Roles and permissions

Every member of staff has one role. A role decides what they can reach in each module, which actions they may take on top of that, which customers they work with, which fields they never see, which lists of people they appear in and which notifications they get by default. Settings > Roles and permissions (in the People and access group) holds the roles. Only administrators can change them.

The role templates#

Tenvara ships a template for each kind of person in an MSP. Each row shows how many fields it hides, its customers and how many people have it.

Owner and Admin have full access: everything, always, for every customer. Every other template is a starting point you can change.

Make your own role#

1. Press Copy on any role or template, or New role.
2. Give it a Name and Description, for example "Apprentice: works tickets and watches devices, deletes nothing, never takes control and sees no costs".
3. Work through the tabs below, then press Save.

Your own roles are listed under Your roles with the template they came from. Any role can be renamed, changed or put back to its template's current defaults with Reset to template. Owner, Admin, Service desk technician and Read-only auditor cannot be deleted, and a role somebody has cannot be deleted.

The role editor#

Click a role to open it. The editor has six tabs.

Modules#

A level for every module: None, View or Manage. View lets people see a module's screens; manage lets them change things there too. A module set to None disappears from their menus, customer and device pages, search and the command menu.

Some modules sit under another because they are the more sensitive part of it: Invoices and payments, Procurement and stock, Redacting ticket messages and Customer sign-offs under Tickets, Agent tamper protection and Admin elevation under Remote access, Credentials, Our company credentials, Sign-up addresses and Sign-up codes and links under Documentation, Domains and DNS under Monitoring, Financial reports under Reports. Giving someone Documentation does not give them Credentials, so a technician can read and write documentation without revealing passwords. Our company credentials covers your own passwords and keys (distributor portals, registrars, your own firewall), separately from your customers'.

Actions#

On top of each module's level, whether people with the role may Delete, Export, make Bulk changes, Approve, and change the module's own Module settings (queues, SLAs and canned responses for the service desk, say) without being an administrator. The Export and Bulk changes switches cover every export and every bulk route in that module, and settings that turn a control off stay with administrators whatever Module settings says.

Sensitive actions#

Single actions that deserve their own switch, each needing a level in its module first. For example:

• Erase customers for good (off for every role except Owner and Admin until you switch it on; see Erasing a customer),
• Delete tickets for good (merging and closing are always allowed),
• Rename computers: ask the agent to change a device's own computer name, after an approval (renaming the device in Tenvara needs only manage),
• Remote control, Remote view only, Terminal and files, Browse the registry and Change the registry,
• Open device web pages: open a device's web page (a NAS, printer, switch or UPS) or forward a port through an agent on its network, every session audited (see Opening device web pages),
• Reveal credentials (every reveal is logged, and it covers the codes in customers' sign-up mail too), Restore backups and Change Microsoft 365,
• Offline passwords for visits: take a sealed, expiring copy of the passwords someone can already reveal onto their phone for a booked visit, when an administrator also allows it in Settings > Mobile app (see Settings > Mobile app),
• Phone follows the desktop: the mobile app shows what the person has open in the web app (see Follow your desktop on your phone),
• Override identity checks: let a ticket that is blocked until its requester is verified go ahead without a check, with a reason, and see every technician's identity checks (see Verifying who a caller is),
• Manage sales settings: change pipelines, stages, targets, reasons, sources and statuses in Settings > Sales without being an administrator, and Commission for commission plans and statements,
• one switch for each Docker action: Read container logs, Start and stop containers, Remove containers and prune and Open a shell in a container (see Docker hosts and containers),
• Run scripts, Write scripts and Run commands, Deploy software and Install updates,
• Prepare invoices, Approve and issue, Credit, void and write off, Record payments and Customer billing settings,
• Work on setup, for the setup sections given to someone,
• See the portal as a contact, Publish publicly for knowledge base articles, and Watch screen recordings.

So a finance assistant can prepare invoice drafts without being able to issue them, and an apprentice can watch a screen without taking control. Templates for people who do not work on devices (project manager, sales, HR, dispatcher, contractor) start with every sensitive action off.

Each switch is enforced on every route to the action, not only its button: What each role switch controls lists every place each one applies.

Customers#

Which customers everyone with the role works with: All customers, Only some customers (customers and customer groups), or Assigned tickets only, where people see only the tickets assigned to them or raised by them, and those tickets' customers. A person limited on their own user gets only the customers on both lists. See Customer groups and scoped access.

Hidden fields#

Groups of fields people with the role never see. The server leaves them out of every screen, list, export, report and search for them, and ignores them in what they send.

CSV and Excel downloads leave out hidden columns too.

Work and seat#

Work is the kinds of work the role does: Tickets, Alerts, Projects, Field work, Dispatch, Sales, Accounts, HR and office and Security. It decides which lists of people the role appears in (who can be assigned a ticket, who is on a chat rota, the dispatch board, leaderboards) and its notification defaults. So a salesperson, project manager or finance user is never offered for support tickets, is not a Support chat operator and gets no ticket notifications they are not named on. Show everyone in any list of people still finds everyone allowed.

Seat says what each person with the role counts as on your licence: Full seat, Light seat or No seat. Every active member of staff counts as a full seat, whatever their role; an invitation that has not been accepted counts as none.

Exceptions for one person#

When one person needs something different from their role, set it on their user rather than making a new role:

1. Go to Settings > Users and open the person.
2. Under Module access, pick a level for that module instead of Role. The line underneath says what is different, for example "Manage for this person (role gives view)".
3. Press Save changes.

Their row in the list then shows the role with +1. See Users.

When changes apply#

Changes to a role apply the next time each person's session refreshes, within a few minutes. The rules are enforced by the server, not just the screen: an action someone is not allowed to take is refused whichever way they try it, including through the API. Anything they reach by a link they are not allowed to open says so, rather than showing an empty page.

Tip: Before giving a new role to the team, use View as on someone who has it to see the app exactly as they will. See Teams, invitations and handover.

Areas whose module is switched off in Modules are hidden for everyone, whatever the level.

Owners#

Only an Owner can change an Owner or make someone an Owner, and the last active Owner can never be demoted, turned off or deleted. Single sign-on rules never give or take the Owner role. An Admin can still end an Owner's sessions and revoke their API tokens in an emergency.