Roles define what a console user is allowed to see and do. Each role is a named bundle of permissions, and you assign one or more roles to a person on the Console Users page. This area lets you review the standard built-in roles, create your own custom roles, and optionally limit a role’s reach to specific resources.
What this guide covers
Before you begin: Open the console and go to Admin › Roles. You will see the list of roles available in your tenant, including the standard built-in roles and any custom roles your team has created. You need administrator access to view and manage roles.
The Roles page, reached from the Admin menu in the top navigation.
Reviewing the roles list
The table lists every role in your tenant. Built-in roles (CF_ADMIN, CM_ADMIN and CM_TEACHER) are provided by default and cannot be changed, while custom roles are ones your team has created. The Permissions column shows a short preview of what each role grants, with a “+ N more” indicator when there are additional permissions.
Each row shows a role’s name, type, whether it is resource scoped, a permissions preview, and its available actions.
Column | Description |
Name | The role name. For built-in roles this is a fixed identifier such as CF_ADMIN; for custom roles it is the name you chose. |
Type | Built-in (a standard role that cannot be edited) or Custom (a role created in your tenant). |
Resource Scoped | Yes if the role is limited to specific resources (such as particular domains), otherwise No. |
Permissions | A preview of the permissions the role grants, with a “+ N more” count when there are additional ones. |
Actions | Built-in roles show a view (eye) control only. Custom roles show edit (pencil) and delete (trash) controls. |
Viewing a built-in role
Select the view (eye) control on a built-in role to open the Role Details window. A message at the top confirms this is a built-in role and cannot be modified. The window shows the role’s name and its full permission set, with nested sub-permissions (for example, Mark Device Lost or Stolen and Toggle Device Tracking sit under View Devices). This is a read-only view, so it is a useful way to understand exactly what a standard role grants before assigning it.
The Role Details window: a read-only name, the full permission checklist, and a resource-restriction toggle.
Creating a custom role
Select New Role in the top right to open the New Role window. Enter a Name, then select the permissions you want the role to grant from the Permissions checklist. Sub-permissions stay greyed out until their parent permission is selected, so choose the higher-level permission first to unlock the more specific options beneath it. When you are finished, select Save.
The New Role window with a name field and the permissions checklist.
Restricting a role to specific resources
By default a role applies everywhere. To limit it, turn on Restrict to specific resources. A Domain Scopes section appears where you can use Add Domain to choose which domains the role applies to. A role configured this way shows Resource Scoped: Yes in the list.
Turning on the restriction reveals the Domain Scopes picker for choosing which domains the role covers.
Note: When a user holds more than one role, permissions and resource scopes are combined across all of their roles, and broader scopes — including roles with no resource restrictions — take precedence.
Related guides
Overview – Console Users
Overview – Console User Activity
Overview – Directory Accounts
Overview – Directory Groups