Understanding User Roles in Endpoint Central

Last Updated On: 11 Oct 2026|

44 minutes read |

This document will explain the User Roles and permissions which can be mapped for users. Creating various users with only certain roles and permissions allow you to have a more robust control over who does what with the product. For a detailed understanding about the various user roles and the associated scope offered by the product, refer to the doc on Role differences

To create a new user, navigate to Admin -> General Settings -> User Administration -> Add User

To create a new role, navigate to Admin -> General Settings -> User Administration -> Add Role

Pre-defined Roles

Pre-defined roles are built-in roles that represent common IT team profiles. They cannot be modified. The roles and modules shown depend on your product.

Administrator

Administrators have unrestricted access to all modules and settings in Endpoint Central. This is the highest-privilege pre-defined role and should be assigned only to personnel responsible for managing the full product.

Module	Access Level	Description
Configurations	Full Control	Create, edit, deploy, and delete all user and computer configurations and templates.
Patch Management	Full Control	Manage all patching features: approval settings, deployment policies, automated patch deployment, system health policies, and patch database settings.
Software Deployment	Full Control	Create software packages, deploy and remove software, manage templates, and configure the Self Service Portal and its settings.
Inventory	Full Control	View, edit, and manage all hardware and software inventory, license records, and scan configurations.
Tools	Full Control	Access all Remote System Manager features: Task Manager, Services, Terminal, Wake on LAN, Remote Shutdown, Chat, and Announcements.
Remote Desktop Sharing	Full Control	Initiate and manage remote control sessions, view session history, and configure session confirmation requirements.
Reports	Full Control	View, create, schedule, and export all pre-defined, custom, and module-based reports.
MDM Control Modules	Full Control	Manage all MDM capabilities: profile management, app management, inventory management, OS updates, and remote control.
OS Imaging	Full Control	Create and manage OS imaging configurations, boot media, and deployment templates.
OS Deployment	Full Control	Configure and execute OS deployments, including tasks and post-deployment actions.
Sensors	Full Control	Create, configure, and manage sensor-based monitoring rules and alerts.
Endpoint Analytics	Full Control	Access and manage all endpoint analytics dashboards, reports, and configurations.
Workflow	Full Control	Create, modify, and manage all workflow automations and approval processes.
Query Reports	Full Control	Create, run, and manage custom query-based reports across all modules.
Scope of Management	Full Control	Add and remove computers, manage Remote Offices, install and uninstall agents, and configure settings.
Application Control	Full Control	Create and manage application groups, policies, privilege groups, and exclusion policies.
Device Control	Full Control	Create and manage Device Control policies, trusted device records, temporary access, and extension groupings.
BitLocker Management	Full Control	Create and manage BitLocker policies, deploy them to devices, and view recovery keys.
Browser Security	Full Control	Create and manage browser security policies, URL filtering rules, and browser configurations.
Endpoint DLP	Full Control	Manage all Endpoint DLP Plus features, including data loss prevention policies.
Vulnerability Management	Full Control	View, assess, and remediate detected vulnerabilities. Configure misconfiguration rules and scan settings.

Auditor

Auditors have read-only access to reports and limited read access to MDM report data. They cannot view or interact with any operational module. This role is intended for compliance reviewers and internal audit teams who need report visibility without operational access.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	No Access	Cannot view patch status, deployment tasks, or any patch management data.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	Read Access	View all standard reports across the product. Cannot create, schedule, or export reports.
MDM Control Modules	Read Access	View MDM reports only. Cannot access MDM operational features such as profiles or enrollment.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Guest

Guests have read-only access to most operational modules. They cannot modify settings, perform actions, run query reports, or access scope management. This role is suited for stakeholders who need visibility into the environment without the ability to make changes.

Module	Access Level	Description
Configurations	Read Access	View existing configurations and deployment status. Cannot create, edit, or delete configurations.
Patch Management	Read Access	View patch status, deployment tasks, and policies. Cannot approve, deploy, or modify any patches.
Software Deployment	Read Access	View software packages and deployment status. Cannot deploy, remove, or create packages.
Inventory	Read Access	View hardware and software inventory data. Cannot modify records, manage licenses, or configure scans.
Tools	Read Access	View Remote System Manager data such as session history and system information. Cannot perform actions.
Remote Desktop Sharing	Read Access	View remote session history. Cannot initiate remote control sessions or modify session settings.
Reports	Read Access	View all standard reports. Cannot create, schedule, or export reports.
MDM Control Modules	Read Access	View MDM module data across all control areas. Cannot modify any MDM settings or configurations.
OS Imaging	Read Access	View OS imaging configurations and templates. Cannot create or modify imaging settings.
OS Deployment	Read Access	View OS deployment tasks and configurations. Cannot create or execute deployments.
Sensors	Read Access	View sensor configurations and monitoring data. Cannot create or modify sensor rules.
Endpoint Analytics	Read Access	View endpoint analytics dashboards and reports. Cannot modify analytics settings.
Workflow	Read Access	View workflow configurations and status. Cannot create or modify workflows.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	Read Access	View Application Control policies and groups. Cannot create, modify, or delete policies or groups.
Device Control	Read Access	View Device Control policies and trusted device records. Cannot create, modify, or publish policies.
BitLocker Management	Read Access	View BitLocker policies and encryption status. Cannot create, modify, or deploy policies.
Browser Security	Read Access	View Browser Security policies and configurations. Cannot create or modify policies.
Endpoint DLP	Read Access	View Endpoint DLP policies and incidents. Cannot create, modify, or delete policies.
Vulnerability Management	Read Access	View vulnerability scan results and remediation status. Cannot configure scan settings or initiate scans.

IT Asset Manager

IT Asset Managers have full control over Inventory and MDM Inventory, and read-only access to Sensors, Endpoint Analytics, and Workflow. All other modules are inaccessible. This role is designed for personnel responsible for tracking and managing the organization's hardware and software assets.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	No Access	Cannot view patch status, deployment tasks, or any patch management data.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	Full Control	View, edit, and manage all hardware and software inventory, license records, and scan configurations.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	Full Control	Full control over MDM Inventory. Cannot access other MDM areas such as profile management or remote control.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	Read Access	View sensor configurations and monitoring data. Cannot create or modify sensor rules.
Endpoint Analytics	Read Access	View endpoint analytics dashboards and reports. Cannot modify analytics settings.
Workflow	Read Access	View workflow configurations and status. Cannot create or modify workflows.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

OS Deployer

OS Deployers have full control over OS Imaging and OS Deployment, together with Configurations and Patch Management. All other modules are inaccessible. This role is intended for technicians responsible for operating system provisioning and imaging workflows.

Module	Access Level	Description
Configurations	Full Control	Create, edit, deploy, and delete all user and computer configurations and templates.
Patch Management	Full Control	Manage all patching features: approval settings, deployment policies, automated patch deployment, system health policies, and patch database settings.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	No Access	Cannot access MDM features.
OS Imaging	Full Control	Create and manage OS imaging configurations, boot media, and deployment templates.
OS Deployment	Full Control	Configure and execute OS deployments, including tasks and post-deployment actions.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Patch Manager

Patch Managers have full control over Patch Management and Software Deployment. All other modules are inaccessible. This role is designed for administrators whose responsibility is managing operating system and application patches across the environment.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	Full Control	Manage all patching features: approval settings, deployment policies, automated patch deployment, system health policies, test groups, and patch database settings.
Software Deployment	Full Control	Create software packages, deploy and remove software, manage templates, and configure the Self Service Portal and its settings.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	No Access	Cannot access MDM features.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Remote Desktop Viewer

Remote Desktop Viewers can start remote desktop connections and view details of users who have connected to a system. All other modules are inaccessible. This role is suited for IT support staff who need remote connectivity without access to policy or deployment features.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	No Access	Cannot view patch status, deployment tasks, or any patch management data.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	Full Control	Access all Remote System Manager features: Task Manager, Services, Terminal, Wake on LAN, Remote Shutdown, Chat, and Announcements.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	No Access	Cannot access MDM features.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Technician

Technicians have a defined set of permissions for specific operations. They cannot perform the administrative operations on the Admin tab, such as defining the Scope of Management or changing mail server settings. Technicians can define and deploy configurations and collections, view all configurations (including those created by other users), suspend, modify, or redeploy the configurations that they defined, update the Vulnerability Database, and scan all modules.

Module	Access Level	Description
Configurations	Full Control	Create, edit, deploy, and delete all user and computer configurations and templates.
Patch Management	Read Access	View patch status, deployment tasks, and policies. Cannot approve, deploy, or modify any patches.
Software Deployment	Full Control	Create software packages, deploy and remove software, manage templates, and configure the Self Service Portal and its settings.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	Full Control	Access all Remote System Manager features: Task Manager, Services, Terminal, Wake on LAN, Remote Shutdown, Chat, and Announcements.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	No Access	Cannot access MDM features.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	Write Access	Write access to OS Deployment.
Sensors	Write Access	Write access to Sensors.
Endpoint Analytics	Write Access	Write access to Endpoint Analytics.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Mobile Device Manager

Mobile Device Managers have access only to Mobile Device Management features. All other modules are inaccessible. This role is designed for administrators managing the organization's mobile device fleet.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	No Access	Cannot view patch status, deployment tasks, or any patch management data.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM: Profile Management	Full Control	Create, deploy, and manage device configuration profiles, including Wi-Fi and VPN.
MDM: App Management	Full Control	Deploy, update, and remove applications on managed mobile devices.
MDM: Inventory	Full Control	View and manage mobile device hardware and software inventory.
MDM: Reports	Full Control	View and export all MDM reports.
MDM: Enrollment	Full Control	Enroll and manage mobile devices. Configure enrollment settings and manage devices.
MDM: Content Management	Full Control	Manage and distribute content to enrolled mobile devices.
MDM: OS Update Management	Full Control	Configure and manage OS update policies for mobile devices.
MDM: Remote Control	Full Control	Initiate remote control sessions on managed mobile devices.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	No Access	Cannot access Vulnerability Management features or reports.

Vulnerability Manager

Vulnerability Managers have full control over the Vulnerability Management module only. All other modules are inaccessible. This role is designed for security administrators responsible for identifying, assessing, and remediating vulnerabilities across the managed endpoint estate.

Module	Access Level	Description
Configurations	No Access	Cannot view or interact with configuration settings or deployed configurations.
Patch Management	No Access	Cannot view patch status, deployment tasks, or any patch management data.
Software Deployment	No Access	Cannot view software packages, deployments, or the Self Service Portal.
Inventory	No Access	Cannot access hardware or software inventory data.
Tools	No Access	Cannot access any Remote System Manager features.
Remote Desktop Sharing	No Access	Cannot initiate or view any remote control sessions.
Reports	No Access	Cannot access standard or custom reports.
MDM Control Modules	No Access	Cannot access MDM features.
OS Imaging	No Access	Cannot access OS imaging features.
OS Deployment	No Access	Cannot access OS deployment features.
Sensors	No Access	Cannot access sensor configurations or monitoring data.
Endpoint Analytics	No Access	Cannot access endpoint analytics dashboards or data.
Workflow	No Access	Cannot view or interact with workflow configurations.
Query Reports	No Access	Cannot create or run query-based reports.
Scope of Management	No Access	Cannot view or modify scope settings, Remote Offices, or computer management.
Application Control	No Access	Cannot access Application Control features or reports.
Device Control	No Access	Cannot access Device Control features or reports.
BitLocker Management	No Access	Cannot access BitLocker Management features or reports.
Browser Security	No Access	Cannot access Browser Security features.
Endpoint DLP	No Access	Cannot access Endpoint DLP features or reports.
Vulnerability Management	Full Control	View, assess, and remediate detected vulnerabilities. Configure misconfiguration rules and scan settings.

Endpoint Security Roles

The following roles apply to the Endpoint Security features of Endpoint Central. Each role grants full control over one or more security modules. All other product areas are inaccessible unless noted.

Application Control Manager

Application Control Managers have full control over the Application Control module and its reports. All other modules are inaccessible. This role is suited for security administrators responsible for defining and enforcing application allow and deny policies.

Module	Access Level	Description
Application Control	Full Control	Create, modify, publish, and delete application groups, policies, privilege groups, and access grants. Remove local admin rights from managed users.
Application Control Reports	Full Control	View, generate, and export all Application Control reports, including policy compliance reports.
All other modules	No Access	No access to Patch Management, Configurations, Software Deployment, Inventory, Device Control, BitLocker, Browser Security, Endpoint DLP, Vulnerability Management, or any other module.

BitLocker Manager

BitLocker Managers have full control over BitLocker Management features and its reports. All other modules are inaccessible. This role is intended for security administrators responsible for managing full-disk encryption across the endpoint estate.

Module	Access Level	Description
BitLocker Management	Full Control	Create, modify, publish, and delete BitLocker policies. Deploy policies to computers and perform on-demand encryption actions.
BitLocker Reports	Full Control	View, generate, and export all BitLocker compliance and encryption status reports.
All other modules	No Access	No access to Patch Management, Configurations, Software Deployment, Inventory, Application Control, Device Control, Browser Security, Endpoint DLP, Vulnerability Management, MDM, or any other module.

Browser Security Manager

Browser Security Managers have full control over the Browser Security module. All other modules are inaccessible. This role is designed for administrators whose primary responsibility is browser security.

Module	Access Level	Description
Browser Security	Full Control	Create and manage browser security policies, URL filtering rules, browser extensions, and baselines.
All other modules	No Access	No access to Patch Management, Configurations, Software Deployment, Inventory, Application Control, Device Control, BitLocker, Endpoint DLP, Vulnerability Management, or any other module.

Device Control Manager

Device Control Managers have full control over the Device Control module and its reports. All other modules are inaccessible. This role is intended for security administrators responsible for managing peripheral device access policies across endpoints.

Module	Access Level	Description
Device Control	Full Control	Create, modify, publish, and delete Device Control policies, trusted device grants, audit settings, and file extension groupings. Deploy policies to target computers.
Device Control Reports	Full Control	View, generate, and export all Device Control reports, including access audit and compliance reports.
All other modules	No Access	No access to Patch Management, Configurations, Software Deployment, Inventory, Application Control, BitLocker, Browser Security, Endpoint DLP, Vulnerability Management, or any other module.

Endpoint DLP Manager

Endpoint DLP Managers have full control over the Endpoint DLP Plus module. They also have access to Wake on LAN and the ability to schedule reports. All other modules are inaccessible. This role is designed for data security administrators responsible for preventing data loss across managed endpoints.

Module	Access Level	Description
Endpoint DLP	Full Control	Create, manage, and enforce data loss prevention policies. View and manage DLP incidents and rules, and access all Endpoint DLP Plus features.
Wake on LAN (Tools)	Full Control	Send Wake on LAN signals and manage scheduled Wake on LAN tasks on managed computers.
Schedule Reports	Full Control	Create and manage scheduled reports for Endpoint DLP data. Cannot access standard reports.
All other modules	No Access	No access to Configurations, Patch Management, Software Deployment, Inventory, Application Control, Device Control, BitLocker, Browser Security, Vulnerability Management, Scope of Management, or any other module.

Security Manager

Security Managers have access to all Endpoint Security modules and Scope of Management. This is the senior security role, suited for administrators who oversee the full security posture of the endpoint estate across all security surfaces.

Module	Access Level	Description
Application Control	Full Control	Create and manage application groups, policies, privilege groups, and exclusion policies. Remove local admin rights.
BitLocker Management	Full Control	Create and manage BitLocker policies, deploy them to devices, view recovery keys, and manage encryption.
Browser Security	Full Control	Create and manage browser security policies, URL filtering rules, and browser configurations.
Device Control	Full Control	Create and manage Device Control policies, trusted device records, temporary access, and extension groupings.
Endpoint DLP	Full Control	Create and manage data loss prevention policies, view and manage incidents, and access all Endpoint DLP features.
Vulnerability Management	Full Control	View, assess, and remediate detected vulnerabilities. Configure scan settings and misconfiguration rules.
Patch Management	Full Control	Manage all patching features: approval settings, deployment policies, automated patch deployment, and system health policies.
Security Reports	Full Control	View, generate, and export reports across all Endpoint Security modules.
Scope of Management	Full Control	Add and remove computers, manage Remote Offices, install and uninstall agents, and configure settings.
All other modules	No Access	No access to Configurations, Software Deployment, Inventory, Tools, Remote Desktop Sharing, OS Imaging, OS Deployment, MDM, Sensors, Endpoint Analytics, Workflow, or Query Reports.

MDM Control	Create Profile Management	Create App Management	Create Inventory	Create Report	Enrollment	Content Management	OS Update Management	Remote Control
Mobile Device Manager	Full Control	Full Control	Full Control	Full Control	Full Control	Full Control	Full Control	Full Control

The following are the roles within the Endpoint Security.

Role	Description
Application Control Manager	This role provides the user with full control over application control and application control reports.
Bitlocker Manager	This role provides the user with full control of BitLocker management and reports.
Browser Security Manager	This role provides the user with full control of Browser Security functions.
Device Control Manager	This role provides the user with full control of Device Control functions and reports.
Security Manager	This role provides the user with full control of Security Manager functions such as BitLocker Management, Patch Management, Application Control and Vulnerability Management amongst others.

Note

Apart from these predefined roles, you can create multiple custom roles based on your organization's access requirements. You are not limited to one role of each type, multiple roles can be created to suit different access needs within your organization.

Was this article helpful?

Yes

Visit Community

Ask questions and get answers