Groups & Permissions Reference

Reference of octoja's group access model — permissions, customer and device access, and device actions, with example group setups.

Written By Erdinc Akay

Last updated 17 days ago

How access works

octoja uses a group-based access model. Each user belongs to one or more groups, and each group grants a set of permissions plus a customer-access and a device-access scope. A user's effective access is the union across all of their groups.

There are no fixed built-in roles. You build your own access model by creating groups with exactly the permissions and scope your team needs.

Where to find this screen

Groups are managed under Administration → Groups. The group editor has three tabs. The General tab holds the group's Info, its Permissions, and its Members; the Customer Access and Device Access tabs hold the two access scopes described below. You need the Group Management permission to open this area; without it the Groups entry is not accessible.

Permissions

Permissions decide which features a group grants. The table quotes the name and description as octoja displays them.

Permission	Description
User Management	Permission to create, edit, and delete user accounts.
Group Management	Permission to create, edit, and delete groups.
Customer Management	Permission to create, edit, and delete customers.
Monitoring Check Management	Permission to manage monitoring check configurations and assignments.
Custom Check Management	Permission to manage the custom check catalog (instance-wide).
Check Repository Management	Permission to manage check repositories (instance-wide check sources).
Alert Management	Permission to manage alert configurations on monitoring checks.
Software Deployment Management	Permission to manage software deployment configurations and assignments.
Custom Package Management	Permission to create, upload, and publish custom software packages.
Manage automations	Create, edit, run and delete automation workflows.
Agent Management	Permission to manage agent enrollment settings and enrollment tokens.
Case Management	Permission to create, update, and close cases.
View Cases	Permission to view cases.
Reports	Manage report templates.
View Reports	Permission to view and generate reports.
Integration Management	Permission to configure and manage third-party integrations such as Lywand, webhooks, and Teams.
Branding Management	Permission to customize instance branding colors.
Tag Rules	Permission to manage tag rules that automatically apply tags to devices.
Create Custom Tags	Permission to create new custom tags. Users without this permission can only apply existing tags.
View Patch Management	Permission to view patch policies, cycles, and results.
Patch Policy Management	Permission to create and edit patch policies.
Approve Patch Cycles	Permission to approve, reject, and finalize patch cycles.
Emergency Patch Cycles	Permission to create emergency patch cycles that bypass ring ordering.

Users whose groups grant none of these permissions can still sign in and view areas that require only a valid session, such as their own profile.

Customer access

Customer access decides which customers a group's members can reach. A group uses one of:

Mode	Meaning
Access all customers	Members can access every customer in the organization.
Specific customers	Access is limited to an explicitly selected list of customers.
Customer tag rules	Access is granted to every customer whose tags match the rules, so matching customers are included automatically as they are added.

A specific list and tag rules can be combined in the same group.

Device access

Device access refines what members reach within their accessible customers; a group with no customer access reaches no devices. It has two parts — which devices, and which actions.

Reach all devices — every device of the accessible customers.
Device rules — only devices that match the rules you define.

Allowed actions are the device actions members may perform on devices they can reach. A group that can reach devices but has no allowed actions gives read-only device access.

Action	What it allows
Service Control	Start, stop, and restart Windows services.
Process Control	View and terminate running processes.
Remote Desktop	Start an interactive remote desktop session.
Terminal	Open a remote terminal or shell.
Registry	Browse and edit the Windows registry.
File Browser	Browse, download, and upload files on the device.
Software Management	Install, update, and remove software.
Event Log	View the device event logs.
Run Script	Execute scripts on the device.
Run Maintenance	Trigger maintenance tasks on the device.
Edit Device	Edit device name, alias, and tags.
Delete Device	Remove the device from the organization.
Send Notification	Show a message on the signed-in user's screen.
Bypass Remote-Desktop Consent	Connect even when the user declines consent on a consent-required device.

The Administrator group option

The group editor offers an Administrator group toggle. Its on-screen description reads: "New permissions introduced in future updates are granted to administrator groups automatically." Enable it on your full-access group so it never falls behind when a future octoja update adds new permissions.

Typical group configurations

The following are examples only — you can combine any permissions and scope.

Administrator — all permissions, access to all customers and devices with all actions, and the Administrator group toggle enabled
Technician — Monitoring Check Management, Alert Management, Case Management, Software Deployment Management, Patch Policy Management, and Approve Patch Cycles, with access to all customers and devices and the operational actions (Remote Desktop, Terminal, File Browser, Software Management)
Help Desk (one customer) — Case Management, with Customer Access set to a single customer and Device Access limited to that customer's workstations, read-only (no allowed actions)
Read-only auditor — View Cases and View Patch Management, no allowed device actions

Access Overview

The Access Overview page (a separate area, not part of the group editor) answers "who can reach what, and why". It offers three views — By user, By customer, and By device — and for each combination shows the customers and devices in reach, an Allowed actions column (an All badge when every action is granted), and the reason a member has that access: which group grants it, and whether the grant is customer-global, device-global, an explicit assignment, or a tag-rule match. Use it to confirm that a group's Customer Access and Device Access add up to the effective access you intended.

For step-by-step instructions, see Create a Group and Assign Permissions.