Siemens SIMATIC S7-1500 System Manual page 344

Introduction to the local user administration and access control
To restrict the PG/HMI access to the CPU at different levels, you configured passwords for the
corresponding access levels. With this procedure, for example, HMI accesses could be
permitted without restriction, but write accesses could be made dependent on the
knowledge of a password. You have agreed passwords for the different access levels in the
"Protection & Security" area of the CPU properties. The access protection therefore always
related to groups that have the appropriate passwords - not to individual users.
With the introduction of local user management and access control in TIA Portal version V19,
you use the "Security settings > Users and roles" area in the project tree in TIA Portal to
manage all users, together with their roles and function rights, of a CPU. This also applies to
the access protection for engineering/HMI access, which as of TIA Portal version V19 no
longer works via access levels with password protection by default, but also via user
management.
More information on the new access protection is available here (Page 347).
As already introduced, e.g. for engineering rights, you use role assignments for combining
individual function rights. In a further step, you assign the roles to individual users. All the
function rights which were assigned to a user via roles and which the user can exercise for
the corresponding CPU are listed In the "Assigned rights" tab.
The following figure shows an example of the available and activated function rights of a
CPU. At least one user must have full access to the CPU. Otherwise, the configuration cannot
be compiled. A role with full access to the CPU must be created for this.
Figure 11-1 Assigning function rights of a CPU to a role
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF
Protection
11.3 Local user management
343