Business Manager Unified Authentication for B2C Commerce

Security Stages

B2C Commerce provides five security stages in Business Manager that allow merchants to control the pace of their migration. Navigate to Administration > Global Preferences > Security in Business Manager to view and change your current stage.

Implementation Timeline

21.6 Release — June 2021

With the 21.6 Commerce Release, all Business Manager instances automatically migrated to Stage 2 — Unified Authentication Encouraged. At this stage:

• Users logging in with Business Manager credentials were presented with an option to link their Account Manager account.
• If a user did not yet have an Account Manager account, they could still log in with Business Manager credentials.
• Linking accounts at this stage was optional but strongly recommended before the 21.8 release.

21.8 Release — August 2021

With the 21.8 Commerce Release, all Business Manager instances migrated to Stage 3 — Unified Authentication Mandatory. At this stage:

• Business Manager users who had not linked their Account Manager account were blocked from logging in.
• Account linking was no longer available at this stage for users who had not previously linked.
• Administrators needed to assist blocked users by creating Account Manager accounts and re-linking manually.

System and Automation Users

System users (also called automation users or service accounts) that perform automated tasks against Business Manager — such as scheduled jobs, import/export processes, or API integrations — cannot be migrated to Unified Authentication. These users must instead authenticate using Access Keys.
To generate an Access Key for a system or automation user:

1. Log in to Account Manager at <REDACTED>.
2. Select the user account used for the automation.
3. Navigate to API Access Keys and select Create New Key.
4. Copy the generated key value — it is displayed only once.
5. Update your automation script or integration to use the Account Manager login email as the username and the Access Key as the password.

Access Points Requiring Access Keys After Migration

After Unified Authentication is enabled, the following access points no longer accept Business Manager username/password credentials. All require Access Key authentication using your Account Manager login and a generated Access Key:

• WebDAV (Web Distributed Authoring and Versioning) — used for cartridge deployment and file management
• Open Commerce API (OCAPI) — used for headless storefronts and third-party integrations
• UX Studio — used for storefront development and debugging

Access Key format for these access points:

Username: <your-account-manager-email>
Password: <your-generated-access-key>

Monitoring Migration Progress

Business Manager provides a Migration Status section within the Security settings screen that shows:

• The total number of Business Manager users in your instance
• The number of users who have linked their Account Manager account
• The percentage of users migrated, displayed as a progress indicator

To view migration status, navigate to Administration > Global Preferences > Security in Business Manager and scroll to the Migration Status section.

Real-World Scenarios

Scenario 1 — Developer using WebDAV for cartridge deployment

A development team uses WebDAV clients (such as Cyberduck or a VS Code WebDAV extension) to deploy cartridges to B2C Commerce. After Unified Authentication is enforced at Stage 4, the team's existing WebDAV connections using Business Manager credentials stop working. The correct resolution is to generate Access Keys in Account Manager for each developer and update the WebDAV client configuration to use the Account Manager email as the username and the Access Key as the password.

Scenario 2 — Merchant administrator preparing for mandatory enforcement

A merchant's Business Manager instance is currently at Stage 2 (Unified Authentication Encouraged). The merchant administrator has 45 Business Manager users, of whom 30 have already linked their Account Manager accounts. The administrator uses the Migration Status screen (Administration > Global Preferences > Security) to identify the 15 users who have not yet linked, and sends Account Manager invitation emails to those users before the 21.8 release enforces Stage 3.

Scenario 3 — User locked out after Stage 3 enforcement

A Business Manager user did not link their Account Manager account before Stage 3 was enforced. They attempt to log in and are blocked with an error. The merchant administrator must create an Account Manager account for the user, assign the appropriate B2C Commerce realm and roles, and inform the user to log in via Account Manager at <REDACTED>.

Troubleshooting

Issue: A user cannot log in to Business Manager after Stage 3 or Stage 4 is enforced.
Cause: The user's Business Manager account is not linked to an Account Manager account.
Resolution: The merchant administrator must create or locate the user's Account Manager account and assign them to the correct B2C Commerce realm with the appropriate roles. The user then logs in via Account Manager (<REDACTED>) to access Business Manager.

Issue: WebDAV, OCAPI, or Studio connections fail after enabling Unified Authentication.
Cause: These access points no longer accept Business Manager username/password credentials after migration.
Resolution: Generate an Access Key in Account Manager for the affected user or system account. Use the Account Manager email as the username and the Access Key as the password in the integration or client configuration.

Issue: The Security Stage selector is not visible in Business Manager.
Cause: The Business Manager user account does not have the Administrator role, or the instance has already reached Stage 4 (Unified Authentication Only) and the selector is no longer displayed.
Resolution: Confirm the logged-in user has the Administrator role in Account Manager. If the instance is at Stage 4, no further stage changes are possible — this is expected behavior.