Set Up Employees

All employees must be assigned to a login authenticator to log in to CXone Mpower.

Complete each of these tasks in the given order.

Before You Begin

If you want to use custom roles instead of the default roles that come with CXone Mpower, you need to create the roles first.
If you want to use a login authenticator besides the system default, you need to create the login authenticator first.
If you want to assign employees to custom teams and not the default one, you need to create the teams first.
If you want to assign employees to custom scheduling units and not the default one, you need to create the scheduling units first.
If you want to assign employees to locations, which you can currently only use for IP address verification on login, you need to create the locations first.
If you want to assign employees to custom groups, you need to create the groups first.
If you want to apply views Allow you to control the information users can see in CXone Mpower. to employees to limit the data they're allowed to see, you need to create the views first.
If you want to assign employees to WEM skills, you need to create the WEM skills first.

Create Employee Accounts

Required permissions: Employees Create, Can Manage Passwords, Role Management User Assignment

You can add an employee account by using:

Create Employee: Create an individual account using the Create Employee window.
Import Employees: Import multiple employee accounts.

The instructions here are for creating a single employee account in the application. If your company is using ACD, you'll also need to configure ACD user settings for this employee.

CXone Mpower offers many options and settings to customize employees. Read through this entire task. Make sure you know the settings you need to configure before you begin.

Click the app selector and select Admin.
Click Employees > Create Employee.
Enter the employee's First Name and Last Name. The Middle Name is optional. Special characters are not accepted in these fields, including, but not limited to: ! / < > ? % ".
Enter a valid Email Address. CXone Mpower sends emails, like activation invitations and password verification codes, here. You can use the same email address for multiple employees. When you edit an employee's email address, a verification email is sent to the new email address. If you have a list of allowed email domains, then the employee's email must have an allowed domain for the employee to be created.
Enter the Username you want to assign to an employee. The username must be in the form of an email address. The field is auto filled from the Email Address field. You can edit it if you want to.
Assign a Primary Role to an employee from the drop-down.
Select the Security tab.
Select the login authenticator you want to assign to the employee. Employees can only be assigned one login authenticator.

Employees can only log into CXone Mpower if they are assigned to a login authenticator.
Click Create to create the employee profile and continue setting it up. Click Create & Invite if you're ready for the user to activate their account and set up their password.

Configure the General Tab

Go to Admin > Employees.
Select an existing employee's account or select Create Employee.

Complete the fields on the General tab.

Learn more about fields on the General tab.

Field	Details
Display Name	Enter a Display Name you want to assign to an employee. Users from other teams can view the display name. They cannot view other information about the employee unless they have the View Employee permission enabled.
Type	Use Type to organize an employee outside of their assigned Role and Team. The type is not tied to permissions or unavailable codes. This makes reporting easier. You can select previously created types from the drop-down. You can also create new types by entering text in the search bar, and clicking Create.
Hire Date	The date you hired an employee. This field is for your records only. CXone Mpower doesn't use this information.
Time Zone	The employee is automatically assigned to the tenant High-level organizational grouping used to manage technical support, billing, and global settings for your CXone Mpower system. time zone unless you change it.
OS Login	OS Login represents the user's login details to their desktop operating system in the format Domain\UserName, for example, NICE\MyUser. The Recording application requires OS Login information for screen recording to work on advanced configurations, such as, Multi-ACD (Open), multi-session environments, and more. The OS Login value for each employee profile must be unique. The OS Login value cannot be used for multiple employee profiles, even if some of the duplicate employee profiles are inactive. If multiple employee profiles have the same OS Login value, ScreenAgent will not run for any agent using that OS Login value.
Rank	This field is visible only if you have WFM in your environment. It determines priority when creating a schedule.
Assigned to Team	Assign the employee to a team by selecting a team from the drop-down menu. If you haven't created teams yet, or if the employee will belong to a new team, you can just accept the Default Team setting and then change it later.
Assigned To Groups	Assign the employee to one or more groups by selecting groups from the drop-down menu.
Assigned To Scheduling Unit	This field is visible only if your system includes WFM. It specifies the scheduling unit for the employee.
Mobile Number	The employee's mobile or cell phone number. This field is for your records only. CXone Mpower doesn't use this information.
ACD Login Id	Add ACD login id here. If an employee belongs to a tenant that is configured with a non-CXone Mpower ACD, ensure that the ACD Login ID is assigned in the employee profile. This is necessary to map the agent state, monitor real-time adherence, and generate reports.
Attributes	Under this drop-down select attributes related to the employee: Agent Integrations: This attribute allows employees to see CRM records in the customer card in Agent Suite applications. The customer card displays CRM records related to the contact the employee is handling. The default value is cleared for new employees. Can be Evaluated/Coached: This attribute appears only if your system includes CXone MpowerQM. It enables the employee to be evaluated, and you will be billed for QM for this employee. The default value is selected for new employees. If you add QM to a system that has existing users, you must manually enable this setting for those users. Can Be Recorded (Screen): This attribute appears only if your system includes Recording Advanced. It enables the employee's screen to be recorded, and you will be billed for screen recording for this employee. The default value is selected for new employees. If you add Recording Advanced to a system that has existing users, you must manually enable this setting for those users. This attribute is necessary for enabling screen recording, screen monitoring, or both. Can be Recorded (Voice): This attribute is visible only if your system includes Recording/Recording Advanced. It enables the employee's voice to be recorded. You will be billed for voice recording for this employee. The default value is selected for a new employees. If you add Recording/Recording Advanced to a system that has existing users, you must manually enable this setting for those users. Can be Scheduled: This attribute is visible only if your system includes WFM. It enables the employee to be scheduled. You will be billed for WFM for this employee. The default value is selected for new employees. If you add WFM to a system that has existing users, you must manually enable this setting for those users. Users who don't have this attribute selected won't appear in employee lists when creating weekly rules or shift templates. Removing this attribute from a user deletes that user from any weekly rules or shift templates to which the user is assigned. Can be Analyzed: This attribute appears only if your system includes Interaction Analytics. When this attribute is selected, the employee's recorded interactions are analyzed by Interaction Analytics. You will be billed for Interaction Analytics for this employee. The default value is cleared for new employees. Can Edit BI Reports: Employees with this attribute selected can edit any of the BI reports in the Reporting application as long as they also have the correct permissions. The default value is cleared for all employees, both existing and new. Can View BI Reports: Employees will be able to open any BI reports with this attribute. Reports are in the Reporting application, but employees should have permissions to view the reports there. BI reports have no usage fee for up to 10% of either your concurrent or configured users, depending on your pricing model. Once the 10% threshold is passed, you will be billed for each additional employee with this checkbox selected. The default value is cleared for all employees, both for existing and new. Customer Card: This attribute allows employees who don't work with digital contacts to access available customer cards for omnichannel-routed voice, chat, email, and SMS Messaging contacts. The default value is cleared for new employees. Digital Engagement: This attribute appears only if your system includes Digital Experience. When this attribute is selected, the employee's record is synced to Digital Experience, and they can work on digital contacts. You will be billed for Digital Experience for this employee. The default value is cleared for new employees. Virtual agent enabled: This attribute appears only if your system includes Digital Experience. When this attribute is selected, the employee profile is marked as a non-human profile. This attribute does not enable a virtual agent in Virtual Agent Hub. Performance Management Insights: This attribute enables basic PM features for the user. It includes enhanced dashboards, custom integrations, metrics, widgets, and more. The default value is not selected for new users. You must manually enable this attribute for users who need access to these features. Users without this attribute will not have access to advanced performance management tools and analytics. Removing this attribute from a user revokes their access to Performance Management Insights features and associated data. Performance Management Act: This attribute provides advanced PM features, building on the basic tier. It includes out-of-the-box dashboards, gamification elements, and coaching tools. The default value is not selected for new users. You must manually enable this attribute for users who require these advanced features. Users without this attribute selected won't have access to gamification and coaching tools within the performance management system. Removing this attribute from a user revokes their access to Performance Management Act features, including gamification elements and coaching tools. Only one of these attributes (Insights or Act) can be selected per user. Enable the appropriate attribute based on the purchased SKU to avoid double billing.

Click Save.

Configure the Security Tab

Required permissions: Employees Edit or Create, Security Policy Configure, Login Authenticator User Assignment

Configure the information below on the Security tab.

Click the app selector and select Admin.
Go to Employees.
Select an existing employee's account or select Create Employee.
Select the Security tab.
Select the secondary role you want to assign to the employee from the Secondary Roles drop-down. Assigning a secondary role will automatically assign that role's permissions to the employee. Only assign the roles and permissions that the employee needs to perform their job.
Select the login authenticator you want to assign to the employee. Employees can only be assigned one login authenticator.

Employees can only log into CXone Mpower if they are assigned to a login authenticator.
External Identity is only required if the user is configured to use an external identity provider (IdP).

For SAML 2.0, the value corresponds to the NameID assertion in the response. This can be configured on the identity provider to use a variety of different identifiers. The value in the response and the value of the External Identity field must match exactly, including letter case.

For OpenID Connect, the value corresponds to the Subject claim in the ID token. The value in the response and the value of the External Identity field must match exactly, including letter case. Some identity providers don't assign a Subject value until the user logs in, making it impossible to know the correct value to configure. In this case, you can have CXone Mpower use the email claim for the first login and then automatically assign the correct Subject value. You can do this by entering information into the External Identity field in this format: claim(email):{email configured by your IdP}. For example, if the user's email in the IdP is nick.carraway@classics.com, you would enter claim(email):nickcarraway@classics.com.
If you assigned a primary role with a login authenticator that requires multi-factor authentication (MFA):
1. Enter an MFA Token Period. The value must be between 15 and 300 seconds, and compatible with the virtual or hardware MFA device your employees use. For example, Google Authenticator only allows a value of 30 seconds.
2. Click Edit next to the MFA Secret field.
3. To use a manual key, type an alphanumeric value. Some MFA devices provide a value (often called a "key") for this purpose. If you type your own MFA Secret, the value must be either 16, 26, or 32 characters and encoded in Base32. Base32 allows you to use a 32-character set comprised of the uppercase letters A-Z and the numerals 2-7. The MFA Secret must be RFC 6238-compliant.
4. To automatically generate a value, click Generate . Provide this value to the employee, who can use it to set up a virtual MFA device such as Google Authenticator. Scanning a QR code or bar code is not supported. The employee must set up 2-step authentication manually when using a virtual MFA device.
Select any views from the drop-down that you want to assign to the user.
If you want to override the tenant inactivity lock setting for this user, turn Lock User On and adjust the Inactive Days Before a User Can Be Locked setting as needed. If you want to make this user exempt from inactivity locking, turn Lock User Off and select Never Lock User. If Lock User is Off with the Never Lock User checkbox cleared, the tenant setting applies to the user.

When you configure a new Inactive Days Before a User Can Be Locked threshold, the setting applies retroactively. For example, if you set it to 7 days and the employee profile has been inactive for at least seven days, it is immediately locked.
Click Save.

Configure Employee Access Keys

Required permissions: Access Key Create

Access keys replace a username and password for user authentication. Access keys can be assigned to human users. But they are most commonly used for applications that function like users, such as bots and intelligent virtual assistants Chatbot or similar application that interacts with a user based on artificial intelligence. (IVAs). Manage your access keys as securely as you do your passwords and advise your employees to do the same.

Human users can also manage their own access keys from the Access Keys tab of their own employee profile. This requires the My Access Key Create permission

If you're configuring access keys while creating the employee profile, begin with step 3.

Click the app selector and select Admin.
Click Employees and then click the employee profile you're editing to open it.
Click the Security tab.
Click Add access key.
Copy the Access Key ID to a secure location.
Click Show Secret Key and copy the secret key to a secure location.
Click Save.

Configure Skills

Go to Admin > Employees.
Select an existing employee's account or select Create Employee.
Select the Skills tab.
Select the skills for the employee from the Skills drop-down. If the proficiency scoring for the selected skill is enabled in the WEM Skills page. Assign the proficiency score to the selected skill. Make sure the direction of the proficiency score is correct when you assign it to an employee. Check the proficiency direction in WEM Skills.

Configure Availability

If your organization uses WFM, configure availability for the employees. Otherwise, skip this step.

Click the app selector and select WFM.
Go to Setup > Agent Configuration.

By default, an employee is set as always available. You can edit the default or existing availability blocks to match an employee's available time frames. Else clear the existing availability blocks and create new ones:

To clear default or existing blocks:
1. To clear all availability blocks, click Clear All.
2. To clear availability blocks for a specific day, click Delete on the respective day row.
3. To clear an individual availability block, click Delete inside the block.
Click and drag to add an availability block. An availability block can have a time frame ranging from 15 minutes to 24 hours. To create a new selection, click and drag in the day/time grid. You can create multiple selections for a single day.

An employee can be assigned multiple availability blocks within a single day.

Click All day to mark an employee available for the entire day.

An employee's available time frame is displayed inside the block. If the block is too short to display the available time frame, hover over the block. A popover appears, showing the available time frame and the delete icon.
Click Save.

Configure Preferences

If your organization uses WFM, configure preferences for the employees. Otherwise, skip this step.

Select the Preferences tab.

In the Shift Preferences area, from the drop-down list for each day, select the employee's preferred shift.
In the Time-Off Preferences area, drag and drop the listed days of the week to the available priority spots.

For example, if the employee's preferred day off is Monday, drag and drop the Mon card to the Priority 1 slot. If the next preference is Wednesday, drag the Wed card to the Priority 2 slot, and so on.
Click Save.

Configure Recording Accounts

This tab is only available with Multi-ACD (Open).

A recording account associates an agent with a telephony system by extension number or agent ID. You can add up to 10 recording accounts to an employee account manually or using bulk upload.

Go to Admin > Employees.
Select an existing employee's account or select Create Employee.
Select the Recording Accounts tab.
Configure recording accounts:
1. To add a recording account, click New Account.
2. Select the Telephony System the recording account is assigned to.
3. Select the Account Type:
  - For sites using fixed seating, select Extension.
  - For sites using free seating, it is recommended to select Agent ID.
  - (Cisco telephony system only) For sites using a shared line, select UDI (Unique Device Identifier).
4. In the Value field, enter a unique value per system for the recording account.

Activate an Employee Account

Inviting an employee sends an email to the email address configured for the employee profile. The user must click the link in the email within 48 hours to activate their account and set up a password. If the user doesn't activate their account within 48 hours, you will need to send another invitation. If your company uses single sign-on (SSO), you can skip the following steps and configure employees for immediate activation.

Click the app selector and select Admin.
Click Employees.
In the Employees table, scroll to or search for the employee profile for the user you want to activate.
Click Invite.

Configure Immediate Activation of Users with SSO

Accounts for employees logging in with single sign-on (SSO) are activated immediately when the employee logs in. Their CXone Mpower account remains active and fully accessible immediately, regardless of whether they have completed email verification.

Set up a federated identity login authenticator.
1. Click the app selector and select Admin.
2. Click Login Authenticator.
3. Click New Login Authenticator.
4. Enter the Name and Description of the login authenticator.
5. Select SAML as the Authentication Type.
6. Enter the SAML request Endpoint as the Endpoint URL.
7. Click Choose File and select the signing certificate from your identity provider. If you don't have a signing certificate from your identity provider, follow these instructions or reach out to your identity provider.
Assign roles to the login authenticator.
1. While still in the Create New Authenticator window, click Assigned Roles.
2. Click Add Roles.
3. Select one or more roles from the list and then click Save & Activate.
Assign one of those roles to employees that you want to immediately activate. Any employee assigned to that role is activated immediately after they sign in with SSO.
1. Click the app selector and select Admin.
2. Click Employees.
3. Click New Employee if you are setting up a new employee account. If you have already created the account, then select an employee from the list of users.
4. Click Primary Role.
5. Select one of the roles that you assigned to the federated identity login authenticator.

Configure Contact Handling Settings for ACD Routing

If you're using the CXone Mpower ACD and want to modify the employee's contact handling settings for interactions routed through it, finish creating the employee account. Then modify the contact settings in ACD Users. Otherwise, skip this step.

Unlock an Employee Account

When you unlock a user, they must log in within two days. Otherwise, their account locks again.

Click the app selector and select Admin.
Go to Security Settings > Locked Employees.
From the table, locate the user you want to unlock. At the end of the user's row, click the Actions icon and select Unlock User.

Force Reset an Employee's Password

You can force employees to reset their password on the Employees page. After you reset an employee's password, they are prompted to enter a new password the next time they log in.

Click the app selector and select Admin.
Click Employees.
In the search bar, enter the name of the employee.
Click the three stacked dots under Actions for the employee whose password you want to reset.
Click Reset P/W.

Edit Employee Username

You cannot edit the username of an employee who shows as Pending in the Status field.

You should never attempt to edit your own username. This can produce unexpected and undesirable results.

Make sure the employee whose username you want to edit is logged out of CXone Mpower. Editing the username of an employee that is logged in can cause issues.
Click the app selector and select Admin.
Click Employees and then click the employee profile you want to edit to open it.
Enter a new Username. The new username must be in the form of an email address. It cannot be a username that already exists in the same tenant.
Click Save.
Have the employee log in to CXone Mpower with their new username.
Logging out and logging back in with the new username will solve problems such as these:
- My Profile lists the old username.
- Navigation isn't working properly.
- The employee cannot change other usernames.
- The employee has refresh token issues.