User management & roles
Create user accounts, assign roles, and manage permissions.
Overview
User management & roles controls who can access your Xcellerate RMM instance and what they are allowed to do. Every person who logs in — whether an admin, a technician, or a read-only auditor — is represented by a user account with one or more roles that define their permissions.
Roles are fully customisable. You can use the built-in roles (Administrator, Technician, Viewer) as-is, clone them and tweak permissions, or create entirely new roles from scratch.
Key concepts
- User account — a login identity with an email, display name, and authentication method (local password or SSO).
- Role — a named set of permissions (e.g. "Technician"). A user can hold multiple roles; permissions are additive (the user gets the union of all role permissions).
- Permission — a granular capability such as "view endpoints", "run scripts", "manage users", or "delete groups". Permissions are grouped by module for easy browsing.
- Tenant scope — roles can be scoped globally (access to all tenants) or restricted to specific tenants. This lets you give a client's IT contact read-only access to their own data without exposing other clients.
- Two-factor authentication (2FA) — optional per-user or enforced globally. Supports TOTP authenticator apps (Google Authenticator, Authy, etc.).
Step-by-step walkthrough
Create a user account
Go to Administration → Users → New user. Enter the email address, display name, and choose an authentication method (local password or SSO). Click Create. The user receives a welcome email with login instructions.
Assign a role
On the user detail page, click Roles → Assign role. Select one or more roles from the list. If you need tenant scoping, expand Tenant access and select the specific tenants this user should see.
Create a custom role
Navigate to Administration → Roles → New role. Name the role (e.g. "Junior technician"), then toggle permissions on or off for each module. Save. The role is now available for assignment.
Enforce two-factor authentication
To enforce 2FA for all users, go to Administration → System settings → Security and enable Require 2FA. Users without 2FA configured will be prompted to set it up on their next login.
Deactivate a user
On the user list, click the user and select Deactivate. The account is disabled immediately — the user can no longer log in, but their audit history is preserved.
Tips & best practices
- Follow the principle of least privilege — give each user only the permissions they need for their job.
- Use tenant scoping to let client contacts view their own endpoints without seeing other clients' data.
- Enforce 2FA for all administrator accounts at minimum.
- Review user accounts quarterly and deactivate anyone who no longer needs access.
- Clone a built-in role instead of building one from scratch — it's faster and less error-prone.