Roles and permissions
What owners, admins, technicians, analysts and customer-portal users can do in a Revo workspace.
Updated
On this page
Every member of a workspace has one role. Change roles in Settings → Team; a user's sessions are revoked when their role changes, so the new role applies at once.
Your team
Settings → Team lists everyone in the workspace. Owners and admins invite technicians and customer-portal users by email, change roles, reset a person's two-factor authentication and deactivate people who leave. Roles of your own, built from these presets, are under Settings → Roles: see Custom fields, tags, roles and co-managed access.
Roles
| Role | Can do |
|---|---|
| Owner | Everything, including billing. The first account in a workspace is an owner |
| Admin | Everything except billing: team, policies, integrations, high-risk agent fixes, approving active scans, audit log, turning patch management on for a customer, pausing all patching, ideal-state templates, release channels for the workspace and customers |
| Technician | Add customers, run assessments, manage findings, generate and schedule reports, install and manage agents, connect customers' Microsoft 365, approve and deploy patches, edit patch policies, run low- and medium-risk agent fixes (and dry runs of any), set a customer's ideal state, use and approve AI actions |
| Analyst | Read-only across customers, plus generate and schedule reports and use the AI analyst. Can't change findings or settings |
| Customer-portal | One customer only, read-only: that customer's overview, the findings shared with them and their client reports. See Customer portal |
Actions reserved for owners and admins
Some actions are restricted further because of their impact:
| Action | Who | Extra requirement |
|---|---|---|
| Turn on patch management for a customer | Owner or admin | Two-factor authentication on; never through an API key |
| Pause all patching | Owner or admin | — |
| Move devices to another customer | Owner or admin | — |
| Uninstall the agent remotely | Owner or admin | Typed confirmation; agent 0.5.0 |
| Run a high-risk or disruptive agent fix (uninstall an application, turn on ufw, remove SMB 1.0) | Owner or admin | Two-factor authentication on the session, the exact preview, typed device count; never through an API key |
| Turn remediation or a remediation action on for a customer | Owner or admin | Two-factor authentication on the session; never through an API key |
| Make someone an owner or admin | Owner or admin | Two-factor authentication on the session; the other owners and admins get an email |
| Disable, enable or remove a device | Owner or admin | — |
| Allow Windows upgrades on unsupported hardware, or override safeguard holds on test devices | Owner or admin | — |
| Approve active scans and network discovery | Owner or admin | Verified domain or authorized scope, and an attestation |
| Set up the workspace's Microsoft 365 and GitHub apps | Owner or admin | — |
| Delete a customer permanently | Owner or admin | Typed name |
| Change the plan | Owner | — |
| Reset another owner's MFA | Owner | — |
API keys
An API key has a role of its own (analyst, technician or admin) and expires. Use the least-privileged role that works. See API keys.
The AI analyst and permissions
The AI analyst acts with your permissions, never more. Any change it suggests becomes an approval request, and when someone approves it, it runs with the approver's permissions. See AI approvals.
Customer-portal users
Portal users are pinned to their one customer by the API, not just hidden menus. They never see other customers, your MSP settings, team, billing, devices, patching, identity, integrations, internal action plans or findings you've hidden from them. Manage or deactivate them in Settings → Team.