Appearance
A role is a named set of permissions. Every company starts with Admin, Manager, Technician and Viewer; Admins can change what the last three can do and add roles of their own.
Overview
On the Roles page, pick a role on the left to see its permissions, grouped by area. Tick or untick permissions and click Save; everyone in that role has the new permissions at once.
- Admin always has every permission and cannot be changed.
- Manager, Technician and Viewer are built in. Change them, or put one back with Reset to default. Built in roles keep their names and cannot be deleted.
- Roles you add can be renamed and deleted.
Four permissions run the company's account and stay with Admins only: Manage users and roles, Company settings, custom domain and storage, Plan and billing and See the activity log. They are marked Admins only and cannot be given to another role, so no other role can hand itself more.
Permissions that change something include seeing it. A permission marked Includes seeing them turns on the matching "see" permission when you save. The Vault is the exception: Add, edit and delete secrets and config backups does not include seeing them, so a role can replace a password it cannot read. See Secrets.
Every change to a role is recorded in the activity log.
Requirements
- Role: Manage users and roles (Admins only).
What each role can do by default
| Permission | Admin | Manager | Technician | Viewer |
|---|---|---|---|---|
| Equipment | ||||
| See equipment | Yes | Yes | Yes | Yes |
| Add equipment | Yes | Yes | Yes | |
| Edit equipment | Yes | Yes | ||
| Assign, lend and check in | Yes | Yes | Yes | |
| Dispose of equipment | Yes | Yes | ||
| Delete equipment | Yes | Yes | ||
| See reports | Yes | Yes | Yes | Yes |
| Submit the company's own devices to the shared device library | Yes | Yes | Yes | |
| Approve device library submissions before they go to TekStacks | Yes | Yes | ||
| Employees | ||||
| See employees | Yes | Yes | Yes | Yes |
| Add, edit, import and mark employees as left (never delete) | Yes | Yes | Yes | |
| Lists and tags | ||||
| Manage statuses, locations, departments, vendors and custom fields | Yes | Yes | Yes | |
| Manage tag series | Yes | Yes | ||
| Manage clients | Yes | Yes | ||
| Documentation | ||||
| Read documentation | Yes | Yes | Yes | Yes |
| Write, archive and restore documentation | Yes | Yes | Yes | |
| Files and snippets | ||||
| See and download files | Yes | Yes | Yes | Yes |
| Upload, edit, share and delete files | Yes | Yes | Yes | |
| Change management | ||||
| See changes | Yes | Yes | Yes | Yes |
| Record and edit changes | Yes | Yes | Yes | |
| Approve planned changes | Yes | Yes | ||
| Network | ||||
| See VLANs, subnets and addresses | Yes | Yes | Yes | Yes |
| Add, edit and delete VLANs, subnets and addresses | Yes | Yes | Yes | |
| Services | ||||
| See domains, certificates, hosting and subscriptions | Yes | Yes | Yes | Yes |
| Add, edit, renew and delete them | Yes | Yes | Yes | |
| Software and licenses | ||||
| See software, licenses and seats | Yes | Yes | Yes | Yes |
| Add and edit them, give out seats and reveal keys | Yes | Yes | Yes | |
| Checklists | ||||
| See checklists | Yes | Yes | Yes | Yes |
| Start checklists and tick their steps | Yes | Yes | Yes | |
| Edit checklist templates | Yes | Yes | ||
| Vault | ||||
| See secrets and config backups | Yes | Yes | Yes | |
| Add, edit and delete secrets and config backups | Yes | Yes | Yes | |
| Tasks | ||||
| Use tasks | Yes | Yes | Yes | |
| Administration | ||||
| Manage users and roles | Yes | |||
| Company settings, custom domain and storage | Yes | |||
| Plan and billing | Yes | |||
| See the activity log | Yes |
Change a role
- Under Administration, open Roles.
- Pick the role on the left.
- Tick or untick permissions. Each group has a control to select or clear all of it.
- Click Save.
Add a role
- On Roles, click New role.
- Enter a Name of up to 40 characters, such as "Help desk".
- Under Start from, choose a role to copy its permissions, or leave No permissions.
- Save. The new role opens, ready to adjust.
Give people the role on the Users page with Change role, or when you invite them.
Rename, reset or delete a role
- Rename: for roles you added.
- Reset to default: for Manager, Technician and Viewer. Their permissions go back to what TekStacks gives every company.
- Delete: for roles you added, once nobody is in them. The list on the left shows how many people are in each role.
Troubleshooting
"Move everyone in this role to another one first." Only a role nobody is in can be deleted. Change those users' roles on the Users page.
"There is already a role with that name." Role names are unique in your company, and no role can be called Admin.
I cannot tick a permission. It is one of the Admins only permissions, or you are looking at the Admin role, which always has everything.
FAQ
Can I give someone access to billing without making them an Admin? No. Billing, settings, users, roles and the activity log stay with the Admin role.
Do Microsoft Entra groups use these roles? Yes. When you map an Entra group to a role, its members get that role. See Sign in with Microsoft.