Concepts
Roles
What Admin, Staff and Read-only users can do.
Each person has one of three access levels. Your level shows in the user menu.
| Level | In the console's words |
|---|---|
| Admin | Everything, including users, settings and billing. |
| Staff | Adds clients, asks devices to audit and dismisses findings. Can't change policy or settings. |
| Read-only | Sees every page but can't change anything. |
The person who signs up is the first admin. Admins add everyone else on the Users page and change levels there.
With the SSO add-on, people on your verified domains join on their own at the level you choose: Staff or Read-only. Nobody joins as an admin.
What each level can do
| Action | Admin | Staff | Read-only |
|---|---|---|---|
| See clients, devices, tools and policy | Yes | Yes | Yes |
| Add a client | Yes | Yes | No |
| Audit a device or a client, and cancel | Yes | Yes | No |
| Dismiss a tool, and undo | Yes | Yes | No |
| Create and revoke enrolment tokens, download MDM profiles | Yes | No | No |
| Retire or uninstall a device | Yes | No | No |
| Set policy, triage, review, approve accounts | Yes | No | No |
| Change client and organisation settings, including agent updates | Yes | No | No |
| Manage users and SSO | Yes | No | No |
| Billing and Panoptic support access | Yes | No | No |
Controls you cannot use are hidden.
Panoptic support
With Make changes access, Panoptic support can do what an admin can, except billing, support access, SSO, adding users, giving access back and first-run setup. With View access, support can change nothing. See Support access.