# Understanding User Roles in Endpoint DLP Plus

Last Updated On: 13 Oct 2026

This document will explain the **User Roles** and permissions which can be mapped for users. Creating various users with only certain roles and permissions allow you to have a more robust control over who does what with the product. For a detailed understanding about the various user roles and the associated scope offered by the product, refer to the doc on [Role differences](https://www.manageengine.com/endpoint-dlp/help/access-management/role-difference.html).

To create a new user, navigate to **Admin -> General Settings -> User Administration -> Add User**

To create a new user, navigate to **Admin -> User Administration -> Add User**

![Understanding user roles](https://www.manageengine.com/sites/meweb/images/desktop-central/help/osd/1774960248667.webp)

To create a new role, navigate to **Admin -> General Settings -> User Administration -> Add Role**

![Understanding user roles](https://www.manageengine.com/sites/meweb/images/desktop-central/help/osd/1774960199606.webp)

| User Role | Configurations | Patch Management | Software Deployment | Inventory | Tools | Remote Desktop Sharing | Report | MDM Control Modules | OS Imaging | OS Deployment | Sensors | Endpoint Analytics | Workflow | Query Reports | Scope Of Management |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| **Administrator** | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control |
| **Auditor** | No Access | No Access | No Access | No Access | No Access | No Access | Read Access | Read Access to Reports | No Access | No Access | No Access | No Access | No Access | No Access | No Access |
| **Guest** | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | Read Access | No Access | No Access |
| **IT Asset Manager** | No Access | No Access | No Access | Full Control | No Access | No Access | No Access | Full Control over Inventory | No Access | No Access | Read Access | Read Access | Read Access | No Access | No Access |
| **Endpoint DLP Plus** | Full Control | Full Control | No Access | No Access | No Access | No Access | No Access | No Access | Full Control | Full Control | No Access | No Access | No Access | No Access | No Access |
| **Patch Manager** | No Access | Full Control | Full Control | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access |
| **Remote Desktop Viewer** | No Access | No Access | No Access | No Access | Full Control | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access |
| **Technician** | Full Control | Read Access | Full Control | No Access Read Access | Full Control | No Access | No Access Read Access | No Access | No Access | Write Access | Write Access | Write Access | No Access | No Access | No Access |
| **Mobile Device Manager** | Full Control | Full Control | Full Control | Full Control | Full Control | No Access | Full Control except Device Enrollment | No Access | No Access | No Access | No Access | No Access | No Access | No Access | No Access |

| MDM Control | Create Profile Management | Create App Management | Create Inventory | Create Report | Enrollment | Content Management | OS Update Management | Remote Control |
|---|---|---|---|---|---|---|---|---|
| **Mobile Device Manager** | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control | Full Control |

The following are the roles within the Endpoint Security.

| Role | Description |
|---|---|
| Application Control Manager | This role provides the user with full control over application control and application control reports. |
| Bitlocker Manager | This role provides the user with full control of BitLocker management and reports. |
| Browser Security Manager | This role provides the user with full control of Browser Security functions. |
| Device Control Manager | This role provides the user with full control of Device Control functions and reports. |
| Security Manager | This role provides the user with full control of Security Manager functions such as BitLocker Management, Patch Management, Application Control and Vulnerability Management amongst others. |

**Note:** Apart from these predefined roles, you can create multiple custom roles based on your organization's access requirements. You are not limited to one role of each type, multiple roles can be created to suit different access needs within your organization.