7.7 Device Rights

The Device Rights dialog box lets you control the operations that the selected administrator can perform on devices. For more information on quick task rights, see Quick Task Rights.

7.7.1 Contexts

Specify the Device folders (contexts) that you want the administrator’s Device rights to apply to. To select a folder, click Add to display the Contexts dialog box, browse for and select the folder (or multiple folders), then click OK. The rights also apply to the folder’s subfolders.

7.7.2 Privileges

The Privileges section lets you grant the selected administrator rights to work with devices, including device groups and folders listed in the Contexts section.

The following rights are available:

RIGHT	OPERATIONS CONTROLLED BY THE RIGHT	NOTES
View Leaf	View the contents in the specified context (folder and subfolders)	Setting the View Leaf right to Deny forces all other Device rights to Deny. The View Leaf right must be set to Allow to perform any other device operations.
Modify	Retire a device Rename a device Acknowledge device messages Change a device to a test device Change a test device to a non-test device Copy device settings (from the Settings tab) to other devices View and edit a device’s detailed inventory (Detailed Software Hardware Inventory link on the Inventory tab)	To copy device settings, the administrator also needs the Modify Settings right.
Create/Delete	Create managed devices by importing device information from a CSV file Create managed devices by manually adding device information Delete a device Move a device
Modify Folders	Rename a device folder Change a device folder’s description
Create/Delete Folders	Create a device folder Delete a device folder Move a device folder	Setting the Create/Delete Folders right to Allow forces the Modify Folders right to Allow. This means that an administrator who creates a folder also receives rights to modify it.
Modify Groups	Rename a device group Change a device group’s description	To change a device group’s description, an administrator needs this right and the Modify right.
Create/Delete Groups	Create a device group Delete a device group Move a device group	Setting the Create/Delete Groups right to Allow forces the Modify Groups right to Allow. This means that an administrator who creates a group also receives rights to modify it.
Modify Group Membership	Add devices to a device group Remove devices from a device group Change criteria for a dynamic device group
Modify Dynamic Group	Modify dynamic group
Modify Settings	Edit settings on a device’s Settings tab	This right applies to devices and device folders. It does not apply to device groups because device groups do not have a Settings tab.
View Audit Log	View a devices’ Audit tab and the events logged to that tab View a device group’s Audit tab and the events logged to that tab View a device folder’s Audit tab and the events logged to that tab	This right does not allow the administrator to view event details. To view event details, the administrator must have the View Audit Event right.
View Audit Events	View a device’s Audit tab, the events logged to that tab, and the details for the events View a device group’s Audit tab, the events logged to that tab, and the details for the events View a device folder’s Audit tab, the events logged to that tab, and the details for the events	Setting the View Audit Events right to Allow forces the View Audit Log right to Allow.
Configure Audit Settings	Configure which events to audit for a bundle (bundle object > Settings tab > Audit Management > Events Configuration) Configure which events to audit for a bundle group (bundle group object > Settings tab > Audit Management > Events Configuration) Configure which events to audit for a bundle folder (bundle folder object > Settings tab > Audit Management > Events Configuration)
Assign Bundles	Assign bundles to devices, device groups, and device folders Assign bundle groups to devices, device groups, and device folders Remove bundle assignments from the objects listed above Remove bundle group assignments from the objects listed above	To assign bundles to devices, groups, and folders, an administrator needs this right and the Bundle Rights – Assign Bundles right. In other words, the administrator needs Assign Bundle rights for the bundle and the device to which the bundle is being assigned.
View Detailed Inventory	View a devices detailed inventory (Detailed Software/Hardware Inventory link on Inventory tab)	This right controls view-only access. If you want an administrator to be able to edit the detailed inventory, the administrator needs the Modify right.
Assign Policies	Assign policies to devices, device groups, and device folders Assign policy groups to devices, device groups, and device folders Remove policy assignments from the objects listed above Remove policy group assignments from the objects listed above	To assign policies to devices, groups, and folders, an administrator needs the following rights: Assign Policies (this right) Policy Rights - Assign Policies Policy Rights - Manage Configuration Policies or Policy Rights - Manage Security Policies In other words, an administrator needs Assign Policy rights for the policy and the device to which the policy is being assigned, and he needs the Manage Configuration Policies or Manage Security Policies right depending on whether the policy is a Configuration or Security policy.
Geolocation	Locate an iOS or Android device
View Activation Lock Bypass Code	View Activation Lock Bypass Code
Assign Locations	Assign locations and network environments to devices and device folders Assign startup locations and network environments to devices and device folders	This right does not apply to device groups because device groups do not have a Locations tab.
Manage ERI	Download a device’s ERI file View an ERI file’s password Delete an ERI file