How to Migrate to New Access Management System

Step-by-step guide to migrate your existing roles and permissions to the new Access Management system.

Available Plans

starter
growth
enterprise

5 minute read

Self-serve migration availability
The self-serve migration feature for users on the legacy RBAC system is currently gated and will be generally available on March 16, 2026.
Contact RudderStack Support if you’d like to enable it for your organization in the meantime.

This guide explains how to migrate your existing roles and permissions from the legacy Permissions Management (RBAC) system to the new Access Management system.

Quickstart summary

Migration in 5 minutes
Go to Settings > Access Management in your dashboard.
Click Import and choose your import strategy (start fresh or use existing policies).
Configure your Baseline Workspace Policy and create Groups for your teams.
Review Member Workspace Policies and adjust as needed.
Click Deploy to activate the new Access Management system.
Your existing permissions remain active until you deploy. You can reset and restart at any time before deployment.

Role mapping reference

The table below shows how roles in the legacy RBAC system map to the new Access Management system:

Legacy RBAC role	New Access Management equivalent	Notes
Admin	Organization Admin + Full workspace permissions	Admins retain full control. Organization-level Admin role is separate from workspace permissions.
Read-Write	Member Workspace Policy with Edit, Connect, Create & Delete permissions	Configure via Baseline Workspace Policy or individual Member Workspace Policy.
Read-Only	Member Workspace Policy with View-only permissions	Default for new members. Can be set via Baseline Workspace Policy.
Custom roles	Group Policies	Create groups (Data Engineers, Marketers, etc.) with specific permission sets.

When you choose the Use existing policies import strategy, RudderStack automatically maps your current roles to individual Member Workspace Policies. You can then organize members into Groups for easier management.

Migration overview

The migration process involves:

Importing your existing members (with or without their existing permissions) and Service Access Tokens into a staging area
Configuring access policies for your workspace, groups, and members
Deploying the changes to activate the new Access Management system

Your existing permissions will remain active until you deploy the new Access Management system.

Prerequisites

Important: See the Pre-migration Considerations guide to understand what to expect after migration
Only Admins will be able to perform the migration

Step 1: Import members and Service Access Tokens

Go to Settings > Access Management in your RudderStack dashboard.
You will see a Migration Status banner — review the migration progress and timeline.

In the Migration Progress section of the banner, click Import.
Choose your import strategy.

Strategy	Implications	Ideal if
Start fresh	RudderStack imports members with baseline, view-only permissions.	You want to start with a blank slate and build permissions policies from the ground up.
Use existing policies	RudderStack imports members with their existing permissions. Current user roles will be mirrored into the individual user’s Member Workspace Policy.	You want to retain the existing user permissions as is, without having to modify them later.

Service Access Tokens will be automatically imported with their current permissions in both import strategies.

Click on Import members or Import members with policies to complete the import process.

Step 2: Configure policies

After importing members, you can review and adjust the imported policies before deploying them.

Review and configure the Baseline Workspace Policy for your workspace.

Create new groups and configure their workspace policies with specific permission sets.

Fine-tune users’ Member Workspace Policy as needed.

You can reset the staging area at any time to revert any changes made to the policies and restart the migration process again.
See Reset staging area for more information.

Step 3: Deploy and enforce the new system

The deployment is irreversible
Make sure you’ve reviewed and configured all permissions correctly before deploying. After deployment, the new Access Management system will be active and the legacy RBAC system will no longer be available.

Review your staging area configuration to ensure all access policies are configured correctly.
In the Migration Progress section, click Deploy.
Confirm the deployment when prompted.

Once migration is complete, you will see the following banner:

After migration, you can leverage the new Access Management system to make any changes to the access policies — they will reflect in the workspace immediately.

Manage permissions after migration

Once migration is complete, you can:

Configure your Baseline Workspace Policy that automatically applies to all new members joining that workspace
Create new groups and fine-tune their workspace policy with specific permission sets
Fine-tune users’ Member Workspace Policy as needed

See the Policies Overview guide for more information.

Reset staging area

The migration staging area lets you configure and preview permissions policies before deploying them, allowing you to:

Review how your current permissions map to the new system
Make changes to policies without affecting your current permissions

Clicking on Reset staging area clears all imported members and policy configurations, allowing you to restart the migration process from scratch.

Troubleshooting

Issue	Solution
Import fails or does not complete	Try resetting the staging area and import again
Deploy button is disabled	Make sure the import step has completed successfully
Permissions don’t match expectations	Make sure you have selected the right import strategy. Reset the staging area and try again, if required Review the How Migration Works guide to understand how permissions are mapped You can also adjust member policies after deployment

See more

How Migration Works: Learn about the technical process of migration and what happens after deployment
Migration Scenarios: Understand how migration works in different scenarios