# Roles and permissions

A role is a named set of permissions. You give people roles on the **Team** page (for a whole organization), on the **Groups** page (for one group of devices), or on the **Users** page (for all or selected organizations). Blink checks every action against the permissions of the roles a person holds, and their permissions add up.

## The roles Blink starts with

### Owner

**Owner** is the only built-in role. It has every permission in its organization, including permissions added in later versions of Blink. It can't be changed or deleted, and it can only be given for a whole organization, never on a group. Whoever creates an organization becomes its first Owner.

### Starter roles: Admin, Technician and Viewer

A new Blink server comes with three starter roles. They are ordinary instance roles: you can edit them, copy them or delete them.

| Role | Description in the console | What it includes |
|---|---|---|
| **Admin** | Everything except renaming or deleting the organization, managing owners, terminal access and backstage as SYSTEM | All Support, Access, Recordings, Logs, Enrollment, Groups and Members permissions (except the terminal and Backstage as SYSTEM), plus **Manage org roles**, **View activity**, **View agent IP rules** and **Manage agent IP rules** |
| **Technician** | Support and Access sessions, device control and recordings | Create and join Support sessions with control, clipboard, file transfer, Run as admin and Install Access; view and connect to devices with Backstage, control, clipboard, file transfer, Reboot and Edit devices; Blink View and chat in Support and Access sessions; end any session; view and download recordings; view logs and change log levels |
| **Viewer** | Watch sessions, see devices, play recordings and read logs | Join any Support or Access session (view only), view devices, view and download recordings, view logs |

### Member (group access only)

**Member (group access only)** is not a role with permissions. It makes someone a member of the organization with no organization-wide permissions, so they reach only the groups where you give them a role. See [Limit access with groups](/configure/groups/).

### Instance owners

Instance owner is not a role either. It is a setting on a user that gives them every instance permission and every organization permission except the three [granted on their own](#permissions-granted-on-their-own). See [Instance owners](/configure/users/#instance-owners).

## Instance roles and organization roles

Every custom role has a scope, which you choose when you create it:

- **All organizations**: an instance role, defined once and usable in every organization and on the **Users** page. Only people with the **Manage instance roles** permission can create or change instance roles.
- **This organization**: an organization role, usable only in the organization where it was made. People with the **Manage org roles** permission can create them.

:::caution[The scope can't be changed later]
A role's scope is fixed when you create it. To have a version of a role in the other scope, copy it.
:::

The **Roles** page lists every role you can use in the current organization. The **Kind** column shows **Built-in**, **Instance** or **Organization**, and **In use** shows how many people hold it. Instance administrators also find the instance roles under **Instance** › **Roles**.

## Create a role

1. Open **Roles** (or **Instance** › **Roles**) and select **New role**.
2. If you can create both kinds, choose the **Scope**: **This organization** or **All organizations**.
3. Enter a **Name** (up to 64 characters) and, optionally, a **Description**. The name **Owner** is reserved.
4. Choose the permissions:
   - **All permissions** includes everything, including permissions added later. For an instance role it excludes instance administration.
   - **All *area* permissions** includes a whole area, including permissions added to it later.
   - Otherwise, tick permissions one at a time.
5. Select **Save role**.

If your plan does not include **Custom roles**, the **Roles** page shows **Custom roles: not in your plan** in place of **New role**, and roles can't be copied. Only the starter roles **Admin**, **Technician** and **Viewer** stay editable. Every other role is marked **read-only**: it keeps working and can still be given to people, but it can't be changed, and the editor says **Not included in your plan: Custom roles. This role keeps working but cannot be changed.** You can still delete such a role. See [Understand your plan and its limits](/configure/plans-and-limits/).

:::note[You can only give what you have]
You can't put a permission into a role unless you hold it yourself. Permissions you don't hold are greyed out with **You don't have this permission**. This stops anyone from creating a role more powerful than their own.
:::

### Own or Any sessions

Some session permissions offer **None**, **Own** or **Any**:

- **Own**: only sessions the person started.
- **Any**: every session they can reach.

These are **Join support sessions**, **End support sessions**, **Delete support sessions**, **Join access sessions**, **End access sessions**, **View recordings**, **Download recordings** and **Delete recordings**. Anyone who can create a session can always join their own.

### Permissions granted on their own

Three permissions are never included by ticking a whole area. A role gets them only by naming them, or through **All permissions**:

- **Terminal (support)**
- **Terminal (access)**
- **Backstage as SYSTEM**

The console marks them with **Not included in 'all' for this area. Grant it on its own.** Terminals are recorded when your plan includes **Terminal history**, and Backstage sessions when it includes **Session recording**.

### Organization-level permissions on a group

The Enrollment, Groups, Members, Roles, Organization and Activity areas apply organization-wide only. When a role is given on a group, those permissions are ignored, and the editor says so with **Ignored when this role is given on a group.**

Instance permissions only apply when a role is given for all organizations on the **Users** page.

### Permissions your plan does not include

Some permissions only do something when your plan includes the matching feature, for example **Terminal (support)** needs **Attended Support** and **Remote terminal**, and **Connect to devices** needs **Unattended Access**. The role editor still lists them, so a role always shows what it grants, but marks each one your plan does not cover with **Not included in your plan:** and the missing features. Blink ignores those permissions while your plan lacks the feature. Roles that hold them can still be given to people, and the permissions take effect if your plan later includes the feature. See [Understand your plan and its limits](/configure/plans-and-limits/#when-something-is-not-in-your-plan).

## Edit, copy or delete a role

On the **Roles** page, select a role to view it, or use the icons at the end of its row:

- **Edit** (pencil): change the name, description or permissions. Roles you can't change open read-only, with an eye icon.
- **Copy**: start a new role from this one's permissions. If the copy includes permissions you don't hold or that its scope doesn't allow, the editor leaves them out and tells you which.
- **Delete** (bin): only works when nobody holds the role. Change those people's roles first.

## Turn organization roles on or off

People with the **Instance settings** permission decide whether organizations may have their own roles. This is useful when, for example, a customer's own staff manage their organization.

1. Open **Instance** › **Settings**.
2. Under **Organization roles**, tick or clear **Allow organization roles**.

When it is off, existing organization roles keep working but can't be changed or given to anyone new. They can still be deleted. The **Roles** page then shows a notice, and those roles are marked **read-only**.

## Permission reference

These are the permissions you can put in a role, by area, as the role editor lists them.

### Support

| Permission | Allows |
|---|---|
| Create support sessions | Create a Support code or link, organization-wide or in a group where the permission is held |
| Join support sessions (own or any) | Open the viewer on a Support session (view only) and see it in lists |
| Control (support) | Keyboard, mouse, type-text and held keys |
| Clipboard (support) | Clipboard sync, both directions |
| File transfer (support) | File transfer, both directions |
| Run as admin (support) | Send administrator credentials and consent to elevation prompts |
| Install Access | Turn a Support session into an enrolled Access device |
| Terminal (support) | Open a command window on the customer's computer as the customer, or as administrator when the session is elevated (also needs Run as admin). Recorded when your plan includes terminal history. |
| Blink View (support) | Create Blink View codes and accept a customer's phone camera into the session (also send the QR code to the customer's computer and end the camera) |
| Chat (support) | Chat with the customer in Support sessions; secret messages when the plan includes them |
| End support sessions (own or any) | End a Support session |
| Delete support sessions (own or any) | Delete an ended Support session with its recording and log |

### Access

| Permission | Allows |
|---|---|
| View devices | See devices, presence and device details |
| Connect to devices | Start an unattended session on a device |
| Join access sessions (own or any) | Open the viewer on an existing Access session (view only) and see it in lists |
| Backstage | Start and join backstage (hidden desktop) sessions; apps there run as the signed-in user |
| Backstage as SYSTEM | Backstage apps run as SYSTEM instead of the signed-in user. A backstage session started with it can only be joined by people who also hold it. Recorded when your plan includes session recording. |
| Control (access) | Keyboard, mouse and type-text; also run as admin in Access sessions |
| Clipboard (access) | Clipboard sync |
| File transfer (access) | File transfer |
| Reboot | Reboot the device normally |
| Safe Mode reboot | Reboot the device into Safe Mode with Networking (also allows a normal reboot) |
| Terminal (access) | Open a command window on a device as SYSTEM or as a signed-in user. Recorded when your plan includes terminal history. |
| Blink View (access) | Create Blink View codes and accept a customer's phone camera into the session (also end the camera) |
| Chat (access) | Chat with the signed-in user of a device, before and during a session; secret messages when the plan includes them |
| End access sessions (own or any) | End an Access session |
| Edit devices | Rename, edit tags, change groups, push an agent update |
| Remove devices | Revoke, un-revoke or unenroll a device |

Watching a live [Blink View](/use/blink-view/) camera needs only permission to join the session, and the end permissions can end the camera too. Roles with **All Support permissions**, **All Access permissions** or **All permissions** get **Blink View (support)** and **Blink View (access)** automatically. Custom roles that list permissions one by one do not get them until you add them.

The same goes for [chat](/use/chat/): **Chat (support)** and **Chat (access)** come with the **Owner**, **Admin** and **Technician** roles and with **All Support permissions**, **All Access permissions** or **All permissions**, but not with **Viewer**, and custom roles that list permissions one by one need them added. Chat also needs **Chat** in your plan, and secret messages **Secret messages**.

### Recordings and logs

| Permission | Allows |
|---|---|
| View recordings (own or any) | List and play recordings |
| Download recordings (own or any) | Download whole recording files |
| Delete recordings (own or any) | Delete a session's video and audio (the session and its log stay) |
| View logs | Session and device logs and the timeline |
| Change log levels | Change the agent's live log levels |

### Organization administration

These apply organization-wide only.

| Permission | Allows |
|---|---|
| Enroll devices | Create and list enrollment keys, build installers |
| Revoke enrollment keys | Revoke enrollment keys |
| Create groups | Create device groups |
| Edit groups | Rename device groups |
| Delete groups | Delete device groups |
| Manage group access | List, add and remove group roles |
| Add members | Add users to the organization |
| Remove members | Remove users from the organization |
| Change member roles | Change a member's role or suspend them |
| Manage org roles | Create, edit and delete organization roles |
| Edit organization | Rename the organization and change its settings |
| Delete organization | Delete the organization |
| Manage owners | Give or take the Owner role |
| View agent IP rules | See where the organization's Access agents may connect from |
| Manage agent IP rules | Change the IP ranges and countries the organization's Access agents may connect from |
| View activity | The organization's activity log |

### Instance administration

These only go in instance roles and only apply when the role is given for all organizations.

No starter role includes **View license**, **Diagnostic mode** or **Send diagnostics to IZT**. Instance owners have them; anyone else needs an instance role that includes them, given for all organizations. If you upgraded from a version without it, every role that already had **Instance settings** was given **View license** too.

| Permission | Allows |
|---|---|
| Create organizations | Create organizations |
| Delete any organization | Delete any organization |
| Manage users | Create and disable users; manage instance role assignments |
| Manage instance roles | Create, edit and delete instance roles |
| Instance settings | Instance-wide settings such as organization roles and the name shown to customers, the **Identity** tab, and the **Agent builds** card and instance id on the **License** tab |
| Instance activity | The instance-wide activity log |
| View license | The license, what the plan includes, and the seats and devices in use |
| Certificates | Upload HTTPS certificates and configure Let's Encrypt for the console's host names |
| View security settings | See the join-code format, rate limits, bans and the allowlist |
| Manage security settings | Change the join-code format and rate limits, ban and unban addresses, edit the allowlist (includes View security settings) |
| Diagnostic mode | Turn on, extend and turn off [diagnostic mode](/troubleshooting/diagnostic-mode/) for the whole instance |
| Send diagnostics to IZT | Send every organization's logs and settings to IZT Support, see and delete what was sent, download a bundle. See [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/) |

**View security settings** and **Manage security settings** also cover seeing and changing the console's [IP and country rules](/configure/ip-and-country-rules/).