Permission Sets

A Permission Set combines several individual permissions into a single, reusable bundle. It defines what a user or group is allowed to do. You assign permission sets to groups (recommended) or directly to users.

Managing permission sets requires the permissions of the Administrator role.

Opening the Permission Set List

Navigate to > Administration > User Management > Permission Sets. The list contains the predefined permission sets as well as any custom ones you create. Use the search box to filter by name. The columns Read, Create, Update and Delete summarize how many permissions of each action the set grants.

The permission set list

Permissions and Actions

A permission set is a grid of permissions (grouped into categories such as Building Structure, Device Management or Sensors & Monitoring) and actions:

Action Meaning

Read

View the entity.

Create

Create new entities.

Update

Modify existing entities.

Delete

Remove entities.

A dash (–) means the action does not apply to that permission. Some actions imply others. For example, granting Update automatically grants Read, which is then shown as a locked checkbox.

Creating a Permission Set

  1. Click Create Permission Set in the top right corner.

  2. Enter a Name and an optional Description.

  3. Optionally click a Template (e.g. Facility Manager or Commissioning Engineer) to pre-fill a typical set of permissions that you can then adjust.

  4. Tick the checkboxes for the permissions and actions the set should grant.

  5. Click Save.

Creating a permission set from the Facility Manager template
Start from the closest Template and remove what you do not need, rather than building a set from scratch.

Reviewing a Permission Set

Open a permission set to see a read-only overview of everything it grants. Granted actions show a green check, denied actions a red cross, and non-applicable actions a grey dash.

The read-only overview of a permission set

Use Edit Permission Set to change it, or the More menu to delete it.

Permissions That Can Be Restricted

Some permissions can be granted for only specific entities; others always apply organization-wide. In the permission grid, the ones that can be scoped this way are marked with a small shield icon:

The shield icon marks permissions that can be restricted to specific entities

  • Can be restricted (shield icon): permissions on the building structure (Buildings, Floors, Rooms, Zones, Places), Networks and Devices.

  • Always organization-wide (no shield icon): everything else, for example Device Details, Device Provisioning, Diagnostic Logs, sensor data, users, alerts and settings.

The actual restriction is configured per assignment via Partial Permissions.

Keep restrictable and always-global permissions in separate permission sets.

When you scope a permission set to certain buildings or devices, only its shield-marked permissions are restricted; every other permission in the same set still applies organization-wide. If you would rather not have some permissions scoped together with the building and device permissions, put them in their own permission set. This keeps each set’s reach predictable and makes your setup future-proof if you decide to scope things later.

The Scope Option

When you edit a permission set you may see a Scope option with the values Not Published and Published. This is a system-administrator feature for sharing a set across organizations; see Publishing Permission Sets. For a normal organization you can leave it at Not Published.

Assigning a Permission Set

Permission sets are not useful on their own, so assign them where they are needed:

  • To a group (recommended) via the group’s Assigned Permission Sets card.

  • To a single user via the user’s Assigned Permission Sets card.

To restrict an assignment to certain buildings or devices, continue with Partial Permissions.

See Also