Roles and permissions

A role is a named set of permissions. You give people roles on the Team page (for a whole organization), on the Groups page (for one group of devices), or on the Users page (for all or selected organizations). Blink checks every action against the permissions of the roles a person holds, and their permissions add up.

The roles Blink starts with

Owner

Owner is the only built-in role. It has every permission in its organization, including permissions added in later versions of Blink. It can’t be changed or deleted, and it can only be given for a whole organization, never on a group. Whoever creates an organization becomes its first Owner.

Starter roles: Admin, Technician and Viewer

A new Blink server comes with three starter roles. They are ordinary instance roles: you can edit them, copy them or delete them.

Role	Description in the console	What it includes
Admin	Everything except renaming or deleting the organization, managing owners, terminal access and backstage as SYSTEM	All Support, Access, Recordings, Logs, Enrollment, Groups and Members permissions (except the terminal and Backstage as SYSTEM), plus Manage org roles, View activity, View agent IP rules and Manage agent IP rules
Technician	Support and Access sessions, device control and recordings	Create and join Support sessions with control, clipboard, file transfer, Run as admin and Install Access; view and connect to devices with Backstage, control, clipboard, file transfer, Reboot and Edit devices; Blink View and chat in Support and Access sessions; end any session; view and download recordings; view logs and change log levels
Viewer	Watch sessions, see devices, play recordings and read logs	Join any Support or Access session (view only), view devices, view and download recordings, view logs

Member (group access only)

Member (group access only) is not a role with permissions. It makes someone a member of the organization with no organization-wide permissions, so they reach only the groups where you give them a role. See Limit access with groups.

Instance owners

Instance owner is not a role either. It is a setting on a user that gives them every instance permission and every organization permission except the three granted on their own. See Instance owners.

Instance roles and organization roles

Every custom role has a scope, which you choose when you create it:

• All organizations: an instance role, defined once and usable in every organization and on the Users page. Only people with the Manage instance roles permission can create or change instance roles.
• This organization: an organization role, usable only in the organization where it was made. People with the Manage org roles permission can create them.

The scope can’t be changed later

A role’s scope is fixed when you create it. To have a version of a role in the other scope, copy it.

The Roles page lists every role you can use in the current organization. The Kind column shows Built-in, Instance or Organization, and In use shows how many people hold it. Instance administrators also find the instance roles under Instance › Roles.

Create a role

1. Open Roles (or Instance › Roles) and select New role.
2. If you can create both kinds, choose the Scope: This organization or All organizations.
3. Enter a Name (up to 64 characters) and, optionally, a Description. The name Owner is reserved.
4. Choose the permissions:
   • All permissions includes everything, including permissions added later. For an instance role it excludes instance administration.
   • All area permissions includes a whole area, including permissions added to it later.
   • Otherwise, tick permissions one at a time.
5. Select Save role.

If your plan does not include Custom roles, the Roles page shows Custom roles: not in your plan in place of New role, and roles can’t be copied. Only the starter roles Admin, Technician and Viewer stay editable. Every other role is marked read-only: it keeps working and can still be given to people, but it can’t be changed, and the editor says Not included in your plan: Custom roles. This role keeps working but cannot be changed. You can still delete such a role. See Understand your plan and its limits.

You can only give what you have

You can’t put a permission into a role unless you hold it yourself. Permissions you don’t hold are greyed out with You don’t have this permission. This stops anyone from creating a role more powerful than their own.

Own or Any sessions

Some session permissions offer None, Own or Any:

• Own: only sessions the person started.
• Any: every session they can reach.

These are Join support sessions, End support sessions, Delete support sessions, Join access sessions, End access sessions, View recordings, Download recordings and Delete recordings. Anyone who can create a session can always join their own.

Permissions granted on their own

Three permissions are never included by ticking a whole area. A role gets them only by naming them, or through All permissions:

• Terminal (support)
• Terminal (access)
• Backstage as SYSTEM

The console marks them with Not included in ‘all’ for this area. Grant it on its own. Terminals are recorded when your plan includes Terminal history, and Backstage sessions when it includes Session recording.

Organization-level permissions on a group

The Enrollment, Groups, Members, Roles, Organization and Activity areas apply organization-wide only. When a role is given on a group, those permissions are ignored, and the editor says so with Ignored when this role is given on a group.

Instance permissions only apply when a role is given for all organizations on the Users page.

Permissions your plan does not include

Some permissions only do something when your plan includes the matching feature, for example Terminal (support) needs Attended Support and Remote terminal, and Connect to devices needs Unattended Access. The role editor still lists them, so a role always shows what it grants, but marks each one your plan does not cover with Not included in your plan: and the missing features. Blink ignores those permissions while your plan lacks the feature. Roles that hold them can still be given to people, and the permissions take effect if your plan later includes the feature. See Understand your plan and its limits.

Edit, copy or delete a role

On the Roles page, select a role to view it, or use the icons at the end of its row:

• Edit (pencil): change the name, description or permissions. Roles you can’t change open read-only, with an eye icon.
• Copy: start a new role from this one’s permissions. If the copy includes permissions you don’t hold or that its scope doesn’t allow, the editor leaves them out and tells you which.
• Delete (bin): only works when nobody holds the role. Change those people’s roles first.

Turn organization roles on or off

People with the Instance settings permission decide whether organizations may have their own roles. This is useful when, for example, a customer’s own staff manage their organization.

1. Open Instance › Settings.
2. Under Organization roles, tick or clear Allow organization roles.

When it is off, existing organization roles keep working but can’t be changed or given to anyone new. They can still be deleted. The Roles page then shows a notice, and those roles are marked read-only.

Permission reference

These are the permissions you can put in a role, by area, as the role editor lists them.

Support

Permission	Allows
Create support sessions	Create a Support code or link, organization-wide or in a group where the permission is held
Join support sessions (own or any)	Open the viewer on a Support session (view only) and see it in lists
Control (support)	Keyboard, mouse, type-text and held keys
Clipboard (support)	Clipboard sync, both directions
File transfer (support)	File transfer, both directions
Run as admin (support)	Send administrator credentials and consent to elevation prompts
Install Access	Turn a Support session into an enrolled Access device
Terminal (support)	Open a command window on the customer’s computer as the customer, or as administrator when the session is elevated (also needs Run as admin). Recorded when your plan includes terminal history.
Blink View (support)	Create Blink View codes and accept a customer’s phone camera into the session (also send the QR code to the customer’s computer and end the camera)
Chat (support)	Chat with the customer in Support sessions; secret messages when the plan includes them
End support sessions (own or any)	End a Support session
Delete support sessions (own or any)	Delete an ended Support session with its recording and log

Access

Permission	Allows
View devices	See devices, presence and device details
Connect to devices	Start an unattended session on a device
Join access sessions (own or any)	Open the viewer on an existing Access session (view only) and see it in lists
Backstage	Start and join backstage (hidden desktop) sessions; apps there run as the signed-in user
Backstage as SYSTEM	Backstage apps run as SYSTEM instead of the signed-in user. A backstage session started with it can only be joined by people who also hold it. Recorded when your plan includes session recording.
Control (access)	Keyboard, mouse and type-text; also run as admin in Access sessions
Clipboard (access)	Clipboard sync
File transfer (access)	File transfer
Reboot	Reboot the device normally
Safe Mode reboot	Reboot the device into Safe Mode with Networking (also allows a normal reboot)
Terminal (access)	Open a command window on a device as SYSTEM or as a signed-in user. Recorded when your plan includes terminal history.
Blink View (access)	Create Blink View codes and accept a customer’s phone camera into the session (also end the camera)
Chat (access)	Chat with the signed-in user of a device, before and during a session; secret messages when the plan includes them
End access sessions (own or any)	End an Access session
Edit devices	Rename, edit tags, change groups, push an agent update
Remove devices	Revoke, un-revoke or unenroll a device

Watching a live Blink View camera needs only permission to join the session, and the end permissions can end the camera too. Roles with All Support permissions, All Access permissions or All permissions get Blink View (support) and Blink View (access) automatically. Custom roles that list permissions one by one do not get them until you add them.

The same goes for chat: Chat (support) and Chat (access) come with the Owner, Admin and Technician roles and with All Support permissions, All Access permissions or All permissions, but not with Viewer, and custom roles that list permissions one by one need them added. Chat also needs Chat in your plan, and secret messages Secret messages.

Recordings and logs

Permission	Allows
View recordings (own or any)	List and play recordings
Download recordings (own or any)	Download whole recording files
Delete recordings (own or any)	Delete a session’s video and audio (the session and its log stay)
View logs	Session and device logs and the timeline
Change log levels	Change the agent’s live log levels

Organization administration

These apply organization-wide only.

Permission	Allows
Enroll devices	Create and list enrollment keys, build installers
Revoke enrollment keys	Revoke enrollment keys
Create groups	Create device groups
Edit groups	Rename device groups
Delete groups	Delete device groups
Manage group access	List, add and remove group roles
Add members	Add users to the organization
Remove members	Remove users from the organization
Change member roles	Change a member’s role or suspend them
Manage org roles	Create, edit and delete organization roles
Edit organization	Rename the organization and change its settings
Delete organization	Delete the organization
Manage owners	Give or take the Owner role
View agent IP rules	See where the organization’s Access agents may connect from
Manage agent IP rules	Change the IP ranges and countries the organization’s Access agents may connect from
View activity	The organization’s activity log

Instance administration

These only go in instance roles and only apply when the role is given for all organizations.

No starter role includes View license, Diagnostic mode or Send diagnostics to IZT. Instance owners have them; anyone else needs an instance role that includes them, given for all organizations. If you upgraded from a version without it, every role that already had Instance settings was given View license too.

Permission	Allows
Create organizations	Create organizations
Delete any organization	Delete any organization
Manage users	Create and disable users; manage instance role assignments
Manage instance roles	Create, edit and delete instance roles
Instance settings	Instance-wide settings such as organization roles and the name shown to customers, the Identity tab, and the Agent builds card and instance id on the License tab
Instance activity	The instance-wide activity log
View license	The license, what the plan includes, and the seats and devices in use
Certificates	Upload HTTPS certificates and configure Let’s Encrypt for the console’s host names
View security settings	See the join-code format, rate limits, bans and the allowlist
Manage security settings	Change the join-code format and rate limits, ban and unban addresses, edit the allowlist (includes View security settings)
Diagnostic mode	Turn on, extend and turn off diagnostic mode for the whole instance
Send diagnostics to IZT	Send every organization’s logs and settings to IZT Support, see and delete what was sent, download a bundle. See Send diagnostics to IZT Support

View security settings and Manage security settings also cover seeing and changing the console’s IP and country rules.