Complete list of permissions applicable for user roles

Permission	Default binded to role	Mandatory	Optional	Description
Cross Application Administrators	Configurable admin \| app admin \| Associated by default	Yes		`Administrators have cross applications privileges` `Operational note: treated as super-admin.`
Application Administrators	Configurable app admin \| Associated by default	Yes		`Application Administrators have permision to manage accounts,devices and see reports Operational note: treated as super-admin`
System Administrators	Configurable sysconfig \| Associated by default	yes		`System Administrators manage system settings, device settings, run scripts Operational note: treated as super-admin`
Certificate Administrators	`Configurable only`		Yes	`Certificate Administrators manage system and devices certificates`
ACL Administrator	`Configurable only`		Yes
License Administrators	`Configurable only`		Yes	`User can manage license agreement`
Configuration settings administrators	`Configurable only`		Yes	`User can manage system settings and device configuration settings`
Invitation code management	`Configurable only`		Yes	`User can do invitation code management`
Enrolment tracker control	`Configurable only`		Yes	`User can do enrolment tracker control`
Reset user PIN	techsupport	Yes		`User can reset independent PIN for any identity`
Run configuration settings	`Configurable only`		Yes	User can run scripts to update system settings and device settings
Write license agreement	`Configurable only`		Yes	User can update license agreement
Write configuration settings	`Configurable only`		Yes	User can write system settings and device configuration settings
Full Access to Orchestrator	`Configurable only`		Yes	Grants the user permission to view and modify orchestrator data.
Read license agreement	Configurable only		Yes	User has read only access to license agreement
Read configuration settings	Configurable only		Yes	User has read only access to system settings and device configuration settings
Monitoring data	Configurable only		Yes	User can visualize monitoring part under tools
Dashboard data	Configurable only		Yes	User can visualize dashboard screen
View AD details	Configurable only		Yes	User can visualize AD details
View location	Configurable only		Yes	User can visualize location
View ILP info	Configurable only		Yes	User can visualize ILP info
View session details raw	Configurable only		Yes	User can visualize session details raw
View history details	Configurable only		Yes	User can visualize history details
Read-Only Access to Orchestrator	Configurable only		Yes	Grants the user permission to view orchestrator data without making any modifications.
Unblock identity	techsupport \|	Yes
Technical Support	techsupport \|	Yes
Devices administrators			Yes	User can manage devices
Accounts administrators	Configurable only		Yes	User can manage accounts
Permissions administrators	Configurable only		Yes	User can manage permissions
Members profiles administrators	Configurable only		Yes	User can manage members profiles
Early warning system administrators	Configurable only		Yes	User can manage data of Early Warning System
Mobile settings administrators	Configurable only		Yes	User can manage mobile settings
Accounts sites administrators	Configurable only		Yes	User can manage accounts sites
Alerts Administrators	alerts	Yes		User can manage alerts
Run test	tester	Yes		User can run maintenance tests
Analyse data	analyst	Yes		User can analyse statistics data
Deprovision identities	Configurable only		Yes	User can view and deprovision current identities
View all users	Configurable only		Yes	User does not have user segregation rule applied Disables user segregation when segregation is enabled.
Execute EWS job	Configurable only		Yes	User can execute EWS jobs
Run mobile settings	Configurable only		Yes	User can run scripts to update mobile settings
Write devices	Configurable only		Yes	User can write devices definitions
Write accounts	Configurable only		Yes	User can write accounts definitions
Write permissions	Configurable only		Yes
Write members profiles	Configurable only		Yes
Write EWS data	Configurable only		Yes
Write mobile settings	Configurable only		Yes
Wrote accounts sites	Configurable only		Yes
Write alerts	Configurable only		Yes
Read devices	Configurable only		Yes
Read accounts	Configurable only		Yes
Read permissions	Configurable only		Yes
Read members profiles	Configurable only		Yes
Read EWS data	Configurable only		Yes
Read mobile settings	Configurable only		Yes
Read accounts sites	Configurable only		Yes
Read alerts	Configurable only		Yes	User has read only access to alerts
Infrastructure operations	Configurable only		Yes	User perform changes on Infrastructure Review flag: used by infrastructure endpoints;
Write device status	Configurable only		Yes	User can change device status Review flag: used by device status endpoints;
Write account status	Configurable only		Yes	User can change account status Review flag: used by identity status endpoints;
ILP View Statistics	appadmin, admin, sysconfig	Yes		User can visualize ILP statistics Review flag: used by Kibana/ILP statistics endpoints
System history	Configurable only		Yes	User can access system history
System logging	Configurable only		Yes	User can access system logs
User can load reports	reports			User can load reports
View accounty History
View Device History	Configurable only		Yes	User can view the device history table and details
Use invitation contact details	Configurable appadmin, admin Associated by default	Yes		Dedicated permission to manage Enrollment Code generation to use invitation contact details. Used when enrollment code generation validates invitation contact details.
Users sessions	Configurable only		Yes	User read sessions statistics
Default client access	active	Yes		Default user access to application functionalities
Shared device access	shareddevice \|	Yes		Shared device access to application functionalities
Default user	active \| default \| shareddevice \|	Yes		User is registered in the system with no access to application functionalities
SSP access	\| default \|	Yes		User is registered in the system with no access to application functionalities
Enroll Account	default \|	Yes		User can enroll account Used by delegated SSP enrollment checks.