User roles

One user can have several roles, but only one role per service. For each service, you can define which role will be assigned to a user.

Alternatively, you can create and assign custom roles, which are combine different sets of permissions and apply across all services. For more information, see Custom roles.

The services that are available to you are configured by your service provider.

Service	Role	Description
n/a	Company administrator	This role grants full administrator rights for all services, including Cyber Frame. This role grants access to the corporate allowlist. If the Disaster Recovery add-on to the Protection service is enabled for the company, this role also grants access to the disaster recovery functionality. Users who have this role can create, view, and update any workflows in the system, as well as view the execution history, and assign workflows to the relevant tenant users. For propagated workflows or workflows set as templates, users with this role can: Enable or disable workflow versions for selected tenants and child tenants. Access workflow details in read-only mode. Clone workflows, but not workflow versions.
n/a	Unit administrator Unit level	This role grants highest possible permissions to all applicable services in the unit. The role does not provide access to the disaster recovery functionality.
Management Portal	Administrator	This role has access to Management Portal, and can manage users and tenants for the entire organization. See also Disaster Recovery roles.
	Read-only administrator Partner level	This role has read-only access to all objects in the partner's Management Portal and Management Portal of all customers of this partner. See Read-only administrator role.
	Read-only administrator Customer level	This role has read-only access to all objects in Management Portal of the entire company. See Read-only administrator role.
	Read-only administrator Unit level	This role has read-only access to all objects in Management Portal of the company unit and sub-units. See Read-only administrator role .
Vendor Portal	Developer	This role provides full access to Vendor Portal. Developers can create and manage CyberApps, CyberApp Descriptions, and CyberApp Versions. They can also submit deployment requests and monitor CyberApp metrics.
	User	This role allows the user to create, manage, and request approvals of CyberApp Descriptions.
	Read-only user	This role provides read-only access to Vendor Portal.
Protection
	Administrator	This role enables configuring and managing the Protection service for your customers. This role is required for: configuring and managing the Disaster Recovery functionality. configuring and managing the corporate allowlist. performing autodiscovery of devices. performing all actions related to software deployment by using DeployPilot (working with software deployment plans, software repositories, software packages, and performing quick deploy actions). Users who have this role can create, view, and update any workflows in the system, as well as view the execution history, and assign workflows to the relevant tenant users. For propagated workflows or workflows set as templates, users with this role can: Enable or disable workflow versions for selected tenants and child tenants. Access workflow details in read-only mode. Clone workflows, but not workflow versions.
	Cyber administrator	In addition to the rights of the Administrator role, this role enables configuring and managing the Protection service, and approving actions in Cyber Scripting. This role grants full access to Cyber Frame. The Cyber administrator role is only available for tenants with enabled RMM pack.
	Read-only administrator	The role provides read-only access to all objects of the Protection service, including Cyber Frame. See Read-only administrator role.
	User	This role enables using the Protection service but without administrative privileges. Access is provided to functionality such as Endpoint Detection and Response, but users assigned this role cannot access the data of other users in the organization.
	Restore operator	The role enables the recovery of Microsoft 365 and Google Workspace backups, while restricting the access to sensitive content inside the backups. A user who has this role also has all permissions of the Read-only administrator role, and therefore has read-only access to the Protection service beyond Microsoft 365 and Google Workspace.
	Security Analyst	The role can be assigned only in customer tenants for which the Detection and Response offering item is enabled. It provides access to the Cyber Protection console and enables the user to manage EDR incidents and perform response actions.
	RMM operator	The role provides access only to the remote management and monitoring features of the Protection service. With this role, you can: start remote desktop connections (via NEAR, RDP, Apple Screen Sharing, or web client) without having access to workload credentials management. manage workloads (restart, shut down, put to sleep, empty recycle bin, or log out remote user). run remote command line. browse device details, software and hardware inventory, and monitoring data. run approved built-in scripts on demand. install software packages from the My packages repository on demand. install approved patches with accepted EULA on demand. run software and hardware inventory scans on demand. browse alerts and activities. Features that are restricted for this role will be hidden in the console.
File Sync & Share	Administrator	This role enables configuring and managing File Sync & Share for your users.
Cyber Infrastructure	Administrator	This role enables configuring and managing Cyber Infrastructure for your users.
Cyber Employee	Cyber Employee Administrator	This role provides access to the Cyber Employee menu in Management Portal and enables Single Sign-On (SSO) access to the newo.ai console. See Cyber Employee.
PSA
	Engineer	The default role applied to all users. Includes access to the service desk and project management modules plus time tracking functionality. This role also includes limited access to customer details and their end users.
	HR	Includes limited access to the service desk, project management, reports, and time management modules.
	Finance	Includes access to the CRM, sales and billing, service desk, project management, plus time tracking functionality. This role also includes limited access to client's financial statistics and no access to company reports.
	Sales	Includes access to the CRM, sales, service desk, and project management modules, plus time tracking functionality. This role also includes limited access to invoices data and no access to company reports.
	Group manager	Includes access to the CRM, service desk, and project management. This role also includes full access to client's financial statistics, company reports, and time management functionality, as well as limited access to the Sales module.
	Finance manager	Includes access to the CRM, sales and billing, service desk, and project management modules. This role also includes full access to client's financial statistics and company reports, and Time management functionality.
	Director	Includes access to all modules but without the capability to manage global company settings.
	Administrator	Full access rights and the capability to manage global company settings for the service desk, Billing and Invoicing.
	The following roles are available for customer users (select the relevant customer, and then go to Company management > Users). When users are first added, their status is 'inactive', and an invitation email is sent to the user. You can activate or deactivate their access to PSA at any time.
	Client manager	Includes access to the service desk, invoices, and reports modules (limited to within the customer organization).
	Client	Includes access to the service desk module (limited to within the customer organization).
Partner Portal	There are a number of roles that can be assigned to Partner Portal users. For more information, see Partner Portal roles.

Vendor Portal is available to technology partners who registered on the Acronis Technology Ecosystem website after October 04, 2023.

If you are looking to build an integration and require access to Vendor Portal and a dedicated sandbox, see the Integrations chapter.

Any changes related to the accounts and roles are shown on the Activities tab with the following details:

What was changed.
Who did the changes.
Date and time of changes.