# IFS Cloud: Add a Permission Set, What an IAM User Is and Linking an Employee to a Supervisor > Source: https://netray.co/erp-help/ifs-cloud-permission-set-iam-user-supervisor-setup > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer An IAM user is the sign-in identity held in IFS Identity and Access Management, which authenticates the person. The IFS application user and its permission sets decide what that person may do. To add access, grant a permission set to the application user and make sure the identity maps to it; the supervisor relationship is an employee and organization setting, not a security one. ## Kind how-to ## System ifs ## Erp IFS Cloud ## Module Security / IAM ## Query ifs cloud how to add permission set ## Alternate Queries - ifs cloud what is iam user - ifs cloud how to add employee to supervisor - ifs cloud grant permission set to user ## Applies To IFS Cloud 21R1 and later. Page names differ slightly by release and by how your identity provider is federated. ## Steps ### How to grant a permission set **Items:** - Confirm the person has an IAM identity (a sign-in) and an IFS application user mapped to it. If the identity comes from a company directory, check it exists there first. - Open the user administration page in Aurena and find the application user. - Open the permission sets assigned to the user and add the required set. Choose the narrowest set that covers the job. - Save, then ask the user to sign out and back in so the new rights are loaded. - Test the specific page or action the user needs, and a page they should not see. - Record the request, the approver and the date for audit. ## Sections ### What an IAM user is **Body:** IFS Cloud separates who you are from what you can do. Identity and Access Management handles authentication: sign-in, tokens and, usually, federation to your company directory. The application user in IFS holds the authorization: permission sets, site and company access and personal settings. Both must exist and be linked for a person to work. The same IAM layer also holds service clients used by integrations. Treat those like privileged accounts with their own owners and rotation process. ### Permission sets done well **Body:** A permission set bundles access to pages, projections and data. Build sets by job role, not by person, and combine a small number per user. Avoid giving broad administrator sets to fix a single failing page. When a user reports missing access, find the exact page or projection involved, find which set grants it, then decide if the user's role should carry that set. This keeps access reviews simple. Periodically compare each role's real usage with its assigned sets. ### Employee to supervisor **Body:** The supervisor link is part of the employee and organization data, not the security model. It is typically maintained in the employee or organizational structure setup and then used by processes such as approvals and time or expense reporting. Granting a supervisor role in security does not by itself make someone the approver. If an approval cannot find an approver, check that the employee record has the supervisor set, that the supervisor is an active employee with an application user, and that the approval step uses that relationship. ## Pitfalls - Fixing access problems by adding broad administrator sets. - Creating the identity but not the application user, or the reverse. - Expecting a permission change to apply to an existing session. - Assuming the supervisor setting controls security rights. - Leaving integration clients without an owner or review. ## Ai Angle Access reviews are slow when someone has to read permission set definitions by hand. A private assistant with read-only access to your IFS security data can answer who can approve purchase orders, which users hold a given set and which sets give access to a projection, and show the query behind each answer. Changes still go through your approval process. ## Faq ### Why does a new permission set not take effect? **Answer:** The user's session may still hold the old rights, so a sign-out and sign-in is the first step. Also check that the set grants the specific projection or page, and that company or site access is set. ### Is an IAM user the same as an IFS user? **Answer:** No. The IAM user is the sign-in identity used for authentication. The IFS application user holds authorization data. They are linked, but they are maintained in different places. ### Can I give a permission set to a group? **Answer:** Directory groups can be used for authentication and mapping in many setups, but whether they drive permission set assignment depends on your configuration. Check how your identity federation is set up. ### How do I make someone an approver? **Answer:** Approval depends on the approval template or workflow you configured. It usually needs the person to be a valid user with the right permissions and to be linked through the supervisor or role set in that template. ## Search terms ifs cloud permission set, ifs cloud add permission set, ifs cloud iam user, ifs cloud user administration, ifs cloud supervisor, ifs cloud employee supervisor, ifs cloud access control, ifs cloud security setup --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json