Creating custom roles

This topic is not applicable if you're working in a child account within a pan-tenant environment. User roles are managed from the parent account.

Creating a custom role involves defining its name, description, and permissions, with two additional optional steps if you want to assign users to the role or specify which roles it can manage during the creation process.

Alternatively, you can copy an existing role and modify the permissions.

To create a new custom role:

1. Log in to the Secure Endpoint Console as a System Administrator.
2. On the navigation bar, click Settings > User management > Roles.
3. Click Create role.

4. Click the role name and enter a descriptive title to help you identify the role.

   The name can be a maximum of 255 characters. If you don't update the name of the role, the role is called Custom role - <Date>.

5. [Optional] Enter a description.

   The description can be a maximum of 1000 characters

6. Under Permissions, do the following:

   1. To ensure that the user can access basic console functionality, including Device Details, select the following permissions:

      • View permissions for Device Fields
      • View permissions for Device reports

   2. To assign additional permissions for the features that you want the role to have access to, do the following:

      • To assign view and export (if applicable) permissions for a feature, select the View checkbox.
      • To assign view, export (if applicable), and edit permissions for a feature, select the Manage checkbox. The View checkbox is selected automatically.
      • To assign Activate, Publish, Run, or Perform permissions for a feature, select the feature's applicable Other Actions checkbox. If a View checkbox is associated with the feature, select it as well.

7. If you want to assign users to this role now, under Assigned users, do the following:

   1. Click Assign users to show a list of available users. To filter the list, enter all or part of a name or email address in the field.
   2. Select each user with an Active status that you want to assign to the role.
   3. When you're done, click outside the list. To remove a user you've selected, click next to the user.

8. If you want to assign roles that this role can manage, under Manageable roles, do the following:

   1. Click Assign roles to show a list of available roles. To filter the list, enter all or part of a role name or description in the field.
   2. Select each role that you want this role to be able to manage. Managing a role includes assigning the role to users and editing users assigned to that role.
   3. When you're done, click outside the list. To remove a role you've selected, click next to the role.
   4. To allow this role to manage other users assigned to the same role, select the checkbox next to Allow self-management.
9. Click Save. A Role created event is logged to Event History.
10. [Optional] Assign limits on the role for the number of Device Action requests that can be completed before the request must be authorized.
11. If you want other roles to be able to manage the new role you created, edit each role's managed roles.