Roles and Securables

TeamViewer DEX Platform 26.10 Green checkmark | 1E Platform 23.11 | 1E Platform on-premises 9.x

Manage access control in the Platform by configuring roles and securables to define user permissions and control access to features, data, and administrative functions. This reference explains how role-based access control works, including built-in roles, custom roles, and securable permissions to help maintain security and governance across your environment.

System roles

On the Roles page, a system role is indicated by an icon with a padlock

System roles are built-in and are not configurable, however, they can be assigned to users the same as any other role. The following table lists the built-in system roles. Questions, responses, actions are examples of Securables. Other Consumers may create their own system roles and Securables.

Platform system role	Permissions	Allows delegation	Description
1E Intelligence Administrator	1eIntelligence (Read, Write)	No	View 1E Intelligence and access the Admin Panel.
1E Intelligence Viewer	1eIntelligence (Read)	No	View 1E Intelligence.
All Instructions Actioner	InstructionSet (Actioner) for All Instruction Sets	Yes	Use Endpoint Troubleshooting, execute any Instruction (Action and Question), and view any Instruction response.
All Instructions Approver	InstructionSet (Approver) for All Instruction Sets	Yes	Use Endpoint Troubleshooting, approve any Instruction for anyone other than self.
All Instructions Questioner	InstructionSet (Questioner) for All Instruction Sets	Yes	Use Endpoint Troubleshooting, ask any Question and view any Instruction response.
All Instructions Viewer	InstructionSet (Viewer) for All Instruction Sets	Yes	Use Endpoint Troubleshooting, view any Instruction response.
Application Experience Management Administrator	ApplicationExperience (Read, Write)	Yes	Full app control, configures monitoring, observing dashboards and, individual application data.
Application Experience Management User	ApplicationExperience (Read)	Yes	Observing dashboards and individual application data without configuration abilities.
Catalog Administrator	Catalog (Read, Sync, Write)	Yes	Curate, view, and synchronize Catalog.
Catalog Curator	Catalog (Read, Write)	Yes	Curate and view Catalog.
Full Administrator	All	No	Has all the permissions available in the Platform and its Applications.
Group Administrator	CustomProperty (Read) ManagementGroup (Read, Write, Synchronize, Delete) Security (Read, Write, Delete) InstructionSetManagement (Read) Repository.Inventory (Read, EvaluateManagementGroup)	Yes	Add Users and Management Groups, and manage their roles and assignments, below this Group Administrator's assigned Management Group(s).
Guaranteed State Administrator	GuaranteedState (Read, Write, Delete, Approver) GuaranteedStateReports (Read) PolicyAssignment (Assign) PolicyDeployment (Execute)	No	Use Endpoint Automation, manage Rules and Polices, and assign and deploy Policies.
Guaranteed State Approver	GuaranteedState (Approver, Read)	No	To use Endpoint Automation, and approve rule changes.
Guaranteed State Policy Assigner	PolicyAssignment (Assign)	Yes	Assign Policies to Management Groups (does not allow use of Endpoint Automation).
Guaranteed State Report Viewer	GuaranteedStateReports (Read)	No	View Guaranteed State reports and dashboards for permitted devices.
Guaranteed State User	GuaranteedState (Read)	No	Use Endpoint Automation, view dashboards.
Installer	Application (Write, Delete) Consumer (Read, Write) CustomProperty (Read) EventSubscription (Read, Write, Delete) Infrastructure (Read) InfrastructureLog (Read) InstructionSetManagement (Delete, Add, Read) ManagementGroup (Read) Security (Read, Write, Delete)	No	Install and upgrade the Platform and Applications, register Consumers, upload DEX Packs, manage Instruction Sets, and configure Roles and Permissions.
Inventory Administrator	Inventory (Read, Write, Export) Catalog (Read, Write)	No	Manage Inventory repositories - populate and archive them - export data - manage Inventory associations.
Inventory User	Inventory (Read)	No	View Inventory repositories, data and Inventory associations.
Nomad Administrator	Nomad (Read, Write, Delete)	No	Users with this role can use the Nomad related instructions.
Patch Insights Administrator	PatchInsights (Read, Write)	No	Administer the patches installed in the estate.
Patch Insights Viewer	PatchInsights (Read)	No	View Platform Patch Insights dashboards.
Platform AI Administartor	InstructionSetManagement (Read, Write, Delete) InstructionSet (Actioner) for Platform AI	No	This role can use AI based functions.
Remote Support	RemoteSupport (Start)	No	To create TeamViewer remote support sessions.
Tachyon System	Component (Read) Connector (Execute) Consumer (Read) EngagementAssignment (Assign) Engagements (Read, Write, Delete, Execute) InstructionSetManagement (Read) ManagementGroup (Read, Synchronize) OffloadingData (Offload) PolicyDeployment (Execute) ProcessLog (Read) ProviderOperationLog (Read) Repository.Inventory (Read, EvaluateManagementGroups) Security (Read)	No	For service and equivalent accounts to perform Platform operations.

Custom roles

On the Roles page, a custom role is indicated by an icon with a cogwheel

The following table lists built-in custom roles used by Platform applications.

Platform custom role	Permissions	Allows delegation	Description
1E ITSM Connect Actioner	InstructionSet (Actioner) on the instruction sets you wish to allow ServiceNow to use	Yes	The ServiceNow proxy user is added to this role instead of All Instructions Actioner so that ServiceNow users can only use instructions belonging to instruction sets assigned to this role.
1E Platform User	All except Approver role	No	Has all the permissions available in the Platform and its Applications except the Approver roles.
Dashboards User	Dashboards InstructionSet (Questioner) for 1E Executive Dashboard	No	This role can be used to View Dashboards.
Experience Administrator	Consumer (Read) EngagementAssignment (Assign) Engagements (Read, Write, Delete, Execute) EventSubscription (Read, Write) Experience (Read) ManagementGroup (Read) PolicyDeployment (Execute)	No	Use Experience Analytics, manage, assign and deploy Engagements (Surveys and Announcements), and manage Metrics.
Experience Engagement Assigner	EngagementAssignment (Assign)	No	Assign Engagements to Management Groups (does not allow use of Experience Analytics).
Experience User	Consumer (Read) Engagements (Read) EventSubscription (Read) Experience (Read) ManagementGroup (Read)	No	Use Experience Analytics, view Survey responses, and view Metrics.
Infrastructure Write permission	Infrastructure (Write)	No	This role can be used to assign Infrastructure Write permissions.
Nomad Administrator	GuaranteedState (Read) InstructionSet (Actioner) for the 1E Nomad instruction set on All Devices Nomad (Read, Write, Delete)	No	Use Content Distribution, manage Pre-cache jobs, view the results of related Instructions and Client health policies.
RapidEndPointDiagnostics Administrator	RapidEndpointDiagnostics (Read, Write, Delete)	No	Users with this role can execute the RapidEndPointDiagnostics instructions
Reporting Administrator	Reporting (Read, Write)	No	This role is to Manage reporting solution.
Reporting Author	Reporting (Read, Write)	No	Use reporting solution to create reports.
Reporting Viewer	Reporting (Read)	No	Use reporting solution to view reports.
Security	Security (Read, Write, Delete)	No	Minimal access for Enhanced page
Shopping Administrator	InstructionSet (Actioner) for All Instruction Sets	No	This role is for Shopping Administrator
Solutions Admin	BusinessImpact (Read, Write) InstructionSet (Actioner, Approver, Questioner, Viewer) for 1E Solutions	No	This role is for Solutions administrators.
Solutions Core	BusinessImpact (Read) InstructionSet (Viewer) for 1E Solutions	No	View DEX content, status, and details of your packs, and view SCALE Code.Solutions Core role.
VDX Administrator	GuaranteedState (Read) VDX (Read, Write)	No	Use VDX to view active and terminated VDI sessions, VDI Infrastructure map & upload infrastructure nodes
VDX Viewer	GuaranteedState (Read) VDX (Read)	No	Use VDX to view active and terminated VDI sessions & VDI Infrastructure map

Securables and operations

In the SDK documentation, Securables are also known as Securable Types.

A Permission is one or more Operations for a Securable. The remit for a Securable is either Localized or Global. A Role that has only Localized permissions can be delegated.

Securable	Operations	Remit	Description
1eIntelligence	Read, Write	Localized	View and create 1E Intelligence insights.
AgentDeployment	Approve, Execute, View	Global	View, create, and cancel 1E Client deployment jobs.
AgentInstallerManagement	Add, Delete, Read	Global	View, upload, and delete 1E Client installers.
Application	Delete, Write	Global	Install and uninstall Portal applications.
ApplicationExperience	Read, Write	Global	View and create Application Experience dashboards.
BusinessImpact	Read, Write	Global	View and create Business Impact rules.
Catalog	Read, Sync, Write	Global	View, create, and sync catalog items.
Component	Read, Write	Global	View and configure Components.
Connector	Delete, Execute, Read, Write	Global	View, create, edit, delete, and test Connectors.
Consumer	Read, Write	Global	View, add, edit, and delete Consumers.
CustomProperty	Read, Write	Global	View, add, edit, and delete Custom properties.
Dashboards	Read	Global	View Dashboards.
DeviceManagement	Delete	Global	Delete devices.
EngagementAssignment	Assign	Localized	Assign Engagements (Surveys and Announcements) to Management Groups.
Engagements	Delete, Execute, Read, Write	Global	View, create, edit, delete, and enable Engagements (Surveys and Announcements) - this securable has been renamed in version 8.0 from Surveys.
EventSubscription	Delete, Read, Write	Localized	View, create, edit, and delete the configurations of event subscriptions.
Experience	Read	Global	View Experience Analytics dashboards.
GuaranteedState	Delete, Read, Write	Global	View, add, edit, and delete Rules, Fragments, Trigger templates, and Policies - view Endpoint Automation dashboards.
GuaranteedStateReports	Read	Localized	View Guaranteed State reports and dashboards for permitted devices.
Infrastructure	Delete, Read, Write	Global	View System health and System information - view, add, and edit global settings.
InfrastructureLog	Read	Global	View Infrastructure log.
InstructionSet	Actioner, Approver, Questioner, Viewer	Localized	Execute, schedule, cancel, and approve instructions - view responses.
InstructionSetManagement	Add, Delete, Read	Global	Upload DEX Pack- add, modify, and delete instruction sets - delete instruction definitions.
Inventory	Export, Read	Global	View Inventory Insights dashboards and export inventory data.
Inventory.Association	Delete, Export, Read, Write	Global	View, create, edit, and delete SCCM Associations in Inventory.
ManagementGroup	Delete, Read, Synchronize, Write	Localized	Create, delete, edit, and initiate synchronization of Management Groups.
Nomad	Delete, Read, Write	Global	View Content Distribution dashboards and SSD peer data. View, add, and delete pre-cache jobs. Pause and resume download activity of Content Distribution clients.
OffloadingData	Offload	Global	Offload (forward) event data to any Web API responsible for processing that data.
PatchInsights	Read, Write	Global	View, create, edit patch details.
PolicyAssignment	Assign	Localized	Assign Endpoint Automation policies to Management Groups.
PolicyDeployment	Execute	Global	Deploy all types of policies (including metrics, events, and engagements) except for Reclaim policies.
ProcessLog	Delete, Read, Write	Global	View and purge the Process log, Cancel all actions.
Protect	Read, Write	Global	View and deploy patches at all endpoints.
ProviderConfiguration	Delete, Read, Write	Global	View, create, edit, and delete Providers.
ProviderOperationLog	Read	Global	Update, delete and view provider configurations.
RapidEndpointDiagnostics	Read, Write, Delete	Localized	View, create, edit, and delete
RemoteSupport	Start	Localized	Create TeamViewer remote support sessions.
Reporting	Read, Write	Localized	View and create reports.
Repository.BI	Populate, Read	Global	View and populate the BI repository.
Repository.Entitlement	Archive, Delete, Populate, Read, Write	Global	View, create, edit, delete, and archive entitlement repository.
Repository.Inventory	Archive, Delete, EvaluateManagementGroups, Populate, Read, Write	Global	View, create, edit, and delete Inventory repositories - populate and archive them.
Repository.Patch	Read	Global	View Patch Success dashboards.
Schedule	Delete, Read, Write	Global	View, create, edit, and delete Schedules - view Schedule history.
Security	Delete, Read, Write	Localized	Add and remove Users - view all Roles - add, modify, and delete Custom roles - assign roles to users - view Audit information log.
SynchronizationLog	Read	Global	View Sync log.
VDX	Read, Write	Global	View, create, edit, and delete application servers.