All operations in this feature require Admin permissions.
Overview
This page explains user management on this service and the roles (permissions) you can assign. A key feature of this service’s role management is the ability to specify both permission scope and data scope.How to Configure
-
Go to Settings > Users. To add a new user, click Invite User. To update an existing user, click Edit Role. See Invite Users for the invitation flow.
-
Select a Basic Role and/or Advanced Role, then click Apply. You can assign multiple roles to a single user (up to 10 roles per user).
Types of Roles
Basic Roles
The following basic roles are available on this service.- If you invite a user without assigning any role, the minimum role (
Essential) is automatically granted, which only allows integration operations. - The Integrations menu is visible to all roles. Any role can perform integration operations on this service, but the user also needs admin-level permissions on the target service for the integration to succeed.
| Role | Description |
|---|---|
| Admin | Full access to all screens and operations. Cannot be combined with other roles. Even when SAML is configured, Admin users go through the standard login process (to prevent lockout). |
| Member | Read access to all menus except Settings and Spend. Can perform SaaS integrations. Cannot add, remove, or deactivate SaaS accounts from this service. Cannot view spend data. Cannot see the Files tab in external storage integrations. Cannot edit licenses in custom apps. |
| Spend Manager | Full management access to the Spend menu, including all operations. |
| Spend Viewer | Read-only access to the Spend menu. |
| Automation Manager | Full management access to the Automation menu, including all operations, management, and tracking. |
Advanced Roles
Service Manager
Grants permission to perform operations on this service for selected services. This includes viewing detailed account information and provisioning (adding accounts). It also includes deprovisioning (removing accounts) and viewing spend for those services. Setup steps (to let a user manage specific services)- Check Service Manager under Advanced Roles.
- Uncheck Allow access to all services.
- Select the services to manage, then set a role name and an optional note. If you have multiple workspaces, check each workspace where you want the permissions to apply.
- Auto-registered services and custom services cannot be in the same role. Create and apply separate roles for each.
- You can create a role without selecting any services. Create an empty role first, then add services later.
Service Viewer
Grants read-only access to detailed account information and contract/spend data for selected services. Follow the same setup steps as Service Manager above.Device Manager
Grants full management access to the Devices menu. Set the device types to manage, a role name, and an optional note.To assign or remove users, you must also assign the Member basic role.
Device Viewer
Displays device data for the approved device types in the Devices menu. Import and edit operations are not available. Set the device types to display, a role name, and an optional note.Directory Manager
Grants full management access to the Directory menu. Set the ID types, user types, a role name, and an optional note.Directory Viewer
Displays the Directory menu in read-only mode. Import, edit, delete, and archive operations are not available. Set the ID types, user types, a role name, and an optional note.Survey Manager
Grants full management access to the Survey menu. Set the survey categories to manage, a role name, and an optional note. Users with this role can create, edit, distribute, and delete surveys in the permitted categories.
Survey Viewer
Displays the Survey menu. Users can view survey results for permitted categories.Applying Saved Advanced Roles
Advanced roles you configure are saved as templates under Saved Advanced Roles and can be applied to other members. Use the three-dot menu [︙] on the right to edit or delete a saved role.
Configuration Examples
Let a SaaS administrator manage specific services
Let a SaaS administrator manage specific services
Advanced Role: Service Manager with the specific services selected
Let a device administrator manage only devices
Let a device administrator manage only devices
Advanced Role: Device Manager
Let an accountant manage SaaS costs
Let an accountant manage SaaS costs
For accountants or others who manage and operate spend:
- Basic Role: Spend Manager
- (If needed) Advanced Role: Service Manager with the relevant services selected
Deleting a User
-
Go to Settings > Users, then click the three-dot menu [︙] on the right and select Delete.
-
The Confirm User Deletion dialog appears. Review the details and click Delete.
FAQ
Q. How do I assign the Essential role?
A. To assign the Essential role, go to Settings > Users > Invite User. Enter only the email address without selecting any other options, then click Apply at the bottom of the screen.