---
title: Permissions Required
slug: permissions-required
createdAt: 2025-06-11T20:26:20.406Z
---

The folder manager module creates AD Groups, sets permissions on folders using those groups, and manages the membership of the groups.

To do that the Activate Orchestrator (Job) Service, service account will need the following permissions on the folders, shares and OU(s) where groups that grant access to folders reside.

##  Scan folder permissions

### Grant to:

- Activate Orchestrator service account.
   See Recommendation below.

###  Grant on:

- Share

### Rights:

- Read

### Grant on:

- Target directory(ies) subfolders and files

### Rights:

- List folder contents

## Create folders

### Grant to:

- Activate Orchestrator service account.
   See Recommendation below

### Grant on:

- Share

### Rights:

- Full Control

### Grant on:

- Parent directory(s)

### Rights:

- Read, Write and Execute

### Grant on:

- On Group OU and all descendant objects

### Rights:

- Read
- Write
- Create all child objects
- Delete all child objects

## Secure folders

### Grant to:

- Activate Orchestrator service account.
   See Recommendation below.

### Grant on:

- Share

### Rights:

- Full Control

### Grant on:

- This folder, subfolders and files

### Rights:

- Read, Write and Execute

### Grant on:

- Group OU and all descendant objects

### Rights:

- Read
- Write
- Create all child objects
- Delete all child objects

# Recommendation

To grant these permissions it is recommended to:

- Create a group in an OU that only the Activate Orchestrator service account can write to.
- Assign rights listed above to the group
- Create a Service that adds users to the group
   Ensure that a team with appropriate training to understand the access being requested are approvers for the service.
- Order the service for the Orchestrator service account

# Notes:

- If possible, remove permissions for users other than the Activate Orchestrator service account to manage groups in the OU(s) where groups that control folder access reside.