Assign Group Permissions

Permissions

Permission

Description

No Access

Users cannot access the selected feature. In most cases, the feature is not visible to the users.

Read Only

Users can view selected areas, but cannot change information.

Full Control

Users can view and change information for the selected feature.

Permissions for a BeyondInsight user must be assigned cumulatively and at the group level. You must assign permissions on features and Smart Groups after creating a new group in order for users in that group to be able to access features in the product. For example, if you want a BeyondInsight administrator to manage discovery scans only, then you must assign full control for the following features:

  • Management Console Access
  • Asset Management
  • Reports Management
  • Scan – Job Management
  • Scan Management

In addition to the group permissions noted, for the group to be provisioned, there must be at least one enabled Smart Group on the group. This sets the scope for the features.

Assign Features Permissions

  1. From the left navigation pane in the console, select Configuration.
  2. Under Role Based Access, select User Management.
  1. Click the vertical ellipsis button for the group, and then select View Group Details.
  2. Under Group Details, select Features.
  3. Filter the list of features displayed in the grid using the Show and Filter by dropdown lists.

Assign Features Permissions

  1. Select the features you wish to assign permissions to, and then click Assign Permissions or the vertical ellipsis button.
  2. Select Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.

 

The following table provides information on the features permissions you can assign to your groups.

Feature

Provides Permissions To:

Analytics & Reporting

Log in to the console and access Analytics & Reporting to generate and subscribe to reports.

Appliance (U-Series) Grant access to manage the U-Series Appliance as a BeyondInsight user.

Asset Management

Create Smart Rules.

Edit and delete buttons on the Asset Details window.

Create Active Directory queries.

Create address groups.

Attribute Management

Add, rename, and delete attributes when managing user groups.

Audit Manager Audit Manager on the Configuration page in the management console.

Credential Management

Add and change credentials when running scans and deploying policies.

Directory Credential Management Grant access to the configuration area where directory credentials are managed. This feature must be enabled to support access to directory queries as well.
Directory Query Management Grant access to the configuration area where directory queries are managed.

Access to Directory Credential Management must also be granted.

Domain Management Grants the user permission to configure mappings of bind credentials to domains for account resolution.
Endpoint Privilege Management Grant access to the Endpoint Privilege Management features.
Endpoint Privilege Management for Unix & Linux Grant access to the Endpoint Privilege Management for Unix & Linux features.

File Integrity Monitoring

Work with File Integrity rules.

License Reporting View the Licensing folder in Analytics & Reporting (MSP reports, Privilege Management for Windows, Privilege Management for Mac true-up reports, and Assets Scanned report).
Management Console Access Access the BeyondInsight management console.

Manual Range Entry

Allow the user to manually enter ranges for scans and deployments rather than being restricted to smart groups. The specified ranges must be within the selected smart group.

Option Management

Change the application options settings (for example, account lockout and account password settings).

Options - Connectors Access the configuration area where connectors are managed.
Options - Scan Options Access the configuration area where scan options are managed.
Password Safe Account Management

Grant read or write permissions to the following features on the Managed Accounts page and through the public API:

  • Bulk delete accounts
  • Add accounts to a Quick Group
  • Remove accounts from a Quick Group
  • Add, edit, and delete accounts
Password Safe Admin Session Password Safe web portal admin sessions.
Password Safe Admin Session Reviewer Grant a user admin session reviewer permissions only.
Password Safe Global API Quarantine Access to the Quarantine APIs.
Password Safe Bulk Password Change Change more than one password at a time.
Password Safe Domain Management Check the Read and Write boxes to permit users to manage domains.
Password Safe Role Management Allow a user to manage roles, provided they have the following permissions: Password Safe Role Management and User Account Management.
Password Safe System Management Read and write managed systems through the public API.
Password Safe Ticket System Management This feature is not presently used.

Protection Policy Management

Activate the protection policy feature. User groups can deploy policies, and manage protection policies on the Configuration page.

Reports Management

Run scans, create reports, and create report categories.

Scan - Audit Groups

Create, delete, update, and revert audit group settings.

Scan - Job Management

Activate Scan and Start Scan buttons.

Activate Abort, Resume, Pause, and Delete on the Job Details page.

Scan - Policy Manager

Activate the settings on the Edit Scan Settings view.

Scan - Port Groups

Create, delete, update, and revert port group settings.

Scan - Report Delivery

Allow a user to set report delivery options when running a scan:

  • Export Type
  • Notify when complete
  • Email report to
  • Include scan metrics in email (only available for All Audits Scan)

Scan Management

Delete, edit, duplicate, and rename reports on the Manage Report Templates page.

Activate New Report and New Report Category.

Activate the Update button on the Edit Scan Settings view.

Session Monitoring

Use the session monitoring features.

Smart Rule Management – Asset

Grants permission to create and edit asset Smart Rules; editing is limited to Smart Rrules that are enabled for groups the user is a member of.

Newly created Smart Rules created by a non-administrator are automatically enabled with read permissions for all groups that the user is a member of, and with full permissions for all groups that the user is a member of AND has the Asset Management permissions for. For more information, see Use Smart Rules to Organize Assets.

Smart Rule Management – Managed Account

Grants permission to create and edit managed account Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.

Newly created Smart Rules created by a non-administrator are automatically enabled with read permissions for all groups that the user is a member of, and with full permissions for all groups that the user is a member of AND has the Asset Management permissions for. For more information, see Use Smart Rules to Organize Assets.

Smart Rule Management – Managed System

Grants permission to create and edit managed system Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.

Newly created Smart Rules created by a non-administrator are automatically enabled with read permissions for all groups that the user is a member of, and with full permissions for all groups that the user is a member of AND has the Asset Management permissions for. For more information, see Use Smart Rules to Organize Assets.

Smart Rule Management – Policy User

Grants permission to create and edit policy user Smart Rules; editing is limited to smart rules that are enabled for groups the user is a member of.

Newly created Smart Rules created by a non-administrator are automatically enabled with read permissions for all groups that the user is a member of, and with full permissions for all groups that the user is a member of AND has the Asset Management permissions for. For more information, see Use Smart Rules to Organize Assets.

Team Passwords Provides access to Team Passwords for all members of the selected group.

Ticket System

View and use the ticket system.

Ticket System Management

Mark a ticket as inactive. The ticket no longer exists when Inactive is selected.

User Accounts Management

Add, delete, or change user groups and user accounts.

A minimum of read access to Directory Credential Management must also be granted to enable creation of AD and LDAP Groups.

User Audits

View audit details for management console users on the User Audits page.

For more information, please see the Managed Accounts section in the BeyondInsight and Password Safe API Guide.

Features Permissions Required for Configuration Options

Configuration Option

Feature and Permission

Active Directory Queries

Asset Management - Full Control.

Address Groups

Asset Management - Full Control.

Attributes

Asset Management - Full Control.

Connectors

Asset Management and Management Console Access - Full Control.

Password Safe Connections

Member of the built-in BeyondInsight Administrators group.

Endpoint Privilege Management Module

Management Console Access and Endpoint Privilege Management - Full Control.

Scan Options

Scan Management - Full Control.

Services

Member of the built-in BeyondInsight Administrators group.

User Audits

User Audits - Full Control.

User Management

Everyone can access.

Users without the Full Control permission to User Account Management feature can edit only their user record.

Workgroups

User Accounts Management - Full Control.

Assign Smart Groups Permissions

  1. From the left navigation pane in the console, select Configuration.
  2. Under Role Based Access, select User Management.
  1. Click the vertical ellipsis button for the group, and then select View Group Details.
  2. Under Group Details, select Smart Groups.
  3. Filter the list of Smart Groups displayed in the grid using the Show and Filter by dropdown lists.

Screenshot of assigning Smart Groups permissions to a newly created BeyondInsight group.

  1. Select the Smart Groups you wish to assign permissions to, and then click Assign Permissions.
  2. Select Assign Permissions Read Only, Assign Permissions Full Control, or Disable Permissions.