Why do I need to manage users?

For users to use Lexmark Cloud Services, administrators must first create accounts for them based on their roles and responsibilities. It is common for a user’s roles to change over time. You can easily make changes to those roles after the initial setup is complete.

When creating Lexmark Cloud Services accounts for users, consider the following:

• What do users need to have access to the cloud?

• What functions will each user need to perform?

For channel partners, also consider the following if child organizations are created:

• Will users in your organization need access to child organizations?

• What users do you need to create in the child organization, and what functions will they need to perform?

Adding users

To give a user access to Lexmark Cloud Services, administrators must first create accounts for them in an organization in Lexmark Cloud Services. You can create user accounts in one of the following ways.

• Using the Add User form in the Account Management portal

• Importing users using a file in the Account Management portal

• Using federated identity management

Creating users manually by using the Add User form

You can create an account for a user manually in Lexmark Cloud Services by typing the user’s information in the Add User form. Only one account can be created at a time. Use this method if you are adding only a few users.

1. From the Account Management web portal, click Users.

2. Click Create User or Create.

   
   

3. Type the following details:

   • E-mail—Must be your Lexmark Cloud Services account name.

   • First Name

   • Last Name

   • Display Name—The name that you want to appear in the Lexmark Cloud Services portal when you log in.

   • Department

   • Cost Center

   • Set Password—This is required only when for Lexmark Customer Identity Management Services are used. The administrator can either manually set the user’s password or email a link to the user. Users can use that link to create their own password.

   
   

4. Click Create User.

Importing users from a CSV file

You can create multiple user accounts simultaneously by importing them from a file. The Import feature lets you create, update, and delete multiple users in an organization using a CSV or TXT file. You can also create user groups, assign a user to those user groups, and set user PINs. For more information, see Managing users. Use this method if you are adding a large number of users.

Notes:

• The CREATE command is used to create a new user account.
• The headers of the import file are case-sensitive.
• Count the commas. All columns must be accounted for on each line of the CSV file.
• The size of the CSV file must not exceed 1MB.

Creating users when using federated identity management

When federated identity management is used, you do not need to create or import users manually to create their accounts. A user account in a federated organization is automatically created when the user logs in to the following for the first time:

• Lexmark Cloud Services portal

• A Lexmark Cloud submission client

• The Lexmark Print application

Creating a user account in a federated organization is useful in the following ways:

• If your organization already uses an identity management system, then federating allows Lexmark Cloud Services to authenticate users with your identity management system. User accounts do not have to be manually created or imported into the Account Management portal. User credentials are not stored in Lexmark Cloud Services.

• If user badges are not maintained in your authentication provider, then they can be manually added for each user. Or a list can be imported using the CSV file import function. This action pre-registers user badges.

  Note: If your authentication provider maintains the users’ badges, then they can be obtained directly through a claim from your authentication provider. This also allows badges to be used without having to register them.

• If the department or cost center definitions used in Lexmark Cloud Services do not correspond to definitions in your authentication provider, then you can resolve the mismatch. You can manually add missing definitions for each user, or you can import a list using the CSV file import function.

User roles

Roles are used to manage access to specific features within Lexmark Cloud Services. A user can be assigned roles using any of the following methods:

• Assigning roles individually—Requires assigning roles manually to each user.

• Assigning roles through groups—Allows a set of roles to be given to users by making them a member of a group. Users can be members of more than one group.

• Inheritance through organization roles—Automatically assigns the organization roles to all users in the organization.

Determining what roles are needed

Before assigning roles, you must determine the features of Lexmark Cloud Services that your organization plans to use, and which individual users plan to use them.

Administrative roles for account management

There are two administrative roles for account management: the Organization Administrator and the User Administrator.

• Role with the most privileges

• Can manage organizational settings for your organization

• Can manage user accounts for your organization

  • Can add and delete user accounts

  • Can add and remove roles assigned to user accounts

  • Can add and remove user accounts from groups

• Can manage user accounts for your organization

  • Can add and delete user accounts

  • Can add and remove roles assigned to user accounts

  • Can add and remove user accounts from groups

For channel partners, users who manage the configuration, user accounts, or printers in a customer organization must be added to a Child Organization Access Group. For more information, see Managing the Child Organization Access Group.

The following table lists the roles required for actions to be performed in a customer (child) organization:

Roles for Cloud Fleet Management

• Users enrolling printers in Cloud Fleet Management must have the Fleet Management Administrator and the File Service Administrator roles.

• Users accessing Fleet Management reports but not enrolling printers in their organization must have the Fleet Management Reporting Analyst role.

• Users enrolling a customer’s printers in Cloud Fleet Management must be added as members of a Child Organization Access Group. They must also be assigned the Partner Administrator, Fleet Management Administrator, and File Service Administrator roles.

• Users accessing Fleet Management reports for printers in customer organizations but not enrolling printers must be added as members of a Child Organization Access Group. They must also be assigned the Partner Administrator, Fleet Management Reporting Analyst roles.

Roles for Cloud Print Management

The roles support two methods of print job submission and release: Cloud Print Management and Hybrid Print Management.

Submitted print jobs are stored in the Lexmark Cloud Service until the user releases it at a Cloud Print Management–enabled printer.

• Users submitting and releasing print jobs using Cloud Print Management must have the Print Release Management User role.

• Users managing Print Management for their organization must have the Print Release Management Administrator role.

• Users generating organizational Cloud Print Management reports but not submitting and releasing jobs must have the Print Release Management Reporting Analyst role.

Roles for Hybrid Print Management

Submitted print jobs are held on the user’s workstation until the user releases it at a Cloud Print Management–enabled printer that uses Hybrid Print Management.

• Users using Hybrid Print Management must have the Hybrid Print Management User role.

• Users managing Print Management for their organization must have the Hybrid Print Management Administrator role.

• Users generating organizational Print Management reports but not using Hybrid Print Management must have the Print Release Management Reporting Analyst role.

Assigning roles to an individual

1. From the Account Management web portal, click Users > Users.

2. On the Users page, click the E-mail of the user.

   

3. In the Assigned Roles section, click Edit.

   

4. Do the following:

   • To assign a role, click Assign.

     1. On the Assign Roles page, select or remove the roles.

     2. Click Assign Roles.

        

   • To remove a role, select the role, and then click Remove > Remove Role.

     

Assigning roles through groups

Assigning roles through groups allows a set of roles to be given to users by making them a member of a group. This method makes it easy to assign the same roles to multiple users.

1. From the Account Management web portal, click Groups tab.

2. Do any of the following:

   • To create a new group, click Create.

     

     1. In the Group name field, type the name of the group.

     2. Click Create Group.

   • To edit an existing group, click the group under the Group Name column.

3. On the Edit group page, do the following:

   • From the Members tab, add or remove members.

     

   • From the Group Roles tab, you can either assign or remove roles.

     

Assigning roles by membership in a child organization access group

Notes:

• Child organization access groups are available only to channel partners.
• Roles assigned through membership in a child organization access group apply across all customer organizations.

For channel partners, the Groups tab shows two tabs: Organization Access and Child Organization Access. Organization access groups apply only to the channel partner’s organization. Child organization access groups apply to the customer organization. The process for managing membership and roles for organization access and child organization access groups is the same.

The difference between organization access groups and child organization access groups is that child organization access groups are created with a default role, Partner Administrator. You cannot delete the Partner Administrator role from a child organization access group. You can add or remove additional roles as needed.

The Partner Administrator role is required for users to have access to customer (child) organizations. For example, a user who will be managing printers in a child organization using Fleet Management must be a member of a child organization access group. Moreover, that child organization access group has the Fleet Management Administrator role added along with the default Partner Administrator role.

Assigning organization roles

Roles can be assigned at the organization level. Organization roles are automatically inherited by all users in the organization. For example, if all users can access Cloud Print Management, then they are all assigned the Print Release Management User or Hybrid Print Management User role. The roles can be automatically assigned to all users via the organization roles.

1. From the Account Management web portal, click Organization > Organization Roles.

   
   

2. Click Assign or Assign Roles.

   

3. From the Assign Roles page, add or remove roles.

   

4. Click Assign Roles.

Managing user badges

If users are authenticating at the printer, then set up a badge or PIN for each user. For more information on badge configuration, see Managing printer logins.

Assigning badges

If identity federation is used and badge IDs can be retrieved using claims from your identity management service, you can automatically populate badge IDs from the service.

If identity federation is not used or badge IDs are not available from your identity management service, then you can assign badge IDs in two ways. The method to use depends on how much of the process you want your users to participate in.

• Assigned by an Organization Administrator or User Administrator in the Account Management portal—Can be done manually, one user badge at a time, or by importing from a CSV file, for multiple user badges

• Assigned by the user—Can be done manually from the user’s My Accounts page, which requires users to provide their badge ID, or manually at the printer

Badges registered manually by an Organization Administrator or a User Administrator in the Account Management portal

1. From the Account Management portal, use any one of the following methods to access the Registered Badges page:

   Note: If you are a channel partner with child organizations, then you must select the organization.

   Using the Users card in the Account Management portal

   1. Click the Users card.

      

   2. Click the email address of the user.

   3. In the Printer Login section, for the Badges login, click Edit.

      

   4. Click Register or Register Badge.

      
      

   5. In the Register Badge window, enter the badge information.

   Using the Users menu

   1. From the Users menu, click Manage Badge/PIN.

   2. Click Register or Register Badge.

      

   3. In the Register Badge window, enter the user’s email address and the badge information.

   Note: The user's email address must already exist in the organization.

2. Click Register Badge.

Badges imported by an Organization Administrator or a User Administrator in the Account Management portal

1. From the Account Management portal, use one of the following methods to access the Registered Badges page:

   Note: If you are a channel partner with child organizations, then you must select the organization.

2. From the Users menu, click Manage Badge/PIN.

3. Click Import Badges.

   

4. In the Import Badges window, browse to the CSV or TXT file that contains the list of badges.

   Note: For more information, see Managing users.
   

5. Click Import Badges.

Badge registered by users through their My Account page

This action can only be performed by users for their own badge.

1. From the Lexmark Cloud Services portal, in the username menu, click My Account.

2. On the My Account page, in the Printer Login section, for the Badges login, click Edit.

   

3. Click Register or Register Badge.

   

4. In the Register Badge window, enter the badge information.

5. Click Register Badge.

   

Badge registered by a user at the printer control panel

This action can only be performed by users for their own badge. Badges can be registered by users at the printer control panel using one of the following methods:

• Manual badge registration using your email address and password

  1. Tap your badge on a card reader that is attached to a printer.

  2. From the control panel, touch Manual Registration.

     

  3. In the Enter your existing account credentials field, type your email address and password.

     

  4. Touch Register.

• Email badge registration request sent from the printer

  1. Tap your badge on a card reader that is attached to a printer.

  2. On the control panel, touch E-mail Registration.

     

  3. In the Send the registration link to field, type your email address.

     

  4. Touch Send > OK.

     

  5. Open your email account, and then click the badge registration link.

     
  Note: The following screen appears for 5 seconds before logging you into the My Account page of Lexmark Cloud Services portal .
  

Managing user PINs

If users are authenticating at the printer, then set up a badge or PIN for each user. For more information on PIN configuration, see Managing printer logins.

Assigning PINs

If identity federation is used and PINs can be retrieved using claims from your identity management service, you can automatically populate PINs from the service.

Notes:

• A user must log in to the Lexmark Cloud Services portal once before their PIN is retrieved, and it can be used to authenticate at a printer.
• If PINs are retrieved from your identity management system, then you must set the PIN Generation menu to Administrator manually set and to Never expire.
• Any PIN changes made in Lexmark Cloud Services is temporary. These temporary PINs are overwritten from your identity management system when the user logs in the next time.

If identity federation is not used or PINs are not available from your identity management service, then you can assign user PINs in two ways. The method to use depends on how much of the process you want your users to participate in.

• Assigned by an Organization Administrator or User Administrator in the Account Management portal—Can be done manually, one user badge at a time, or by importing from a CSV file, for multiple user badges

• Assigned by the user—Can be done manually from the user’s My Accounts page, which requires users to provide their PIN

PINs assigned by an Organization Administrator or a User Administrator

An Organization Administrator or a User Administrator can set PINs for users one at a time or for multiple users at once by importing a file. New or reset pins are emailed to the user.

Setting the PIN for a single user

The Organization Administrator or User Administrator can use one of the following methods to set or reset a PIN for a user:

• Using the users list

  1. From the Account Management portal, select the Users card, or click Users > Users.

     

  2. In the E-mail column, click the user email.

  3. In the Printer Login section, for the PIN login, click either Set PIN or Reset PIN.

     
     

  4. Based on the option chosen in the PIN Generation Option for the Organization Printer Login Configuration, do any of the following:

     Note: The result of clicking Set PIN or Reset PIN depends upon the PIN Generation Option chosen for the Organization Printer Login Configuration page.

     • If Automatically generate and email is selected in the PIN Generation menu, then an email with the new PIN is sent as soon as you click Set PIN or Reset PIN.

     • If Administrator manually set is selected in the PIN Generation menu, then a user must submit a request outside of Lexmark Cloud Services to an Organization Administrator or a User Administrator to set or reset their PIN.

     • If User set is selected in the PIN Generation menu, then you can click Set PIN or Reset PIN, and then enter the new PIN, and then click Generate PIN.

       

  An example of PIN received by the user.

  

• Using Manage Badge/PIN

  1. From the Account Management portal, click Users > Manage Badge/PIN.

  2. Click the PINs tab.

  3. Click Generate.

     
     

  4. In the E-mail field, type the email address of the user, and then click Generate PIN.

     
  Note: The user receives an email with the PIN.
  

Importing user PINs

The Organization Administrator or User Administrator can set the PIN for one or more users by importing the PINs using a CSV or TXT file.

Notes:

• PINs can be imported when user accounts are created using the file import method.
• If PIN Generation Options is set to Automatically generate and email, then any PINs set in the imported file are ignored. The PIN field should be left empty.
• For more information on the CSV and the TXT file, see Sample CSV formats.
• The headers of the import file are case-sensitive.
• Count the commas. All columns must be accounted for on each line of the import file.

The Organization Administrator or User Administrator can use one of the following file import methods to set or reset a PIN.

• Using the users list

  1. From the Account Management portal, select the Users card, or click Users > Users.

  2. Click Import.

  3. In the Import Users window, browse to the CSV or the TXT file that contains the users list.

  4. Click Import Users.

  Note: The user receives an email with the PIN.

• Using Manage Badge/PIN

  1. From the Account Management portal, click Users > Manage Badge/PIN.

  2. Click the PINs tab.

  3. Click Import or Import PINs.

  4. In the Import PINs window, browse to the CSV or the TXT file that contains the PINs.

  5. Click Import PINs.

  Note: The user receives an email with the PIN.
  

• How PIN data in the imported file is used depends on the PIN generation options selected on the Printer Login Configuration page.

  • If the Automatically generate and email option is selected , then PIN values in the imported file are ignored. Lexmark Cloud Services automatically creates a PIN for each user in the file.

  • In the Administrator manually set option is selected , then users are assigned the PIN value associated with their entry in the imported file.

Setting PIN expiration

Administrators can select whether PINs will expire and how long before they expire by clicking Organization > Printer Login Configuration. If a PIN expires, then you must use one of the methods to reset the PIN. The PIN expiration and reset options depend on the selected PIN generation options.

• Automatically generate and email—You cannot set an expiration for the PINs.

  

• Administrator manually set or User set—You can set the PIN to never expire or to expire after 1 to 48 hours or 1 to 180 days.

  

PINs assigned by the user

Users can set or reset their PINs from their My Account page.

• From the username menu, select My Account. In the Printer Login section, you can view following:

  • Set PIN

    

  • Reset PIN

    

  • Check e-mail or contact administrator for your PIN

    
Note: If you do not currently have a PIN, then in the Printer Login section, click Set PIN. If you currently have a PIN, then click Reset PIN.

Setting and resetting the PIN

Depending on the selected PIN generation option, clicking Set PIN or Reset PIN results in either of the following

• If PIN Generation Options is set to Automatically generate and e-mail, then Lexmark Cloud Services generates and emails a new PIN to the user.

• If PIN Generation Options is set to User set, then users are allowed to manually set or reset their PINs. They can do this task by entering a PIN with the required number of digits, and then clicking Generate PIN.

Note: If “Check e-mail or contact admin for your PIN” appears, then it means that PIN generation is manually set by the administrator. To set or reset their PIN, users must submit a request outside of Lexmark Cloud Services to an Organization Administrator or a User Administrator.

Modifying user information

If Identity Federation is used, then user information is retrieved from your authentication provider through claims. Any changes made to this data in Lexmark Cloud Services are overwritten when the user logs in for the next time.

If Identity Federation is not used, or if claims from your authentication provider do not work, then modify user information by doing one of the following:

Manually modify user information in the Account Management portal

1. From the Account Management portal, select the Users card or click Users > Users.

   

2. In the E-mail column, click the user email.

   

3. In the Personal Information section, click Edit.

   

4. In the Personal Information page, enter the information, and then click Update Profile.

   

Import changes to user information using a CSV file

Use this method if you want to modify multiple user accounts simultaneously. The Import feature lets you create, update, and delete multiple users in an organization using a CSV or TXT file. You can also create user groups, and then assign a user to those groups. For more information, see Managing users.

When importing, note the following:

• Use the UPDATE command to modify the information of an existing user account.

• The headers of the import file are case-sensitive.

• Count the commas. All columns must be accounted for each line of the CSV file.

• The size of the CSV file must not exceed 1MB.

Deleting user accounts

If Identity Federation is used, then a user’s account can only be permanently deleted from your authentication provider. A user account that is deleted only from Lexmark Cloud Services is restored when the user logs in the next time.

If Identity Federation is not used, then you can delete user accounts by doing one of the following:

Manually delete the user account in the Account Management portal

1. From the Account Management portal, select the Users card or click Users > Users.

   

2. Select the user, and then click Delete.

   

3. Click Delete User.

   

Delete user information by importing a file in the Account Management portal

For more information, see Managing users.