Roles

Roles are sets of permissions assigned to users, user groups, or application identities. They govern access to workspaces, vaults, and PAM providers, and are separate from inheritable permissions, which control what a specific user or user group can do in a given entry or folder within a vault.

There are many roles for different use cases, but all fall into three categories: Members, Administrators, and Owners:

• Members have the fewest permissions. They can only view the content of specific vaults, and what they can do inside those vaults is controlled separately via Permissions.
• Administrators can manage users, security settings, password policies, licenses, preferences, and similar settings. Since their rights are limited to management, they don't automatically get access to the content of the vaults or PAM providers they administer.
• Owners have full permissions within their assigned scope. For security reasons, it's strongly recommended to keep the number of owners to a minimum, for example one per vault.

To see which roles are assigned to you, head to Devolutions Server web interface, click on your avatar in the top right corner, and select My roles.

Role assignments

Assigning roles to users requires adding Role assignments. These are accessible from several places, namely:

• The Role assignments section, under Administration – Configuration and security, which lists every role assignment in the workspace and lets you add new ones.
• Directly where these roles apply:

  • Administration – Vaults – Edit – Role assignments
  • Administration – Users – Edit – Role assignments
  • Administration – User groups – Edit – Role assignments
  • Administration – Application identities – Edit – Role assignments

Auditing role assignments

Every role assignment is logged, including an administrator granting themselves access to a vault. Head to Reports – Security, then choose between the Vault role assignments, Workspace role assignments, and Redundant role assignments reports.

These reports show who holds which roles, how they got them, and what their scope is. The Redundant role assignments report additionally flags redundant assignments so they can be cleaned up.

Built-in roles

Roles can be assigned at three scopes: Workspace, Vault, and PAM provider.

Role	Description
Workspace owner	Grants unrestricted access to the whole workspace, including every vault and its content. Assigned automatically to users and groups flagged as workspace owners; it cannot be granted, edited or removed manually.
Workspace administrator	Administer every area of the workspace: users, roles, vaults, settings, licenses, logs and PAM. Does not grant access to the content of the vaults.
Users and identities administrator	Create, edit, delete, unlock and disconnect user accounts and application identities, manage their MFA and API keys, create and manage user groups and their members, and view user activity and license assignment reports.
Vaults administrator	Create, edit and delete vaults, manage their gateways and their user assignments. Does not grant access to the content of the vaults.
PAM administrator	Configure every PAM setting (policies, templates, OTP, propagation, risk), fully manage all privileged access providers including account discovery and discovery results, and view active privileged sessions.
Gateway administrator	Manage Devolutions Gateway instances, review who can use them and which permissions apply, and terminate active gateway sessions.
Vault member	Grants access to the content of the assigned vaults. Entry permissions defined in the vault still applies.
Vault owner	Manage every aspect of an assigned vault: its content, permissions, access requests, entry statuses, deleted entries, reports and session recordings, as well as the vault's own configuration, gateways and assignments.
PAM provider owner	Manage every aspect of an assigned privileged access provider, including its account discovery configuration, discovery results, group listing and assignments. Does not allow creating new providers.
Licenses administrator	Add, edit, delete and assign licenses, and view license usage and user license reports.
Entry templates administrator	Create, edit, delete and export entry templates, set the default template and review where each template is used.
Password policies administrator	Create, edit, delete and export password policies and passphrase dictionaries.
System images administrator	Create, edit, delete and clean up the system images available in the workspace.
PAM account creator	Create PAM accounts on an assigned privileged access provider. Does not grant any other permission on the provider.
Workspace log viewer	View the server and administration logs of the workspace, the login attempts and login history, the PAM logs, and the activity logs of every vault.
Privileged sessions supervisor	View active privileged sessions and terminate them.
Auditor	Read-only view of the whole administration section: users, groups, roles, vaults, settings, licenses, logs and reports. Does not grant access to the content of the vaults.