> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/admin-access-and-roles.md).

# Administration: roles and access

Every option of the devo admin role and devo admin access commands: security roles, permission sets, system permissions, and system vault roles.

This page describes the `devo admin role` and `devo admin access` commands, which show security roles and permission sets and manage the organization-wide permissions of users and groups. Most of them are for Devolutions Cloud; `devo admin access permission-sets` is for Devolutions Server. The **Workspace** line under each command says where it works. A command run on a workspace type it doesn't support stops with `operationNotSupportedBySource` and names the type you need.

For the list of all commands, see [Commands](/cli/reference/commands.md). For step-by-step tasks, see [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md). To give access to one vault or one entry, use `devo vault access` and `devo entry access` instead. The options every command accepts, such as `--context` or `--output json`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here.

{% hint style="info" %}
**IDs.** Every ID on this page (user, group, role) is a GUID. Find user IDs with `devo admin user list`, group IDs with `devo admin group list`, and role IDs with `devo admin role list`. Commands that change something refuse to run without `--yes` (aliases `-y` and `--confirmed`) and stop with `confirmationRequired`.
{% endhint %}

## devo admin role list

Lists the vault roles or the entry roles of the Devolutions Cloud organization. Alias: `devo admin role ls`.

**Workspace:** Devolutions Cloud.

```bash
devo admin role list [--scope vault|entry]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--scope &#x3C;scope></code></td><td><code>vault</code></td><td>Which roles to list: <code>vault</code> (roles you assign on a vault) or <code>entry</code> (roles you assign on an entry). Any other value is refused. Case doesn't matter.</td></tr></tbody></table>

## devo admin role get

Shows one vault role or entry role, by ID.

**Workspace:** Devolutions Cloud.

```bash
devo admin role get <role-id> [--scope vault|entry]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;role-id></code></td><td></td><td>Required. ID of the role, as a GUID.</td></tr><tr><td><code>--scope &#x3C;scope></code></td><td><code>vault</code></td><td>Where to look for the role: <code>vault</code> or <code>entry</code>. Use the scope the role belongs to. Any other value is refused.</td></tr></tbody></table>

## devo admin access permission-sets

Lists the permission sets of the workspace.

**Workspace:** Devolutions Server.

```bash
devo admin access permission-sets
```

This command has no options of its own.

## devo admin access system list

Lists the system permissions given to users and groups of the Devolutions Cloud organization. Alias: `devo admin access system ls`.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system list
```

This command has no options of its own.

## devo admin access system get

Shows the system permissions of one user or one group.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system get --user-id <id>
devo admin access system get --group-id <id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr></tbody></table>

## devo admin access system grant

Gives one or more system permissions to a user or a group.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system grant --user-id <id> --permission <name> [--permission <name> ...] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--permission &#x3C;name></code></td><td></td><td>Required. System permission to give. Repeat the option, or list several names after one <code>--permission</code>, to give several. Names are matched without case sensitivity and duplicates are ignored. Only the names listed below are accepted; an unknown or empty name is refused.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin access system revoke

Removes system permissions from a user or a group. Without `--permission`, removes all of the subject's system permissions. Alias: `devo admin access system rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system revoke --group-id <id> [--permission <name> ...] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--permission &#x3C;name></code></td><td>All</td><td>System permission to remove. Repeat the option, or list several names, to remove several. Leave it out to remove every system permission of the user or group. Only the names listed below are accepted.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the removal. Required.</td></tr></tbody></table>

### System permission names

`--permission` accepts these names, without case sensitivity:

* **Organization and settings**: `manageSystemSettings`, `systemSettingsView`, `manageLicense`, `manageProductLicenses`, `viewAdministrationLogs`, `openedEntriesView`, `forceCheckin`, `releaseLock`.
* **Vaults and templates**: `addVaults`, `manageEntryTemplates`, `entryTemplatesView`, `entryTemplatesEdit`, `entryTemplatesDelete`, `managePasswordTemplates`, `passwordTemplatesView`, `passwordTemplatesAdd`, `passwordTemplatesEdit`, `passwordTemplatesDelete`, `passphraseDictionariesEdit`, `passphraseDictionariesDelete`.
* **Users, groups, and invitations**: `manageUsersGroups`, `manageUsers`, `usersView`, `usersAdd`, `usersEdit`, `usersDelete`, `usersReinvite`, `groupsView`, `groupsAdd`, `groupsEdit`, `groupsDelete`, `manageInvitations`, `invitationsView`, `invitationsAdd`, `invitationsDelete`.
* **Licenses**: `licensesAssign`, `licensesView`, `licensesAdd`, `licensesAdjust`, `licensesDelete`.
* **Devolutions Gateway**: `manageGateways`, `gatewaysView`.
* **Privileged access**: `managePAMProviders`, `pamProvidersView`, `managePAMTasks`, `addPAMVaults`, `managePAMPolicies`, `pamPoliciesView`, `managePAMScriptTemplates`, `pamScriptTemplatesView`.
* **Global resources**: `manageGlobalImages`, `manageGlobalMacrosScriptsTools`, `manageGlobalVpns`, `manageGlobalContact`, `manageCustomWidgets`.
* **Application services**: `manageApplicationServices`, `applicationServicesView`, `applicationServicesAdd`, `applicationServicesEdit`, `applicationServicesDelete`, `applicationServicesChangeStatus`, `applicationServicesViewLogs`.
* **Scheduled reports**: `manageScheduledReports`, `scheduledReportsView`, `scheduledReportsAdd`, `scheduledReportsEdit`, `scheduledReportsDelete`, `scheduledReportsReschedule`.

## devo admin access system-vault list

Lists the roles users and groups hold on the system vault of the Devolutions Cloud organization. Alias: `devo admin access system-vault ls`.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system-vault list
```

This command has no options of its own.

## devo admin access system-vault get

Shows the system vault role of one user or one group.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system-vault get --user-id <id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr></tbody></table>

## devo admin access system-vault grant

Gives a user or a group a role on the system vault. If the user or group already has a role there, it's replaced.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system-vault grant --group-id <id> --role-id <role-id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--role-id &#x3C;role-id></code></td><td></td><td>Required. ID of the vault role to give, as a GUID. Find it with <code>devo admin role list --scope vault</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin access system-vault revoke

Removes the system vault role of a user or a group. Alias: `devo admin access system-vault rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin access system-vault revoke --user-id <id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--user-id &#x3C;id></code></td><td></td><td>ID of the user, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--group-id &#x3C;id></code></td><td></td><td>ID of the group, as a GUID. Pass exactly one of <code>--user-id</code> and <code>--group-id</code>.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the removal. Required.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/admin-access-and-roles.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.