What changed
Administrators can now scope individual roles held by Authorized Organizations users and groups to one or more divisions, the same division-based scoping already available for other Genesys Cloud users and groups. Previously those roles could only apply to All Divisions. Separately, Web Directory now authenticates with Proof Key for Code Exchange (PKCE), which keeps access tokens out of browser URLs; Genesys says this addresses authentication findings raised in security assessments and rolls out across regions over two weeks.
Vendor documentation (opens in a new tab)Why it matters
Partner, outsourcer and managed-service access granted through Authorized Organizations has been all-or-nothing across divisions, which is hard to justify in least-privilege reviews. Division scoping closes that gap, and the PKCE change removes a token-exposure finding that often appears in penetration tests.
CxCave practical context
Who should care
- Security and compliance teams
- Administrators
Implementation considerations
REVIEWList roles granted to Authorized Organizations users and groups, scope each to the divisions that partner actually needs, and close any open security finding about tokens in Web Directory URLs once PKCE reaches your region.
CxCave recommendation, not a vendor mandate unless explicitly stated.