Configure roles with RBAC 编辑

The role-based access control (RBAC) feature in Endpoint Management lets you assign roles to users and groups. Roles are sets of permissions that control the level of access users have to system functions.

Endpoint Management comes with the following default user roles. You can use the default roles as templates that you customize to create your own user roles.

• Administrator: Grants full system access.
• User: Allows users to enroll devices and access the Self-Help Portal.

You can use the RBAC feature in Endpoint Management to:

• Create and edit user roles.
• Assign roles to local user groups and Active Directory (AD) groups.
• Assign roles to administrators in Citrix Cloud through Identity and Access Management > Administrators. See Add roles to Citrix Cloud administrators.

Use the RBAC feature

You can assign roles to local users, to cloud administrators (in Citrix Cloud), and to local user groups and Active Directory groups.

• Local users: Assign roles to local users using Manage > Users. You can assign only one role to local users. To change the roles, you can manually edit the user account. Or, you can create a group for local users and assign a role to that group.
• Cloud administrators: A cloud administrator is a special user account that Citrix Cloud creates when an administrator is added to your Citrix Cloud customer account. A cloud administrator account uses the same user name as the administrator account on Citrix Cloud. Create RBAC roles in the Endpoint Management console and assign roles to these users through Identity and Access Management > Administrators in Citrix Cloud.
• Active Directory groups: All users in an Active Directory group have the same permissions. If a user belongs to several Active Directory groups, all the permissions merge to define the permissions for that user. For example, suppose ADGroupA users can locate manager devices and ADGroupB users can wipe employee devices. A user who belongs to both groups can locate and wipe the devices of managers and employees. If a user belongs to groups with conflicting permissions, the allowed permissions prevail.

For more information, see About user accounts.

Create or edit roles

1. In the Endpoint Management console, to access the Settings page, click the gear icon in the upper-right corner.

2. Click Role-Based Access Control. The Role-Based Access Control page shows the default user roles and any roles that you added.

   Click the plus sign (+) next to a role to see all the permissions for that role.

   

3. To add a role, click Add. Or, to edit a role, click the pen to the right of an existing role.

   Note:

   You can delete a role by clicking the trash can to the right of a role that you defined. You can’t delete the default user roles.

4. On the Add Role page, enter the following information:

   • RBAC name: Enter a descriptive name for the new user role. You can’t change the name of an existing role.
   • RBAC template: Optionally, select a template as the starting point for the new role. (When editing a role, you can’t select or change templates.) RBAC templates are the default user roles that define the access to system functions.

   Click the Apply button to populate the Authorized access and Console features check boxes. Endpoint Management fills those fields with the predefined access and feature permissions for the selected template.

   

5. To customize the role, select or clear the check boxes in Authorized access and Console features.

   Click the triangle next to a console feature to reveal and select permissions specific to that feature. Clicking the top-level check box does not select the individual permissions. Select individual options after expanding the top-level permission.

6. Apply permissions: Click To specific user groups to apply permissions to the groups you select.

   For example, if an RBAC administrator has permissions to the ActiveDirectory user group:

   • The administrator can access information only for users who are in the ActiveDirectory group.
   • The administrator can’t view any other local or AD users. The administrator can view users who are members of child groups of either of those groups.

   • The administrator can send invitations to:

     • The permission groups and their child groups
     • The users who are members of permission groups and their child groups

   

7. Click Next and enter the following information to assign the role to user groups.

   

   • Select domain: From the list, select a domain.
   • Search for user groups: Click Search to see a list of all available groups. Type a full or partial group name to narrow the search.
   • Include user groups: In the list that appears, select the user groups you want to assign the role to.

8. Click Save.

Add roles to Citrix Cloud administrators

Instead of assigning RBAC roles to Citrix Cloud administrators through the Endpoint Management console, assign roles from the Citrix Cloud console.

1. In the Citrix Cloud console, navigate to Identity and Access Management > Administrators.

2. Selecting an identity provider, and then type an email address to add an administrator. Click Invite.

   Click the … at the end of an existing administrator row to edit those permissions.

3. Click Custom access. When assigning permissions to the administrator, you can select the RBAC roles created in the Endpoint Management console.

   

4. Click Send Invite to send an invitation to a new administrator or click Save to finish editing an administrator.

Predefined roles

Each predefined RBAC role has certain associated access and feature permissions. The tables that follow describe each of the permissions for the Admin role and for the User role. You can’t delete or edit the predefined roles.

• For a full list of default permissions for each built-in role, download Role-Based Access Control Defaults

• For information about the Endpoint Management user accounts, see About user accounts.

Important:

Under the Settings permission, the RBAC permission gives Admin users full access, including the ability to assign their own permissions. Give this access only to users who you intend to give the ability to manipulate everything in the Endpoint Management system.

Admin role

The predefined Admin role provides specific access in Endpoint Management. By default, Authorized access (except Self-Help Portal), Console features, and Apply permissions are enabled.

You can change the role for local users who are assigned the Admin role by using Manage > Users. For cloud users who have the Admin role, use the Citrix Cloud console to change the role. By default, cloud and local users with the Admin role have Full access.

Authorized access for administrators

Console features for administrators

Administrators have unrestricted access to the Endpoint Management console.

Device restrictions for administrators

Administrators access device features throughout the console by setting device restrictions, setting up and sending notifications to devices, administering apps on the devices, and so on.

Local Users and Groups

Administrators manage local users and local user groups on the Manage > Users page in Endpoint Management.

Enrollment

Administrators can add and delete enrollment invitations, send notifications to users, and export the enrollment table to a .csv file.

Policies

App

Administrators manage apps on the Configure > Apps page in Endpoint Management.

Media

Manage media from a public app store or a volume purchase license.

Action

Delivery group

Administrators manage delivery groups from the Configure > Delivery Groups page.

Enrollment profile

Manage enrollment profiles.

Alexa for Business

Manage Alexa for Business profiles.

Settings for administrators

Administrators configure various settings on the Settings pages.

Support

Administrators can do various support tasks.

Restrict Group Access

Admin users can apply permissions to all user groups.

Console features for device provisioning

Device provisioning users have the following restricted access to the Endpoint Management console. By default, each of the following features is enabled.

Device restrictions

Settings for device provisioning

Device provisioning users can access the Settings page, but do not have the rights to configure the features.

User role

Users with the User role have the following limited access to Endpoint Management.

Authorized access for users

Console features for users

Users have the following restricted access to the Endpoint Management console.

Device restricted access for users

Enrollment restrictions for users

Restrict Group Access for all roles

For the default roles, this permission is set by default and can be applied to all user groups. You can’t edit the role.