# Assign credentials to a device

> Learn how a device's credential order and Admin setting decide which credential syncs and the AI use, and set up your devices to match.

Section: Permissions & RBAC / Credentials  
Source: https://www.itva.com/docs/credentials/assign-credentials-to-a-device  
Last updated: 2026-11-04

Each device has a list of credentials. The order of the list and the Admin setting of each credential decide which credential ITVA uses. In this guide, you learn how ITVA chooses, then assign credentials so that each feature uses the access you intend.

## How ITVA chooses a credential

The device's **Credentials** list goes from highest priority at the top to lowest priority at the bottom. Each credential in the list also has an **Admin** setting, Yes or No. On the device's page, **Permissions** shows this as **Admin** or **User**.

| Feature | Credential that ITVA uses |
| --- | --- |
| Syncs, Test Connection, Connect, and other actions that the probe runs on the device | The first credential in the list, whatever its Admin setting |
| The AI, when it runs commands on the device | The first credential in the list with Admin set to No |

ITVA uses only that one credential. It does not try the next credential in the list if the first one fails to sign in.

## What the AI can do on a device

The AI never uses a credential with Admin set to Yes. If a device has no credential with Admin set to No, the AI cannot run commands on it, and it reports "No non-admin credential assigned."

The AI also has these limits:

- It can run only commands that start with `show`, `get`, `diagnose`, `ping`, or `traceroute`.
- It can run commands only on devices that the person using the AI can manage.

Admin is a label that you set in ITVA. ITVA does not check what the account can do on the device. To limit what the AI can do, give the non-admin credential a read-only account on the device.

## Before you begin

- Your role must have Manage set to All for **Devices**, for the device's tags.
- You must be able to see the credentials that you want to assign. If you are not an administrator, each credential must have one of the tags in your permissions, and your role must have View on **Credentials**. See [Use tags](https://www.itva.com/docs/permissions-rbac/use-tags).
- A read-only account on the device, saved as a credential. See [Create a read-only account on Juniper Junos](https://www.itva.com/docs/juniper/create-a-read-only-account-on-juniper-junos) or [Create a read-only account on Cisco IOS-XE](https://www.itva.com/docs/cisco-ios-xe/create-a-read-only-account-on-cisco-ios-xe).

## Assign credentials

We recommend a read-only credential at the top of the list with Admin set to No. Then syncs and the AI both use the read-only account.

1. Open the device, and select **Edit**.
2. In **Credentials**, select the add button (+). The **Select Credential** panel opens.
3. Select the read-only credential.
4. In the **Admin** column, turn the switch off for that credential. It shows **No**. ITVA sets new credentials to Yes by default.
5. If the credential is not at the top of the list, use the up arrow to move it to the top.
6. Optional: Add more credentials below it. Set Admin to Yes for accounts with full access.
7. Select **Save**.

**Caution: **If an Admin credential is at the top of the list, syncs and other probe actions use that account, even when a read-only credential is lower in the list.

If you import devices from a CSV file, ITVA assigns the credential in `api_credential_name` with Admin set to Yes. To let the AI use a device that you imported, edit the device and add a credential with Admin set to No.

## Check that it worked

1. On the device's page, look at **Credentials**. The read-only credential is first, and **Permissions** shows **User**.
2. Select **Test Connection**. The result is **Successfully connected**.
3. Ask the AI to run a `show` command on the device. It returns the output.

## Troubleshooting

- If the AI reports "No non-admin credential assigned.", every credential on the device has Admin set to Yes. Add a read-only credential with Admin set to No.
- If the AI says that a command is not supported, the command does not start with one of the allowed words. Run it yourself, or use a `show` command instead.
- If a sync shows "The device ... does not have a credential assigned.", the device has no credentials. Add one.
- If a credential is not in the **Select Credential** panel, you cannot see it. Ask an administrator to add one of your tags to the credential.
- If syncs fail but the second credential in the list is correct, move the correct credential to the top. ITVA does not try the second credential.