Home » Role Management
Applicable For Endpoint Central MSP 
 
 

Role Management

Overview

As an administrator, many a time you would have felt mundane routines spill over crucial attention-seeking jobs of your network. Endpoint Central answers this concern through its User & Role Management module; delegating routine activities to chosen users with well-defined permission levels. You can easily administer the users, and define their scope to manage a specific set of computers.

Role Management

Some of the most commonly used Roles are specified under Pre-defined Roles. However, you also have the flexibility to define roles that best suit your requirements under the User-defined Roles and grant appropriate permissions.  Here's a brief on the Pre-defined and User-defined roles respectively:

User-defined Role

You can tailor-make any number of roles, and give them permissions based on your personalized needs. These customized roles fall under the User-defined category. For a better understanding let us quickly see how to create a User-defined Role in the following section.

Follow the steps mentioned below to create a new User-defined role:

1. Select the Admin tab and click  User Administration under Global Settings. This opens the User Administration page.
2. Select the Role tab and click the Add Role button.
3. Specify the Role Name and a small description about it.
4. You can define module-wise permission level for the Role in the Select Control Section.
    The permission levels are broadly classified into:
    Full Control - To perform all operations like an administrator, for the specific module
    Write - To perform all the operations, except few restrictions as explained in this table
    Read - To only view the details in that module
    No Access - To hide the module from the User  (For more details, refer the user role and permission table.)
5. Click  Add button.

       You have successfully created a new role.

The role you have just created will now be available in the Roles list of the user creation module. Role deletion cannot be performed if that role is associated even with a single User. However you can modify the permission levels for all User-defined roles.

Pre-defined Roles

You will find the following roles in the Pre-defined category:

    1. Administrator
    2. Guest
    3. Technician
    4. Auditor
    5. Remote Desktop Viewer
    6. IT Asset Manager
    7. Patch Manager
    8. Mobile Device Manager
    9. OS Deployer

Administrator Role: The Administrator role signifies the Super Admin who exercises full control, on all modules. The operations that are listed under the Admin tab include:

    1.    Defining or modifying Scope of Management
    2.    Adding Inactive Users
    3.    Changing mail server settings
    4.    Changing proxy settings
    5.    Personalizing options like changing themes, setting session expiry, etc.
    6.    Scheduling vulnerability database update
    7.    Scheduling scan settings for Patch Management
    8.    Editing MSI or Script repository
    9.    Viewing Actions Logs
    10.   Has write permission for the following,  Inventory, Reports, Profiles and Apps in Mobile Device Management.     

Guest Role: The Guest Role retains the Read Only permission to all modules. A user who is associated to the Guest Role, will have the privileges to scan and view various information about different modules, although making changes is strictly prohibited. Guest Role also has Read Only permission for viewing, MDM inventory details, reports, profiles and Apps of the mobile devices.

Technician Role: The Technician Role has a well defined set of permissions to do specific operations. Users under the Technician role are restricted from performing all the operations listed under the Admin tab. The operations that can be performed by users associated with the Technician Role include:

    1.    Can define and deploy all types of configurations and collections.
    2.    Can view all the configurations including those created by other users, reports, etc.
    3.    Can suspend, modify, or re-deploy the configurations defined by them.
    4.    Can update the Vulnerability Database.
    5.    Can perform Scan operations on all modules.
    6.    Has write permission for the following,  Inventory, Reports, Profiles and Apps in Mobile Device Management.  

Auditor: The Auditor role is specially crafted for Auditing Purposes. This role will help you grant permissions to auditors view the details of software inventory, check for license compliance, etc. Users with "Auditor Role" can also have read permission for MDM Reports.

Remote Desktop Viewer: The Remote Desktop Viewer Role will allow the users associated with it to Invoke a Remote desktop connection and view details of users who had connected to a particular system.

IT Asset Manager: The IT Asset Manager has complete access to the Asset Management module and all the other features are inaccessible. IT Asset Manager can also view the Inventory details of all the Mobile Devices.

Patch Manager: The Patch Manager role has complete access to Patch Management. Patch Manager will also have the privilege to access and use "Tools", like Wake On LAN, Remote Shutdown, System Manager and ability to schedule Patch Reports. All the other modules/features are inaccessible.

Mobile Device Manager: Mobile Device Manager role has write permission for the following,  Inventory, Reports, Profiles and Apps in Mobile Device Management.

OS Deployer: The OS deployer role provides the associated user the privilege to capture images of Windows OS and deploy it across the network computers.

Note: Learn more about User Roles and Permission Level.

Defining a Scope

Endpoint Central provides you the privilege of defining a scope for the users with which you can define the target computers, which can be mapped to every user. By limiting the user's permission to specific set of computers, you can feel assured that the user has enough permission to perform their roles and not excess permission to take unduly advantage.

The target that you define as the scope can be one of the following:

All Computers

When the target is defined as 'All Computers', users will have permission to execute all the privileges defined in the role, to all the computers. Though the scope is all computers, the permission level is determined only by the role to which the user is mapped.

Static Unique Groups

You can create specific custom groups for management purposes and associate it to the users. The custom groups that you create should be Unique, so that no computer can belong to more than one custom group. These are computer based custom groups which are created for user management purpose, is defined as "scope" for the user. Refer to this to know more about Creating Custom Groups

Remote Office

You can create specific remote offices or use the existing remote offices to be defined as the scope for the users. More than one user can have manage the same remote offices. Similarly more than one remote office can be mapped to the same user, however you cannot have a combination of remote offices and unique groups as a part of the scope.

Sharing a Scope

More than one user can share the same scope. In such cases, configurations/tasks applied to the scope can be managed by more than one user.  To know more, refer to this: Points to be noted

Modifying a Scope

When a scope of the user is modified, the user will not be able to manage the configurations/tasks, which were created. The user will have permission to clone the configurations without the target to re-use them for the user's current scope. Modifying the computers within the scope will not be considered as modifying the scope.

Learn more on scope allocation for a newly created user

User Management

Creating a User and Associating a Role

    1. Follow the steps mentioned below for Endpoint Central On-Premises:

      Note: This is applicable only after Endpoint Central build # 10.1.2211.1

      Pre-requisite for Adding Users

      For security reasons, mail server is required to send user activation links when creating new user accounts. If the mail server is not configured, navigate to Admin tab> Server Settings>Mail Server Settings to configure your mail server. Kindly go through this link to learn about configuring mail server.

      User Creation

      1. Login to the product as an administrator.
      2. Navigate to Admin tab> Global Settings> User Administration.
      3. Click on Add User.
      4. Specify the authentication type as Active Directory Authentication or Local Authentication. For Active Directory Authentication, select a Domain in Domain name.
      5. Specify a User Name.
      6. Specify the Role from the drop down. You can find all the pre-defined roles, and also the roles that you have created will be rested here.
      7. For Active Directory Authentication, the Email Address of the user will be fetched from Active Directory, if available. If not, specify the email address of the user manually. The Email Address should be manually entered for local authentication.
      8. The Phone Number of the user is optional.
      9. Define the Scope for the user, you can specify the computers, which needs to be managed by the user. You can choose to provide the user access to manage all computers, remote offices or specific unique custom groups. If you do not have a unique custom group, you can create one. If the custom group is not unique, it will not be listed here. Refer to this, to know more about : Unique Custom groups
      10. Click on Add User.

User Activation

      1. After the administrator adds the user, an account activation mail will be sent to the user's mail address.
      2. If the mail is not delivered due to mail server issues, a Send link manually option appears on the Remarks column of that particular user
      3. The administrator can then manually copy and send the account activation link to the user.
      4. The mail will contain the account details like Username and domain.
      5. Active Directory users must click the Activate your account link. Local users must click the Create New Password link.
      6. This link will expire in 24 hours after which the administrator must re-invite the user to generate a new activation mail.
      7. For Active Directory users, clicking the Activate your account link will successfully activate your account and you will be redirected to the login page. Local users must specify a new password and confirm the password after clicking the Create New Password link. Then, your account will be successfully activated and you will be redirected to the login page.
      8. Furnish your username and password to sign in to the console.
      9. The user will not be able to login unless the account is activated.

 

  1. Follow the steps mentioned below for Endpoint Central Cloud:
    1. Login to the product as an administrator.
    2. Navigate to Admin tab > under Global Settings > select User Administration > Add User.
    3. Provide the Email and user name of the new user.
    4. Either from the list of predefined roles or user-defined roles, assign a role for the new user.
    5. Furnishing phone number is optional.
    6. Define the Scope for the user, you can specify the computers, which needs to be managed by the user. You can choose to provide the user access to manage all computers, remote offices or specific unique custom groups. If you do not have a unique custom group, you can create one. If the custom group is not unique, it will not be listed here. Refer to this, to know more about : Unique Custom groups

You have successfully create a user and associated a role to the user with the scope of the computers that need to be managed.

When you opt to authenticate a user via Active Directory, the user should have privileges to login to the domain from the computer where the product Server is installed.

Modifying User details

Endpoint Central On-Premises

  1. Login to the product as an administrator.
  2. Navigate to Admin tab > under Global Settings > select User Administration.
  3. The list of users will be displayed. Against one particular user, under the Action column, choose Modify.
  4. In addition, you can view the Login details of the user and change the password, if required.

Endpoint Central Cloud

  1. Login to the product as an administrator.
  2. Navigate to Admin tab > under Global Settings > select User Administration.
  3. The list of users will be displayed. Against one particular user, under the Action column, choose Modify User.
  4. In addition, you can re-invite the user in cases wherein the user has not received the invitation mail or has deleted it accidentally.

Deleting a User

At times when you find a user's contribution obsolete, you can go ahead and delete the user from the User List. The user removed will no more exercise Module Permissions.

Enabling Two Factor Authentication

Endpoint Central On-Premises

Enabling Two Factor Authentication will secure the access to the web console. Users will be prompted to enter the One Time Password (OTP) along with their default password. You can configure the settings to save the OTP for the specific browser. If this option is enabled, user will not be prompted for OTP for the number of days, specified here : Admin -> User Administration -> Two Factor Authentication. You can choose the mode for two factor authentication, which could be either via email or an authenticator app (Zoho OneAuth, Google Authenticator, MS Auth, DUO Auth, etc.)

Email

One Time password will be sent to each user via email. You cannot enable Two Factor Authentication if one or more users do not have email address mapped with the product server. You should ensure that email address of all the users are registered with the product server.

When two factor authentication is enabled, users will receive an email with the details of the OTP.  Every OTP is valid for 15 minutes from the time of generation. OTP will be an auto-generated 6 digit number. You can also allow the users to save the OTP on their web browsers. You should specify the number of days allowed for the OTP to be saved on the web browser. Users will not be prompted for OTP, if they choose to save the OTP on the browser. If you specify the number of days as 0, then users will not be allowed to save the OTP on the web browser. OTP will be generated every time the user tries to login into the web console.

Authenticator App

Note: The Authenticator app could be Zoho OneAuth, Google Authenticator, MS Auth, DUO Auth, etc..

You can choose any of the above mentioned authenticator apps to generate an OTP.  You should install the authenticator app on your smart phone.

Here are the download links to a few commonly used authenticator apps:

Download and install the authenticator app on your mobile device. When you login to the web console for the first time,  a QR code will be displayed. You should open the authenticator app and scan the QR code to create an account for Endpoint Central. You can see Endpoint Central is now added to the authenticator app and OTP will be generated automatically. The chosen authenticator app can also be selected after enabling two factor authentication via email.

You can use the OTP generated in the authenticator app as a secondary authentication and login to the product.

If the user has deleted the Endpoint Central account on the authenticator app, then the user should contact the administrator to restore Two Factor Authentication using the same app. Administrator can re-send the QR Code to restore the authenticator app from here : Admin -> User Management -> Actions (Under the appropriate user) -> Re-send QR Code.

If the Endpoint Central administrator is not able to access the authenicator app, he/she can contact other administrators to send the QR code via e-mail. If there are no other administrators available, then follow the steps given in the document to disable two-factor authentication and then access the server.

Endpoint Central Cloud

TFA adds an additional layer of security when logging into the product, by requiring the user logging to provide the unique time-bound one time passcode(OTP) generated using Google Authenticator or sent as an SMS to your mobile number. This process improves authentication, thereby preventing unauthorized access of user data.

Note : This settings will be applied to all Zoho users.

Password Policy

Endpoint Central On-Premises

You can impose the following restrictions on passwords for user accounts:

  1. Minimum Password Length: Define the minimum length a password should have.
  2. Using Previous Passwords: Specify the number of previous passwords that can't be reused.
  3. Define Password Complexity:Two options are available:-
    • Simple: Users will be prompted to enter a password that meets the specified password length. There are no enforcements for any characters/numbers to be used.
    • Complex: Users will be prompted to enter a password with minimum one special character(! ~ @ # $ % ^ & + = _ *), upper case and lower case character.
  4. Enable User Account Lockout: You can specify the maximum number of invalid login attempts that are allowed before the account gets locked for a customizable 'Lockout duration'. Once a user account has been locked, login is possible only after the lockout duration is over.

Endpoint Central Cloud

You can configure the password policy for user accounts, by imposing the following restrictions while creating a password:

  1. Minimum password length: By default, the password should have atleast a minimum of 5 characters.
  2. Password expiry(in days): Configure the number of days for which the password will be valid, after which it will expire and the user will have to create a new password.
  3. Number of passwords to be maintained in history: Specify the number of passwords that you'd want to maintain in history
  4. Minimum number of special characters
  5. Minimum number of numerical characters
  6. In addition, the password should have atleast one uppercase and one lowercase character.

Points to be Noted

  1. A Unique Custom group can be managed by more than one user.
  2. The same computer cannot be a part of more than one Unique Custom Group
  3. Only Administrators will have permission to modify the scope for users
  4. Scope defined for a user cannot be a combination of custom groups and remote offices, it can only be  all computers or specific unique group or remote office
  5. When the scope of the user is modified, the user will not be notified about the changes made to his scope
  6. Adding or removing computers from the unique custom groups would not affect the scope of the user
  7. Refer to the following scenarios and behaviors:
    User A's scope : Static Unique Group 1
    User B's scope : Static Unique Group 2
    User C's scope : Static Unique Group 2 and Static Unique Group 3
    User D's scope : Static Unique Group 1, Static Unique Group 2, Static Unique Group 3 and Static Unique Group 4
    1. User A creates and applies the configuration/task to Static Unique Group 1. This configuration will be visible to User A, and User D, since they share the same scope (Static Unique Group 1). This configuration can be modified by User A and User D. When user D modifies this configuration, the target of this configuration will list only the scope that is being shared by User A and User D.
    2. User D creates a configuration and applies it to Static Unique Group 2, then this configuration can be viewed by user User B, User C and User D. All the three users will be able to manage the configuration.
    3. User D creates a configuration and applies it to Static Unique Group 3, and Static Unique Group 4. In this case, User C and User D will be able to view this configuration. User C cannot make any changes to  this configuration.
    4. User A creates a configuration and applies it to Static Unique Group 1 and later, user A's scope is modified, then this configuration can only be viewed by him, or cloned as a new configuration without the target.