Roles and permissions

In this guide, you create a role, choose what it allows, and give it to a member with a set of tags. To learn how roles and tags work together, see Access control overview.

Before you begin

• You must be an administrator. Only administrators can open Settings > Users.
• The tags you want to use already exist, and your items have them. See Use tags.

Create a role

1. Select your initials at the top right of the portal, then select Settings.
2. Under Administrator, select Users.
3. Select the Roles tab.
4. Select New Role.
5. In Name, enter a name for the role. For example, "Network operator".
6. In Description, enter what the role is for. This field is required.
7. Select Save. The page for the new role opens.

A new role allows nothing. You choose what it allows in the next section.

Choose what the role allows

The role's page lists each resource in groups: Core, Reporting, Inventory, Tools, and Settings. Each resource has a View column and usually a Manage column. Ticketing also has Create and Update.

Caution: ITVA saves each change on this page right away. A change applies at once to every member, SCIM group, and API key that has this role.

1. For each resource the role needs, set View to All.
2. If the role must add, change, or delete that resource, also set Manage to All.

Manage does not include View. A member must be able to view an item before they can open it to change it, so set View as well.

Some settings give more than their name says:

• Alerts View also gives access to the Overview report.
• Scans View also shows all the applications and certificates that scans found, whatever their tags.

Give a member permissions

A permission is one role plus a set of tags. A member can have more than one permission.

1. In Settings > Users, select the Memberships tab.
2. Open the member.
3. Select Manage Permissions. The Membership Permissions panel opens.
4. If the member must have full access, turn on Administrator and go to step 8.
5. Under Permissions, select Permission (the button with a plus icon) to add a row.
6. In the role list, select the role.
7. Select Tags. In the Select Tags panel, select each tag the role applies to, then select Select. To add another role, repeat steps 5 to 7.
8. Select Save.

You cannot change your own permissions. Manage Permissions is not available on your own membership.

To give permissions to a new person, select Invite Member on the Memberships tab. Enter their Email, First Name, and Last Name, then set Administrator or Permissions in the same way.

Give permissions through SCIM groups

If your identity provider adds people to ITVA through SCIM, you set their permissions on SCIM groups. Each SCIM group has one role and a set of tags. A person in the group gets a permission with that role and those tags.

Caution: When ITVA syncs a person's SCIM groups, it replaces all of that person's permissions with the permissions from their groups. Changes that you make with Manage Permissions are lost at the next sync.

1. In Settings > Users, select the SCIM tab.
2. Select New Group.
3. In Name, enter a name for the group.
4. In External ID, enter the ID of the group in your identity provider.
5. In Role, select the role.
6. In Tags, select the tags the role applies to.
7. Select Save.

To give a group two roles, make two SCIM groups in ITVA, each with its own role.

Give permissions to a system API key

A system API key is for integrations and automation. It has its own permissions, separate from any person. A user API key acts as the person who made it, and has the same access as that person.

1. In Settings, under General, select API Keys.
2. Select New System API Key.
3. In Name, enter a name for the key.
4. Turn on Administrator, or add one or more Permissions rows with a role and tags. Give the key only the access the integration needs.
5. Select Save. The API Key Token dialog opens.
6. Copy the Token and keep it in a safe place. You cannot see it again after you close the dialog.
7. Select Done.

Check that it worked

1. In Settings > Users > Memberships, find the member. The Permissions (Group / Role) column shows Administrator, or each role with its tags.
2. Ask the member to sign in and open Devices. They see only the devices with their tags, or in folders with their tags.

Troubleshooting

• If a member cannot see an item, make sure the item has one of the tags in their permission. Also make sure that permission's role has View set to All for that resource.
• If a member creates an item and then cannot see it, the item has none of their tags. Ask an administrator to add one of the member's tags to the item.
• If a member sees subnets, workflows, or dashboards with no matching tags, this is expected. Tags do not limit those resources. Only the role does.
• If Users is not in Settings, you are not an administrator. Ask an administrator to make the change.
• If a member's permissions change back after you edit them, the member comes from SCIM. Change the role or tags on their SCIM group instead.