# How to Migrate to New Access Management System


{{< announcement >}}
**Permissions Management (RBAC) deprecation timeline**

The legacy [Permissions Management (RBAC) system]({{< ref "access-management/glossary.md#role-based-access-control-rbac" >}}) will be **deprecated on October 31, 2026**. RudderStack recommends completing your migration before this date.

- [Understand the pre-migration considerations]({{< ref "access-management/pre-migration-considerations.md" >}})
- [Learn how the migration works]({{< ref "access-management/how-migration-works.md" >}})
{{< /announcement >}}

This guide explains how to migrate your existing roles and permissions from the [legacy Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md" >}}) to the new [Access Management system]({{< ref "access-management/overview.md" >}}).

## Quickstart

{{< success >}}
**Migration in 5 minutes**

1. Go to **Settings** > **Access Management** in your dashboard.
2. Click **Import** and choose your import strategy (start fresh or use existing policies).
3. Configure your [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}) and create [Groups]({{< ref "access-management/groups.md" >}}) for your teams.
4. Review [Member Workspace Policies]({{< ref "access-management/members.md" >}}) and adjust as needed.
5. Click **Deploy** to activate the new Access Management system.

Your existing RBAC permissions remain active until you deploy. You can reset and restart at any time before deployment.
{{< /success >}}

## Migration overview

The migration process involves: 

- Importing your existing members (with or without their existing permissions) and [Service Access Tokens]({{< ref "access-management/service-access-tokens.md" >}}) into a staging area
- Configuring [access policies]({{< ref "access-management/concepts.md#access-policy" >}}) for your workspace, groups, and members
- Deploying the changes to activate the new [Access Management system]({{< ref "access-management/overview.md" >}})

## Prerequisites

- Review [Pre-migration Considerations]({{< ref "access-management/pre-migration-considerations.md" >}}) to understand how your current permissions map to the new system and what to expect after deployment.
- Confirm you have [Admin]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) access — only Admins can perform the migration.

## 1. Import members and Service Access Tokens

1. Go to **Settings** > **Access Management** in your RudderStack dashboard.
2. You will see a **Migration Status** banner — review the migration progress and timeline.

{{< image src="images/access-management/migration/migration-banner-new.webp" alt="Migration banner" >}}

3. In the **Migration Progress** section of the banner, click **Import**.
4. Choose your [import strategy]({{< ref "access-management/pre-migration-considerations.md#import-strategy-decision" >}}).

{{< image src="images/access-management/migration/migration-strategy.webp" alt="Migration strategy selection" >}}

5. Click **Import members** or **Import members with policies** to complete the import process.

Note that:

- [Service Access Tokens]({{< ref "access-management/service-access-tokens.md" >}}) are automatically imported with their current permissions.
- Data Privacy (PII) permissions follow the same import strategy:

    - **Import members**: Data Privacy permissions from legacy member roles and allowlists are not preserved. You will need to review and configure PII permissions in the staging area before deploying the new Access Management system.
    - **Import members with policies**: Existing Data Privacy permissions are imported as part of each member's workspace policy mapping. Members on a workspace's Data Privacy allowlist receive workspace-wide PII permissions for Event Stream Sources, Destinations, and Transformations.

See [Pre-migration Considerations]({{< ref "access-management/pre-migration-considerations.md#data-privacy-permissions" >}}) for guidance on how to handle Data Privacy permissions before migration.

## 2. Configure policies

After importing members, you can review and adjust the imported policies before deploying them.

1. Review and configure the [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}) for your workspace.

{{< image src="images/access-management/migration/configure-baseline-workspace-policy.webp" alt="Configure baseline workspace policy" >}}

2. [Create new groups]({{< ref "access-management/groups.md#add-a-new-group" >}}) and configure their [workspace policies]({{< ref "access-management/groups.md#configure-group-workspace-policy" >}}) with specific permission sets.

{{< image src="images/access-management/migration/create-groups-new.webp" alt="Create groups" >}}

3. Fine-tune users' [Member Workspace Policy]({{< ref "access-management/members.md" >}}) as needed. See [Role mapping reference]({{< ref "access-management/how-migration-works.md#role-mapping-reference" >}}) for more information on how roles in the legacy RBAC system map to the new Access Management system.

{{< image src="images/access-management/migration/configure-member-policies-new.webp" alt="Configure member policies" >}}

## 3. Deploy and enforce the new system

{{< danger >}}
**The deployment is irreversible**

Make sure you've reviewed and configured all permissions correctly before deploying. After deployment, the new Access Management system will be active and the legacy RBAC system will **no longer be available**.
{{< /danger >}}

1. Review your staging area configuration to ensure all access policies are configured correctly.
2. In the **Migration Progress** section, click **Deploy**.
3. Confirm the deployment when prompted.

Once migration is complete, you will see the following banner:

{{< image src="images/access-management/migration/migration-success-banner.webp" alt="Migration complete banner" >}}

After migration, you can use the new Access Management system to change access policies — updates apply in the workspace immediately.

## Manage permissions after migration

Once migration is complete, you can:

- Configure your [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}) that automatically applies to all new members joining that workspace
- [Create new groups]({{< ref "access-management/groups.md#add-a-new-group" >}}) and fine-tune their [workspace policy]({{< ref "access-management/groups.md#configure-group-workspace-policy" >}}) with specific permission sets
- Fine-tune users' [Member Workspace Policy]({{< ref "access-management/members.md" >}}) as needed

See the [Policies Overview]({{< ref "access-management/policies-overview.md" >}}) guide for more information.

## Staging area

During migration, the new Access Management system is in **Preview Mode** — a staging area where you configure and preview policies before deployment. The dashboard shows a **Preview Mode** badge on the Access Management page while you are in staging.

In Preview Mode, you can:

- Review how your current permissions map to the new system
- Adjust policies **without affecting** permissions currently enforced in the [Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md" >}})

{{< info >}}
**Important considerations**

- Until you deploy, your existing RBAC permissions remain in effect for all live access. 
- In **Preview Mode**, new members invited through the Access Management system will not get workspace access until you deploy. To invite users immediately, use the [Invite users]({{< ref "archive/dashboard-guides/user-management.md#invite-users" >}}) flow in the RBAC system.
{{< /info >}}

Click **Reset staging area** to clear all imported members and policy configurations and restart the migration process from scratch.

{{< image src="images/access-management/migration/reset-staging-area.webp" alt="Reset staging area" >}}

## Troubleshooting

| Issue | Solution |
| :----| :----|
| Import fails or does not complete | Try resetting the staging area and import again |
| Deploy button is disabled | Make sure the import step has completed successfully |
| Permissions don't match expectations | <ul><li>Make sure you have selected the right [import strategy]({{< ref "access-management/pre-migration-considerations.md#import-strategy-decision" >}}). Reset the staging area and try again, if required</li><li>Review the [How Migration Works]({{< ref "access-management/how-migration-works.md" >}}) guide to understand how permissions are mapped</li><li>You can also adjust member policies after deployment</li></ul> |

## See more

- [How Migration Works]({{< ref "access-management/how-migration-works.md" >}}): Learn about the technical process of migration and what happens after deployment
- [Migration Scenarios]({{< ref "access-management/migration-examples/" >}}): Understand how migration works in different scenarios