# Understanding User Roles in Device Control Plus

Last Updated On: 13 Oct 2026 | 8 minutes read

This document will explain the **User Roles** and permissions which can be mapped for users. Creating various users with only certain roles and permissions allow you to have a more robust control over who does what with the product. For a detailed understanding about the various user roles and the associated scope offered by the product, refer to the doc on [Role differences](https://www.manageengine.com/device-control/help/access-management/role-difference.html).

To create a new user, navigate to **Admin -> General Settings -> User Administration -> Add User**

![Understanding user roles](https://www.manageengine.com/sites/meweb/images/desktop-central/help/osd/1774960248667.webp)

To create a new role, navigate to **Admin -> General Settings -> User Administration -> Add Role**

![Understanding user roles](https://www.manageengine.com/sites/meweb/images/desktop-central/help/osd/1774960199606.webp)

| User Role | Inventory | Report | Query Reports | Scope Of Management |
|---|---|---|---|---|
| **Administrator** | Full Control | Full Control | Full Control | Full Control |
| **Auditor** | No Access | Read Access | No Access | No Access |
| **Guest** | Read Access | Read Access | No Access | No Access |
| **Technician** | No Access Read Access | No Access Read Access | No Access | No Access |

The following are the roles within the Endpoint Security.

**Note:** Apart from these predefined roles, you can create multiple custom roles based on your organization's access requirements. You are not limited to one role of each type, multiple roles can be created to suit different access needs within your organization.