◾Back Office permissions, home label and SSO

There are 4 main permissions roles in Smartico backoffice:

• CRM Admins - the role with highest set of permissions. Can manage sensetive settings and create other user to access Smartico backoffice

• CRM Manager - the main role that has access to manager CRM and Gamification setup and many other settings needed in the daily work

• CRM Support - can see everything, but cannot change most of the configurations. His main focus is on CRM User/player profile screen and possibility to investigate and do minor adjustments on the user/player level ("give bonus" is among such actions !!! )

• CRM Integration engineer - has same permissions as CRM Support but can access private keys for the APIs, his role is to support integration with Smartico those he need to see how data is delivered to Smartico.

You can find detailed explanation of all roles below.

Important to note that if you are managed multiple labels, specific user can have different permissions towards different labels. So one user can be CRM Admin in label A, and at the same time CRM Manager in label B.

Concept of "Home" label

If you have only one Label in Smartico you can skip reading this section entirely.

When a new user is created in Smartico BackOffice it should be assigned to a specific label as "Home label". You can think of home label as of the main label to which user belongs. Only CRM Admins of the home label can manage other user that belongs to this label.

Lets say you have started with label "MyCasino Europe" and you have created users under this label.

At some point your business is expanding and you created a new label "MyCasino USA". From this point:

• you can give to some of existing user access to MyCasino USA

• you can create new users under USA label and they will have access only to USA label

• you can create user with CRM Admin role under USA label. This user will be able to manage user of USA brand, but will not be able to manage user of Europe label.

• If you deicde to close USA label at all, then users that are created under USA label will lost access to Smartico at all. Because this was their main label, or what we call "Home" label

Every home label also has definittion of "suffix" for username, for example your Europe label may have suffix "mycasino", and then all the users under this label should have names in the format like john@mycasino. Your another label could have same name or different one, depending on your vision.

As a concept, the suffix is reflecting an organizational unit or CRM group in your company.

Default permissions groups in Smartico

Here you can find permission groups of the administrative users in the Smartico Back Office

Role	Allowed to do
CRM Manager	Can manage campaigns, segments, assets for communication. Can manage all gamification elements Can access user profiles and: - send messages - adjust points - give/complete missions - change test and opt-out flags - give mini-games spins - give bonuses
CRM Admin	Same as CRM Manager and: - SMS, Mail, IVR gateways - Caps for mails & sms - Brands configurations - Create new Back Office users - Other label level configurations - Access REST API & Keys
CRM Support	Has read-only access to all Marketing & Gamification configurations Can access user profiles: - send messages - adjust points - give missions - give mini-games spins - give bonuses Cannot: - complete missions - change opt-out flags - change test flag
CRM Integration engineer	Same as CRM Support and can additionally: - Access REST API documentation & Keys

Note that each role can be extended with additional permissions or some possibilities can be taken from role, for example - CRM Admin can create a new user with role of CRM Support, but exclude possibility to give bonuses, and additionally to give access to REST API documentation and keys

"Additional" and "Restriction" roles

Operator can give what is called "Additional roles" to the users.

For example, the CRM Support role doesn't have permission to "Complete missions" manually for the players, but the role can be given to particular user ass "Additional role"

Also, some permissions can be taken away on user level using "Restriction roles", for example to remove permission to adjust points

Current restriction roles that can be taken away from the user

Role	Explanation
Don't allow to adjust points	Removes permission to adjust gamification points for player
Don't allow to send personal messages	Removes permission to send communication in manual way from the player profile
Don't allow to export segment	User won't be able to export segments
Hide links in SMS & Mail communication	When looking on the communication history and content of mails/sms/popups, user won't see the actual links
Don't allow to give bonus from user profile	User won't be able to give bonus manually to the player
Don't allow to read content of sent mails/sms/popups	User won't be able to see content of send communication, but will see only the facts that communication was sent
Don't allow activation of Campaigns & Rules	Users won't be able to activate campaigns or automation rules or do any changes in already active campaigns and rules. They can still created drafted versions that will be activated by other users with higher permissions
Don't allow to give mini-game attempts	User won't be able to give mini-game attempts manually to the player
Don't allow to give mission manually	User won't be able to give missions manually to the player
Don't allow giving raffle tickets from user profile	User won't be able to give raffle tickets manually to the player

Authorization with SSO

Smartico supports Single Sign-On (SSO), currently available for Google and Microsoft users, with plans to expand support to other providers in the future.

To enable SSO, the client needs to provide the email domain(s) used in their Google Workspace (e.g., mycompany.com). This setup allows users with emails under the specified domain (e.g., [email protected]) to log in using SSO.

Note: Smartico is not supporting authorization using personal mails managed under generally available domains like googe.com, yahoo.com etc. Only company managed emails/domains are supported

When enabling SSO client must provide

1. List of campaign owned mail domains, e.g. mycompany.com, mycompany.org

2. If to allow user creation on Smartico side when new user logins through SSO. In case "yes", then

   1. The default permission role to be assigned to new users (e.g., "CRM Support," "CRM Manager," etc.).

   2. The Smartico label(s) to which newly created users will have access. E.g. label ids - 4444 and 4445

   3. Which of the listed in point "b" labels will be assigned as "home" label

The logic of user matching and permissions assignment

• For new users: New users logging in via SSO will

  • automatically be assigned access to the specified label(s), listed in point 2b

  • they will get the default permission role as specified in point 2a

  • they will have "home" label assigned according to point 3c

• For existing users: If an existing user logs in via SSO, they will be matched by their email address and retain their current set of permissions.

Template of the request for enabling SSO:

Mail domain(s)	mycompany.com, mycompany.org
Allow new users creation	YES/NO
List of label IDs	4444,4445
Home label ID	4444
Default permission	CRM Support

Note: QA labels cannot be selected as Home label ID