User Permissions

After an administrator gets invited and their account has been created, you can set specific permissions for them. By default, the new administrator will not have any permissions assigned. To edit these privileges, navigate to the Administrators page.  

Note: This article contains directions for both the ThreatLocker Portal and the ThreatLocker Legacy Portal. If you are using the Legacy Portal, you can find the appropriate directions by scrolling down in the article. 

Editing User Permissions in the ThreatLocker Portal

On the Administrators page, select the name of the administrator you want to change the permissions on. 

In the 'Update Administrator' side panel, navigate to the 'Roles/Permissions' section. In the 'Individual Permissions' dropdown, you can select as many or as few permissions as needed.

Definitions of Individual Permissions

Approval Permissions

If you would like your administrator to be able to approve using a maintenance mode, combine the 'Approval' permission with the corresponding 'Manage Maintenance Mode' permission (i.e., combine 'Approve for Entire Organization' with 'Manage Application Control Installation Mode' to allow the administrator to process approvals for the entire organization using Installation mode).

• Approve for Entire Organization - This provides the ability to view the Approval Center page, approve application and storage requests at the Entire Organization Level, or the Group Level, or for a Single Computer. 
• Approve for Group - This permission provides the ability to view the Approval Center page, approve applications and storage requests for Computer Groups or a Single Computer.
• Approve for Single Computer - This permission provides the ability to view the Approval Center page and approve application and storage requests for a single  endpoint at a time
• Elevation Administrator - This provides the ability to approve Elevation requests. It must be combined with one of the other Approval permissions to gain access to the Approval Center page
• View Approvals - This provides the ability to view the Approvals Center page, but not the ability to open the requests
• Approve for Single Computer (Application Only)- This provides the ability to view the Approval Center page, approve application requests for a single endpoint at a time. This does not grant the ability to approve storage requests.

Administrator Permissions

• Assign Roles - This provides the ability to assign roles to administrators giving them specific permissions
• Change Permission - This provides the ability to edit permissions for a user. This must be combined with either the 'Edit Administrators' permission or the 'View Adminstrators' permission, which gives the user access to the Administrators page
• Edit Administrators - This permission provides the ability to view the Administrators page, add a new administrator, invite a new administrator, delete an administrator, reset passwords, and edit the information of listed administrators, minus the ability to change a user's permissions 
• Role Administrator - This provides the ability to add permissions and make changes to administrator roles
• View Administrators - This permission gives the administrator the ability to view the Administrators page
• Manage Local Admin Settings - This permission allows the administrator to manage the local Windows and MacOS administrators on all endpoints with ThreatLocker installed.

Application Control Permission

• Allow Application Merge - This permission provides the ability to merge application definitions, but it does not provide viewing access to the Application Control > Applications page. You will also need to add the ability to Edit Application Control Applications.  
• Edit Application Control Applications - This provides the ability to view the Application Control > Applications page, edit applications, create new applications and delete applications
• Edit Application Control Policies - This permission gives the administrator full control of the Application Control > Policies page including creating new application policies, editing policies, deleting policies, and moving policies 
• Manage Tags - This permission gives the ability to edit and create new tags, as well as to add items to those tags

Billing Permissions

• Edit Billing - This gives the user the ability to view the Billing page and make changes to the information displayed on the Billing page
• View Billing - This gives the administrator the ability only to view the Billing page   

Computer Permissions

• Edit Computer Groups - This provides the ability to edit listed computer groups on the Computer Groups page. Changes include creating a new computer group, editing the title of a group, deleting a group, updating the ThreatLocker Version, and changing the Update Channel 
• Edit Computers - This permission allows the administrator to access the QR Scanner on the Mobile App and everything on the Computers page except the 'Maintenance Mode' button. 
• View Override Codes - This permission is needed to be able to view the Override Codes report (unless the administrator has Super Admin permissions)
• View Computers -  This permission will provide view-only access to the Computers page. This does not provide access to the Install Computers button
• Install Computers - This permission will provide access to the Install Computers button and view-only access to the Computers page

General Permissions

• Edit Integrations - This permission gives the administrator the ability to view the Integrations page, create, edit and delete integrations 
• Super Admin - This provides the administrator full control of all listed user permissions for the parent account, including child organizations, and provides access to the System Audit page 
• Super Admin-Child - This permission grants the administrator full control of all listed user permissions only on child organizations, not on the Organization this user is set on. This does not provide access to the System Audit page. For example, if Company A manages Company B and Company C, a super admin-child set on Company A will not have permissions on Company A, but will have full permissions on Company B and Company C.
• Super Admin - Parent Only - This permission grants the administrator full control of all listed user permissions only on the Parent organization. This admin will have no permissions on child organizations
• View Reports — This provides access to the Reports page, where the administrator can generate and view reports  
• View System Audit - This provides access to the System Audit page.
• View Unified Audit — This provides the administrator with the ability to view and search the Unified Audit page and view the file history for audit entries, but it does not provide permission to add to applications, permit vendors, or permit or deny applications   

Network Control Permissions

• Edit NC Authorization Hosts - This provides the ability to edit, add, or delete authorization hosts and create their passwords
• Edit Network Control Policies - This provides the ability to edit, add, or delete Network Control policies 

Organization Permissions

• Edit Organizations - This permission grants the administrator the ability to view the Organizations page, delete an empty organization, the ability to use the 'Deploy Policies' button located at the top of the page, and edit the General, Billing, Exclusions, Tray, and Branding settings for the organization
• View Organizations - This provides the ability to view the Organizations page, the ability to delete an empty organization, and the ability to use the 'Deploy Policies' button located at the top of the Organizations page 

Storage Control Permissions

• Edit Storage Control Policies - This allows you to edit, add, or delete Storage Control policies
• Edit Storage Control Storage Devices - This allows you to edit, add, or delete Storage Devices

Configuration Manager Permissions

• Edit Configuration Manager Policies - This provides the ability to add,edit, or delete Configuration Manager policies  
• View Configuration Manager - This provides the ability to view Configuration Manager policies  

ThreatLocker Ops Permissions

• Edit ThreatLocker Ops - This allows you to edit, add, or delete ThreatLocker Ops policies
• View ThreatLocker Ops - This allows you to view ThreatLocker Ops policies

Maintenance Mode Permissions

• Manage All Maintenance Modes - can enable/disable ALL maintenance modes via the Computers page
• Manage Application Control Installation Mode - Can enable/disable Application Control Installation mode via  the Computers page
• Manage Application Control Learning Mode - Can enable/disable Application Control Learning mode via Computers page
• Manage Application Control Monitor Only - can enable/disable Application Control Monitor Only mode via Computers page
• Manage Network Control Monitor Only - can enable/disable Network Control monitor only mode via Computers page
• Manage Storage Control Monitor Only - can enable/disable Storage Control monitor only mode via Computers page
• Manage Tamper Protection - can enable/disable Tamper Protection via the Computers page

Creating Custom User Roles

Administrators can create custom user roles based on their organization's specific needs. Once created, these user roles can be applied to specific administrators. These roles are organization-specific and must be created at the organization level where they will be applied.   

Navigate to the Administrators page and switch to the Roles tab. 

Select '+ New Role'.

Insert a name for the user role in the 'Role Name' textbox.

If desired, input a description for the user role in the 'Description' textbox.

Expand the 'Role Permissions' dropdown menu and select the checkbox next to the permissions you wish to include in this custom user role. 

Once you have made all the selections needed for this user role, select '+ Create Role'.

The role will now appear in the list on the main page. If you need to make changes to this role, clicking the 'Edit' button will open the 'Update Role' panel.   

Roles can be deleted by selecting the delete icon to the right role name.  

Applying Custom User Roles

 Once created, custom user roles can be applied to administrators in the same way as applying specific permissions.

On the Administrators page, select the name of the administrator you want to change the permissions on.  

In the 'Update Administrator' side panel, navigate to the 'Roles/Permissions' section. 

Expand the 'Role' dropdown menu to select the desired role.

Optionally, you can select the organization to apply this custom role to. This is beneficial for organizations with child organizaions, allowing the administrator to have different permissions for different organizations.

Select the '+' icon to add the role.

Select 'Update Admin' to save your changes.

Permissions being Deprecated 8/28/2024

Please Note: All deprecated permissions that are currently applied will continue to work as expected.

• Approve for Entire Organization (Learning Mode Only) - can process application or storage approval requests for entire org, a group, or a single computer, and when combined with edit computer, ONLY use Learning Mode
• Approve for Entire Organization (Installation Mode Only) - can process application or storage approval requests for entire org, a group, or a single computer, and when combined with edit computer, ONLY use Installation Mode
• Approve for Group (Learning Mode Only) - can process application or storage approval requests for a group or a single computer, and when combined with edit computer, use ONLY learning mode
• Approve for Group (Installation Mode Only) - can process application or storage approval requests for a group or a single computer, and when combined with edit computer, use ONLY installation mode
• Approve for Single Computer (Learning Mode Only) - can process application or storage approval requests for a single computer, and when combined with edit computer, ONLY use learning mode
• Approve for Single Computer (Installation Mode Only) - can process application or storage approval requests for a single computer, and when combined with edit computer, ONLY use installation mode
• Approve for Single Computer (Application and Learning Mode Only) - can process application approval requests for a single computer, and when combined with edit computer, ONLY use learning mode
• Approve for Single Computer (Application and Installation Mode Only) - can process application approval requests for a single computer, and when combined with edit computer, ONLY use installation mode