Manage roles

View as Markdown Open in ChatGPT Open in Claude

A role is a named set of permissions, and each person in the console holds one or more roles. This page shows how to create and change roles, and how to change which roles a person holds, so each technician has the access their job needs and no more. For the roles every Outpost comes with, see Roles and permissions.

Before you begin

You need role:manage. Among the built-in roles, only Owner holds it.
Home Lab has one console user, the owner, and no roles. Changing roles there is refused with Plan limit reached.
A change to a role applies to everyone who holds it from their next request. Removing a permission takes it away from all of them at once.
On the MSP plan, roles belong to your practice’s team, and you manage them from the practice, not from a client.

What you can change

Owner always holds every permission and cannot be changed in any way: not renamed, narrowed, restored, or deleted. Your Outpost always has someone who can undo a change.
The other built-in roles (Support Manager, Field Technician, Support Rep, and Accounting) can be edited, and each has Restore defaults. They cannot be deleted.
Custom roles can be created, cloned, edited, and deleted, and have no Restore defaults. Sales and Project manager come with every Outpost and are custom roles. A role’s code is set from its name when you create it and does not change.
Every role holds feedback:submit and search:query, whatever you select.
If you are not an owner, you can only add or remove permissions you hold yourself. You cannot edit, restore, or delete a role that holds permissions you do not have, and you cannot give anyone such a role, whether you invite them into it or add it on the Team page. The console shows You do not hold this permission, so you cannot add it to or take it away from a role. beside a permission you cannot change. A role you cannot edit opens read-only, with This role holds permissions you do not hold yourself, so you cannot edit it. An owner can. On the Team page, such a role is locked with This role grants permissions you do not hold, so you cannot give or take it away., and the invite form leaves it out.
Only an owner can give or take away the Owner role.

Create or clone a role

Go to Settings > Roles.
Select New role. To start from an existing role instead, select Clone on its row.
In Name, enter the role’s name. Optionally, enter a Description, which is shown wherever someone picks a role.
In Start from, choose the role whose permissions the new role copies, or No permissions. Clone fills this in for you.
Select Create role. The role opens so you can change its permissions.

Change a role’s permissions

Go to Settings > Roles, and select the role.
Under Permissions, open an area, or enter a name, code, or description in Search permissions. A search opens every area with a match.
Select or clear the permissions. The count shows how many the role holds.
Select Review and save. The console lists the permissions you are adding and removing, and how many people hold the role.
Select Save permissions, or Keep editing to go back.

To change the name or description, edit them under Details and select Save details.

To narrow how technicians connect to endpoints, clear remote:unattended, remote:attended, remote:consent, or remote:escorted from their role. See Permission for each mode.

Restore a built-in role’s defaults

Open the built-in role from Settings > Roles.
Select Restore defaults, then Restore defaults again to confirm.

The role gets back the permissions it shipped with, and the changes made to it are replaced.

Delete a custom role

You can delete a custom role, including Sales and Project manager, only when nobody holds it. Built-in roles cannot be deleted, and the console does not offer Delete for them.

Take the role away from everyone who holds it. The role’s page lists them under People with this role.
Go to Settings > Roles, and select Delete on the role’s row.
Confirm.

Change a person’s roles

Go to Settings > Team.
On the person’s row, select Roles.
Select the roles they should hold, and clear the ones they should not. Each change saves at once.

The change applies from the person’s next request, and they receive an email saying their account permissions were changed. Your organization always keeps at least one active owner.

Verify

The role’s page shows the permission count you expect, and People with this role lists the right people.
Each change is recorded in the audit log, including the permissions added and removed. See Audit logs.

If something goes wrong

Symptom	Cause	Fix
A permission’s checkbox is unavailable	You are not an owner and do not hold that permission.	Ask an owner to make the change.
That role holds permissions you do not have. Ask an owner., followed by Permissions involved: and the permission codes	You are not an owner, and the role, or the role you are giving someone, holds the listed permissions, which you lack.	Ask an owner.
You can only grant permissions you hold yourself., followed by Permissions involved: and the permission codes	You are not an owner, and you tried to add the listed permissions to a role without holding them.	Clear them, or ask an owner.
Delete is unavailable	People still hold the role.	Take the role away from them on the Team page first.
Roles is missing from Settings	You do not hold `role:manage`.	Ask an owner.

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.