Manage users and roles in your IoT Central application

This article describes how you can add, edit, and delete users in your Azure IoT Central application. The article also describes how to manage roles in your application.

To access and use the Administration section, you must be in the App Administrator role for an Azure IoT Central application or in a custom role that includes administration permissions. If you create an Azure IoT Central application, you're automatically added to the App Administrator role for that application.

Add users

Every user must have a user account before they can sign in and access an application. IoT Central currently supports Microsoft accounts and Azure Active Directory accounts, but not Azure Active Directory groups.

For more information, see Microsoft account help and Quickstart: Add new users to Azure Active Directory.

1. To add a user to an IoT Central application, go to the Users page in the Administration section.

   

2. To add a user, on the Users page, choose + Assign user.

3. If your application uses organizations, choose an organization to assign to the user from the Organization drop-down menu.

4. Choose a role for the user from the Role drop-down menu. Learn more about roles in the Manage roles section of this article.

   

   The available roles depend on the organization the user is associated with. You can assign App roles to users associated with the root organization, and Org roles to users associated with any other organization in the hierarchy.

   Note

   A user who is in a custom role that grants them the permission to add other users, can only add users to a role with same or fewer permissions than their own role.

   When you invite a new user, you need to share the application URL with them and ask them to sign in. After the user has signed in for the first time, the application appears on the user's My apps page.

   Note

   If a user is deleted from Azure Active Directory and then added back, they won't be able to sign into the IoT Central application. To re-enable access, the application's administrator should delete and re-add the user in the application as well.

Edit the roles and organizations that are assigned to users

Roles and organizations can't be changed after they're assigned. To change the role or organization that's assigned to a user, delete the user, and then add the user again with a different role or organization.

Delete users

To delete users, select one or more check boxes on the Users page. Then select Delete.

Manage roles

Roles enable you to control who within your organization is allowed to do various tasks in IoT Central. There are three built-in roles you can assign to users of your application. You can also create custom roles if you require finer-grained control.

App Administrator

Users in the App Administrator role can manage and control every part of the application, including billing.

The user who creates an application is automatically assigned to the App Administrator role. There must always be at least one user in the App Administrator role.

App Builder

Users in the App Builder role can manage every part of the app, but can't make changes on the Administration or Continuous Data Export tabs.

App Operator

Users in the App Operator role can monitor device health and status. They aren't allowed to make changes to device templates or to administer the application. Operators can add and delete devices, manage device sets, and run analytics and jobs.

Org Administrator

IoT Central adds this role automatically when you add an organization to your application. This role restricts organization administrators from accessing some application-wide capabilities such as billing, branding, colors, API tokens, and enrollment group information.

Users in the Org Administrator role can invite users to the application, create sub-organizations within their organization hierarchy, and manage the devices within their organization.

Org Operator

IoT Central adds this role automatically when you add an organization to your application. This role restricts organization operators from accessing some application-wide capabilities.

Users in the Org Operator role can complete tasks such as adding devices, running commands, viewing device data, creating dashboards, and creating device groups.

Org Viewer

IoT Central adds this role automatically when you add an organization to your application.

Users in the Org Viewer role can view items such as devices and their data, organization dashboards, device groups, and device templates.

Create a custom role

If your solution requires finer-grained access controls, you can create roles with custom sets of permissions. To create a custom role, navigate to the Roles page in the Administration section of your application, and choose one of these options:

• Select + New, add a name and description for your role, and select Application or Organization as the role type. This option lets you create a role definition from scratch.
• Navigate to an existing role and select Copy. This option lets you start with an existing role definition that you can customize.

When you invite a user to your application, if you associate the user with:

• The root organization, then only Application roles are available.
• Any other organization, then only Organization roles are available.

You can add users to your custom role in the same way that you add users to a built-in role

Custom role options

When you define a custom role, you choose the set of permissions that a user is granted if they're a member of the role. Some permissions are dependent on others. For example, if you add the Update personal dashboards permission to a role, the View personal dashboards permission is added automatically. The following tables summarize the available permissions, and their dependencies, you can use when creating custom roles.

Managing devices

Device template permissions

Device instance permissions

Device groups permissions

Device connectivity management permissions

Jobs permissions

Rules permissions

Managing the app

Application settings permissions

Application template export permissions

Device file upload permissions

Billing permissions

Managing users and roles

Custom roles permissions

User management permissions

Organization management permissions

Customizing the app

Application dashboard permissions

Personal dashboards permissions

Branding, favicon, and colors permissions

Help links permissions

Extending the app

Data export permissions

API token permissions

Next steps

Now that you've learned how to manage users and roles in your IoT Central application, the suggested next step is to learn how to Customize application UI.