashboard page	Hidden, View, View and Actions
Restore Requests	Access to the Restore Requests page	Hidden, View, View and Actions
Phishing Reports	Access to the Phishing Reports page	Hidden, View, View and Actions
Quarantined Items	Access to the Quarantined Items page	Hidden, View, View and Actions
Modified Attachments	Access to the Modified Attachments page	Hidden, View, View and Actions
Smart Banners	Access to the Smart Banners page	Hidden, View, View and Actions
Analytics
Dashboard	Access to the Dashboard page	Hidden, View, View and Actions
Partner Risk	Access to the Partner Risk page	Hidden, View, View and Actions
Shadow IT	Access to the Shadow IT page	Hidden, View, View and Actions
Security Checkup	Access to the Security Checkup page	Hidden, View, View and Actions
Report Scheduler	Access to the Report Scheduler page	Hidden, View, View and Actions
Summary Report	Access to the Summary Report page	Hidden, View, View and Actions
Periodic Reports	Access to the Periodic Reports page	Hidden, View, View and Actions
Security Training
Dashboard	Access to the Dashboard page	Hidden View View and export View, export and import
Policy	Access to the Policy page	Hidden View View and export View, export and import
DMARC	Access to the DMARC page	Hidden, View, View and Actions
Policy	Access to the Policy page	Hidden, View, View and Actions
Security Settings
SaaS Applications	Access to the SaaS Applications page	Hidden, View, View and Actions
Security Engines	Access to the Security Engines page	Hidden, View, View and Actions
DLP Data Types	Access to the DLP Data Types page	Hidden, View, View and Actions
Security Exceptions	Access to the Security Exceptions page	Hidden, View, View and Actions
User Interaction Settings	Access to the User Interaction Settings page	Hidden, View, View and Actions
System Settings
Roles	Access to the Roles page	Hidden, View, View and Actions
Others – all other pages under System Settings	Access to all other pages in the System Settings section	Hidden, View, View and Actions

Custom Role for Notification Settings

Harmony Email & Collaboration allows you to configure the following settings in the Notifications section while defining a custom role:

Permission	Description	Available Settings
Overview	User will receive notifications from the system.	Receive Don’t receive
Events	User will receive alerts from the system. Note - Even when this role is applied, the user receives email alerts for security events only when Send alerts to admins is selected in the policy	Receive Don’t receive
Checkup report	User will receive scheduled Security Checkup reports.	Receive Don’t receive

Assigning Roles to Users and Groups

Harmony Email & Collaboration allows you to assign Global Role and Specific Service Roles, including custom roles, to individual users, custom groups, or groups in Active Directory, Entra ID, or other IDP groups.

For more information, see Infinity Portal Administration Guide.

Conflicts Between Specific Service Roles and Global Roles

Harmony Email & Collaboration supports Specific Service Roles. These roles are an addition to the Global Role and applies only to the specific service on top of the Global Role.

Example 1: A user has Read-Only global role in the Infinity Portal and is assigned Admin role specifically for Harmony Email & Collaboration. This allows the user to be an administrator responsible for Harmony Email & Collaboration service, while this user has only Read-Only access to other services.

Example 2: A user has Admin global role in the Infinity Portal and is assigned Read-Only role specifically for Harmony Email & Collaboration. Then the user gets the permissions of the Admin role.

Note - It is recommended to always assign a base role to a user. If a specific permission is assigned to a user, the system automatically assigns this user with the Read-Only role.

Automatically Added Custom Roles

Before May 2025, administrators used to assign modified permissions to each user or group from the following options instead of defining granular custom roles.

Permission	Description
Modified Permissions
Disable Receiving Weekly Reports	The user will not receive Security Checkup reports.
Receive Alerts	Sends email alerts to users with this role. Note - Even when this role is applied, the user receives email alerts for security events only when Send alerts to admins is selected in the policy.
View Sensitive Data only if Threats are Found	Allows the user to access the sensitive data* only for emails/files/messages flagged as containing threats.
View Policy	Allows the user to view the policy rules and does not allow to edit the rules.
View and Edit Policy	Allows the user to view, create and edit the policy rules.
View All Sensitive Data	Allows the user to access sensitive data*.
If None are Assigned	By default, all users regardless of the role, has these permissions: No access to sensitive data Does not receives alerts Receive Security Checkup reports
* Sensitive data includes email body, ability to download email as an EML file, ability to download shared files and sent messages, and viewing strings from emails/files/messages caught as DLP violations.

When the Custom Role feature is released, if any users have one of these modified permissions, the system automatically creates and assigns a custom role to them. As a result, you may see the following predefined custom roles in your system, even if you didn’t create them in the Roles page:

• View Only with Detections

• View Also Without Detections

• Alerts

• Checkup Reports

• View and Edit Policy

• View Policy

For example, if an user is configured with the Receive Alerts permission and the Custom Role feature is enabled, the system automatically creates the Alerts role on the Roles page and assigns it to the user.

You can remove these roles if they are unnecessary. However, ensure that other roles in your system provide the necessary permissions for all users before removing them.