{"id":12018,"date":"2025-01-19T13:03:31","date_gmt":"2025-01-19T03:03:31","guid":{"rendered":"https:\/\/nsrd.info\/blog\/?p=12018"},"modified":"2025-01-19T13:03:36","modified_gmt":"2025-01-19T03:03:36","slug":"working-with-resource-groups","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2025\/01\/19\/working-with-resource-groups\/","title":{"rendered":"Working with Resource Groups"},"content":{"rendered":"\n

PowerProtect Data Manager features a powerful access control mechanism which allows you to isolate users of the system to only have access to the assets they need to do their job. These are referred to as resource groups<\/strong>.<\/p>\n\n\n\n

Resource groups are controlled from within the Administration > Access Control page of Data Manager, and you’ll start by making sure you have a user or group defined to apply a resource group against. In the example below, I’ve created a user called bob<\/strong> who has permissions as a Backup Administrator, Restore Administrator and a general view User:<\/p>\n\n\n\n

\"PPDM<\/a>
Administration > Access Control: bob user<\/strong><\/figcaption><\/figure>\n\n\n\n

Across on the Resource Groups tab, I’ve got a single resource group defined, which just so happens to be called Bob:<\/p>\n\n\n\n

\"PPDM<\/a>
Administration > Access Control: Bob resource group<\/strong><\/figcaption><\/figure>\n\n\n\n

Let’s have a look at what’s defined in the Bob resource group by selecting it and clicking Edit<\/strong>. On my lab system I’ve got two asset types defined on the system: virtual machines and file systems. Two assets in the file system category have been assigned to the resource group, and no virtual machines:<\/p>\n\n\n\n

\"PPDM<\/a>
Resource Group Bob Membership Overview<\/strong><\/figcaption><\/figure>\n\n\n\n

If I click View Assets<\/strong>, I can see which file system assets are assigned to the Bob resource group:<\/p>\n\n\n\n

\"PPDM<\/a>
Viewing the Assets in the Resource Group<\/strong><\/figcaption><\/figure>\n\n\n\n

If you need to modify the assets (or you’re creating the resource group in the first place), you can use the Edit link to assign ownership. This uses a wizard and I’ll step through the wizard pages below to let you see how that works:<\/p>\n\n\n\n

\"Wizard<\/a>
Resource Group Asset Selection – Selection Method Explanation<\/strong><\/figcaption><\/figure>\n\n\n\n

When you go to Select by Policy, you get a list of policies that are compatible with the workload selected. Since this is the file system workload I’m editing, I get to see file system policies. I can toggle on access for each policy, and I get an updated view of assets that will be included based on policy selection:<\/p>\n\n\n\n

\"PPDM<\/a>
Resource Group Asset Selection – Select by Policy<\/strong><\/figcaption><\/figure>\n\n\n\n

In addition to adding assets by policy, under Manual Selection I can optionally select additional assets to include. For me, the advantage of “Select by Policy” is that if your policy uses rules for asset inclusion, the resource group will be actively, automatically updated as matching assets for the rules are found. But, if you do need to manually add a few assets, this is where you can do it:<\/p>\n\n\n\n

\"PPDM<\/a>
Resource Asset Selection – Manual Selection<\/strong><\/figcaption><\/figure>\n\n\n\n

Finally, the summary tells me how many assets have been added through which method and optionally lets me see them:<\/p>\n\n\n\n

\"PPDM<\/a>
Resource Asset Selection – Summary<\/strong><\/figcaption><\/figure>\n\n\n\n

Now, if I jump back across to the User\/Groups tab and edit the bob<\/strong> user, I can see that for each of the roles bob has been assigned (Backup Administrator, Restore Administrator, and User), bob has been assigned the Bob resource group:<\/p>\n\n\n\n

\"PPDM<\/a>
User Role\/Resource Group assignment for the bob user<\/strong><\/figcaption><\/figure>\n\n\n\n

Now, how does this all work? Well, the net result of connecting the bob user to the Bob resource group is simple: bob will only get to see and interact with the assets that have been assigned. Compare for instance, the admin user view for Virtual Machines and File System assets:<\/p>\n\n\n\n