# User Role and Permission

This document will explain the roles and permissions which can be mapped for users. For roles related to Endpoint security, [click here](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/user_role_and_permission.html#security).

The default roles available in Endpoint Central are given below:

- **Administrator**

A user with Administrator role will have complete access to all the features available in Endpoint Central.

- **Auditor**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ❌ | ❌ | ❌ | ✅ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Tools | ❌ | ❌ | ❌ | ✅ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ✅ | ❌ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ❌ | ✅ |
| App Management | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ✅ | ❌ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ❌ | ❌ | ❌ | ✅ |
| OS Update Management | ❌ | ❌ | ❌ | ✅ |
| Remote Control | ❌ | ❌ | ❌ | ✅ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

- **Guest**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ✅ | ❌ |
| Patch Management | ❌ | ❌ | ✅ | ❌ |
| Software Deployment | ❌ | ❌ | ✅ | ❌ |
| Inventory | ❌ | ❌ | ✅ | ❌ |
| Tools | ❌ | ❌ | ✅ | ❌ |
| Remote Desktop Sharing | ❌ | ❌ | ✅ | ❌ |
| Report | ❌ | ❌ | ✅ | ❌ |
| SoM | ❌ | ❌ | ✅ | ❌ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ✅ | ❌ |
| App Management | ❌ | ❌ | ✅ | ❌ |
| Inventory | ❌ | ❌ | ✅ | ❌ |
| Report | ❌ | ❌ | ✅ | ❌ |
| Enrollment | ❌ | ❌ | ✅ | ❌ |
| Content Management | ❌ | ❌ | ✅ | ❌ |
| OS Update Management | ❌ | ❌ | ✅ | ❌ |
| Remote Control | ❌ | ❌ | ✅ | ❌ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ✅ | ❌ |
| Deployment | ❌ | -- | ✅ | ❌ |

- **IT Asset Manager**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ❌ | ❌ | ❌ | ✅ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ✅ | ✅ | ✅ | ❌ |
| Tools | ❌ | ❌ | ❌ | ✅ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ❌ | ✅ |
| App Management | ❌ | ❌ | ❌ | ✅ |
| Inventory | ✅ | ✅ | ✅ | ❌ |
| Report | ❌ | ❌ | ❌ | ✅ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ❌ | ❌ | ❌ | ✅ |
| OS Update Management | ❌ | ❌ | ❌ | ✅ |
| Remote Control | ❌ | ❌ | ❌ | ✅ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

- **Mobile Device Manager**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ❌ | ❌ | ❌ | ✅ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Tools | ❌ | ❌ | ❌ | ✅ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Create Profile Management | ✅ | ✅ | ✅ | ❌ |
| Create App Management | ✅ | ✅ | ✅ | ❌ |
| Create Inventory | ✅ | ✅ | ✅ | ❌ |
| Create Report | ✅ | ✅ | ✅ | ❌ |
| Enrollment | ✅ | ✅ | ✅ | ❌ |
| Content Management | ✅ | ✅ | ✅ | ❌ |
| OS Update Management | ✅ | ✅ | ✅ | ❌ |
| Remote Control | ✅ | ✅ | ✅ | ❌ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

- **OS Deployer**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ❌ | ❌ | ❌ | ✅ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Tools | ❌ | ❌ | ❌ | ✅ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ❌ | ✅ |
| App Management | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ❌ | ❌ | ❌ | ✅ |
| OS Update Management | ❌ | ❌ | ❌ | ✅ |
| Remote Control | ❌ | ❌ | ❌ | ✅ |
| **OSD Control** |  |  |  |  |
| Imaging | ✅ | -- | ❌ | ❌ |
| Deployment | ✅ | -- | ❌ | ❌ |

- **Patch Manager**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ✅ | ✅ | ✅ | ❌ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Tools | ❌ | ❌ | ❌ | ✅ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ❌ | ✅ |
| App Management | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ❌ | ❌ | ❌ | ✅ |
| OS Update Management | ❌ | ❌ | ❌ | ✅ |
| Remote Control | ❌ | ❌ | ❌ | ✅ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

- **Remote Desktop Viewer**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ❌ | ❌ | ❌ | ✅ |
| Patch Management | ❌ | ❌ | ❌ | ✅ |
| Software Deployment | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Tools | ✅ | ✅ | ✅ | ❌ |
| Remote Desktop Sharing | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ❌ | ❌ | ❌ | ✅ |
| App Management | ❌ | ❌ | ❌ | ✅ |
| Inventory | ❌ | ❌ | ❌ | ✅ |
| Report | ❌ | ❌ | ❌ | ✅ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ❌ | ❌ | ❌ | ✅ |
| OS Update Management | ❌ | ❌ | ❌ | ✅ |
| Remote Control | ❌ | ❌ | ❌ | ✅ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

- **Technician**

| Module Name | Full Control | Write | Read | No Access |
|---|---|---|---|---|
| **Desktop Control** |  |  |  |  |
| Configurations | ✅ | ✅ | ✅ | ❌ |
| Patch Management | ❌ | ❌ | ✅ | ❌ |
| Software Deployment | ✅ | ✅ | ✅ | ❌ |
| Inventory | ❌ | ❌ | ✅ | ❌ |
| Tools | ✅ | ✅ | ✅ | ❌ |
| Remote Desktop Sharing | ❌ | ❌ | ✅ | ❌ |
| Report | ❌ | ❌ | ✅ | ❌ |
| SoM | ❌ | ❌ | ❌ | ✅ |
| **MDM Control** |  |  |  |  |
| Profile Management | ✅ | ✅ | ✅ | ❌ |
| App Management | ✅ | ✅ | ✅ | ❌ |
| Inventory | ✅ | ✅ | ✅ | ❌ |
| Report | ✅ | ✅ | ✅ | ❌ |
| Enrollment | ❌ | ❌ | ❌ | ✅ |
| Content Management | ✅ | ✅ | ✅ | ❌ |
| OS Update Management | ✅ | ✅ | ✅ | ❌ |
| Remote Control | ✅ | ✅ | ✅ | ❌ |
| **OSD Control** |  |  |  |  |
| Imaging | ❌ | -- | ❌ | ✅ |
| Deployment | ❌ | -- | ❌ | ✅ |

## Roles related to Endpoint Security

| Action | Full Control | Write | Read |  |
|---|---|---|---|---|
| **Application Control Manager** |  |  |  |  |
| Application Control | ✅ | ❌ | ❌ |  |
| Application Control Reports | ✅ | ❌ | ❌ |  |
| **Bitlocker Manager** |  |  |  |  |
| Bitlocker | ✅ | ❌ | ❌ |  |
| Bitlocker Reports | ✅ | ❌ | ❌ |  |
| **Browser Security Manager** |  |  |  |  |
| Browser Security | ✅ | ❌ | ❌ |  |
| **Device Control Manager** |  |  |  |  |
| Device Control | ✅ | ❌ | ❌ |  |
| Device Control Reports | ✅ | ❌ | ❌ |  |
| **Security Manager** |  |  |  |  |
| Patch Management | ✅ | ❌ | ❌ |  |
| Vulnerability Management | ✅ | ❌ | ❌ |  |
| Browser Security | ✅ | ❌ | ❌ |  |
| Device Control | ✅ | ❌ | ❌ |  |
| Bitlocker | ✅ | ❌ | ❌ |  |
| Application Control | ✅ | ❌ | ❌ |  |
| Reports | ✅ | ❌ | ❌ |  |
| Scope of Management | ✅ | ❌ | ❌ |  |

You can also create roles and customize it based on your requirement. The below table explains in detail about the permissions that can be specified while creating/modifying a role in Endpoint Central.

1. For build numbers below `100646`
2. For build numbers `100646` or above

## For build numbers below `100646`

The permissions include detailed control over:

- Configuration
- Patch Management
- Software Deployment
- Inventory
- Tools
- Reports
- SoM
- Global Settings
- Report Settings
- Admin Tools

(Refer to the detailed matrix above for full control, write, and read permissions per action.)

## For build numbers `100646` or above

The permissions for users with write access in software deployment module have been revised from build number `100646` as per customer request.

The revised permission structure follows the same module breakdown as above, with updates specifically in the **Software Deployment** section regarding:

- Create Software Package
- Install/Uninstall Software
- Package Templates
- Repository Settings
- Self Service Portal
- Save as New from Packages

(Refer to the detailed matrix above for updated Full Control, Write, and Read mappings.)