Skip to main content

Roles & Permissions

The Roles & Permissions tab manages the role-permission matrix that gates every action in Beak ELM. Each role carries a per-module permission set — one column per role, one checklist per module — and the Create Role button adds custom roles alongside the built-in tenant roles.

Roles​

  • Tenant Admin — Full access to every permission across the tenant (e.g. 112/112 permissions granted)
  • Tenant Viewer — Read-only access — view permissions across modules without create / edit / delete
  • Custom roles — Created via Create Role with a hand-picked permission set, e.g. a per-customer role in an MSP deployment

Each role card shows its granted-permission count against the total (e.g. 112/112), and built-in roles carry a System chip. Users are bound to a role — and to the companies they can access — in User Management.

Permission Groups​

Permissions are grouped by module, mirroring the sidebar. Each group exposes granular view / create / edit / delete / import-style actions:

ModuleExample permissions
DashboardView dashboard
LicensesView, create, edit, delete, import licenses
Software ProductsView catalog, create / edit / delete products, import software inventory
DevicesView devices, import device details, delete devices
ContractsView, create, edit, delete, import contracts
Usage AnalyticsView License Usage / Endpoint Software / Microsoft 365 / Smartsheet tabs
ComplianceView compliance, recalculate compliance, resolve compliance alerts
OptimizationView each optimization sub-menu separately, run optimization, apply recommendations
Cost ManagementView cost data, create / edit / delete cost records, generate forecasts
AlertsView alerts, manage alert rules, run alert check, resolve alerts
ReportsPer-report view permissions — each report on the Reports chooser is gated individually — plus generate reports
Global SettingsPer-settings-tab administration permissions

Best Practices​

  • Leave Tenant Admin and Tenant Viewer intact and create custom roles for anything in between — a modified built-in role is hard to reason about at upgrade time.
  • Use Tenant Viewer for finance and procurement teams who need to query but not change data — they get read access to every dashboard without edit rights.
  • Scope custom roles per module rather than per person — e.g. a Contracts Manager role with contract permissions only — and combine with per-company access in User Management.
  • Audit role assignments quarterly via the Users page — privilege creep is the most common RBAC issue.
  • Review custom roles after an upgrade that adds modules — new menu permissions are backfilled to custom roles, so confirm the result still matches your intent.