Skip Navigation

Permissions for preconfigured administrator roles

BlackBerry UEM
includes four preconfigured roles for administrators. The Security Administrator role has full permissions, including creating and managing roles and administrators. You cannot edit or delete this role. At least one administrator must be assigned the Security Administrator role. The Enterprise Administrator role (all permissions except for creating and managing roles and administrators), the Senior HelpDesk role (permissions to perform intermediate administrative tasks), and the Junior HelpDesk role (permissions to perform basic administrative tasks) can be edited or deleted. The following tables list the permissions that are turned on by default for each preconfigured role.
Some permissions are supported only in custom roles.

Roles and administrators

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View roles
NA
NA
NA
Create and edit roles
NA
NA
NA
Delete roles
NA
NA
NA
Rank roles
NA
NA
NA
Create administrators
NA
NA
NA
Delete administrators
NA
NA
NA
Edit non-administrative attributes of administrators
NA
NA
NA
Change password for other administrators
NA
NA
NA
Change role membership for administrators
NA
NA
NA

Directory access

You can specify the company directories that the administrator can search.
Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
All company directories
Selected company directories only

Group management

You can specify the groups that the administrator can manage. To manage users that do not belong to a group, administrators must have permission to manage all groups and users.
Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
All groups and users
Selected groups

Users and devices

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View users and activated devices
Create users
Edit users
Assign user roles
Delete users
Export user list
Generate an activation password and send email
Generate activation passwords and send activation email messages to multiple users
Specify an activation password
Specify multiple activation passwords with unique activation profiles for a user
Specify whether activation passwords expire after first device is activated
View user activation QR codes and access keys
Specify account password
Change multiple account passwords
Set
BlackBerry 2FA
preauthentication
Manage devices
Enable work space
Disable work space
Lock work space
Reset work space password
Specify device password
Lock device and set message
Unlock device and clear password
Delete only work data
Delete only work data from multiple devices
Delete all device data
Delete all device data from multiple devices
Delete device
Delete multiple devices
Specify work password and lock
Get device logs
Enable Activation Lock
Disable Activation Lock
Lost Mode
Turn on Lost Mode
Turn off Lost Mode
Locate device
Check in device
Restart device
Update
iOS
software
Update
iOS
software on multiple devices
Turn off device
View device location details
View device location history
View Exchange gatekeeping information
View
Apple
DEP device information
Assign enrollment configurations
View One-time Password tokens
Assign One-time Password tokens
Send email to users
View Activation Lock bypass history
Manage
BlackBerry Dynamics
apps
Lock app
Unlock app
Delete app data
Control logging for app
Manage
Intune
apps

Dedicated device

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View shared device group settings
Create and edit shared device groups
Delete shared device groups
View public device group settings
Create and edit public device groups
Delete public device groups

Groups

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View group settings
Create and edit user groups
Assign user roles
Add and remove users from user groups
Delete user groups
Create and edit device groups
Delete device groups

Policies and profiles

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View IT policies
Create and edit IT policies
Delete IT policies
View email profiles
Create and edit email profiles
Delete email profiles
View IMAP/POP3 email profiles
Create and edit IMAP/POP3 email profiles
Delete IMAP/POP3 email profiles
View enterprise connectivity profiles
Create and edit enterprise connectivity profiles
Delete enterprise connectivity profiles
View device SR requirements profiles
Create and edit device SR requirements profiles
Delete device SR requirements profiles
View activation profiles
Create and edit activation profiles
Delete activation profiles
View
Wi-Fi
profiles
Create and edit
Wi-Fi
profiles
Delete
Wi-Fi
profiles
View VPN profiles
Create and edit VPN profiles
Delete VPN profiles
View compliance profiles
Create and edit compliance profiles
Delete compliance profiles
View device profiles
Create and edit device profiles
Delete device profiles
View proxy profiles
Create and edit proxy profiles
Delete proxy profiles
View web content filter profiles
Create and edit web content filter profiles
Delete web content filter profiles
View
FileVault
profiles
Create and edit
FileVault
profiles
Delete
FileVault
profiles
View location service profiles
Create and edit location service profiles
Delete location service profiles
View app lock mode profiles
Create and edit app lock mode profiles
Delete app lock mode profiles
View single sign-on profiles
Create and edit single sign-on profiles
Delete single sign-on profiles
View CA certificate profiles
Create and edit CA certificate profiles
Delete CA certificate profiles
View shared certificate profiles
Create and edit shared certificate profiles
Delete shared certificate profiles
View SCEP profiles
Create and edit SCEP profiles
Delete SCEP profiles
View OCSP profiles
Create and edit OCSP profiles
Delete OCSP profiles
View certificate retrieval profiles
Create and edit certificate retrieval profiles
Delete certificate retrieval profiles
View CRL profiles
Create and edit CRL profiles
Delete CRL profiles
View managed domains profiles
Create and edit managed domains profiles
Delete managed domains profiles
View user credential profiles
Create and edit user credential profiles
Delete user credential profiles
View custom payload profiles
Create and edit custom payload profiles
Delete custom payload profiles
Assign IT policies and profiles to users
Assign IT policies and profiles to user groups
Assign IT policies and profiles to device groups
Assign IT policies and profiles to shared device groups
Assign IT policies and profiles to public device groups
Rank IT policies and profiles
View CardDAV profiles
Create and edit CardDAV profiles
Delete CardDAV profiles
View CalDAV profiles
Create and edit CalDAV profiles
Delete CalDAV profiles
View
AirPrint
profiles
Create and edit
AirPrint
profiles
Delete
AirPrint
profiles
View network usage profiles
Create and edit network usage profiles
Delete network usage profiles
View
AirPlay
profiles
Create and edit
AirPlay
profiles
Delete
AirPlay
profiles
View
Enterprise Management Agent
profiles
Create and edit
Enterprise Management Agent
profiles
Delete
Enterprise Management Agent
profiles
View
BlackBerry Dynamics
compliance profiles
Delete
BlackBerry Dynamics
compliance profiles
View
BlackBerry Dynamics
profiles
Create and edit
BlackBerry Dynamics
profiles
Delete
BlackBerry Dynamics
profiles
View
BlackBerry Dynamics
connectivity profiles
Create and edit
BlackBerry Dynamics
connectivity profiles
Delete
BlackBerry Dynamics
connectivity profiles
View do not disturb profiles
Create and edit do not disturb profiles
Delete do not disturb profiles
View
BlackBerry 2FA
profiles
Create and edit
BlackBerry 2FA
profiles
Delete
BlackBerry 2FA
profiles
View
Windows
Information Protection profiles
Create and edit
Windows
Information Protection profiles
Delete
Windows
Information Protection profiles
View per-app notification profiles
Create and edit per-app notification profiles
Delete per-app notification profiles
View gatekeeping profiles
Create and edit gatekeeping profiles
Delete gatekeeping profiles
View
Microsoft Intune
app protection profiles
Create and edit
Microsoft Intune
app protection profiles
Delete
Microsoft Intune
app protection profiles
View home screen layout profiles
Create and edit home screen layout profiles
Delete home screen layout profiles
View
Enterprise Identity
authentication policy
Create and edit
Enterprise Identity
authentication policy
Delete
Enterprise Identity
authentication policy
Assign
Enterprise Identity
authentication policy to users and groups

Apps

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View apps and app groups
Create and edit apps and app groups
Delete apps and app groups
Export app data
Assign apps and app groups to users
Assign apps and app groups to user groups
Assign apps and app groups to device groups
Assign apps and app groups to shared device groups
Assign apps and app groups to public device groups
Edit app rating and review settings
Delete app ratings and reviews
View app installation ranking
Edit app installation ranking
View app licenses
Create app licenses
Edit app licenses
Delete app licenses
Assign app licenses to apps or app groups

Restricted apps

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View restricted apps
Create restricted apps
Delete restricted apps

Personal apps

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View personal apps

Settings

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View general settings
Edit activation defaults
Create and edit email templates
Delete email templates
Edit console settings
Edit language for automated emails
Edit self-service console settings
Create work space backup and restore settings
1
Delete work space backup and restore settings
1
Edit default variables
1
Edit login notices
1
Edit custom variables
Edit organization notices
Edit email domains
Edit location service settings
Edit customize console settings
Edit delete command expiration settings
Edit attestation settings
Edit certificate settings
Create and edit event notifications
Delete event notifications
Edit device support messages
Edit certificate-based authentication settings
1
Edit public web service access settings
View app management
Edit
BlackBerry World
for Work
Edit internal app storage
1
Edit
Work Apps
for
iOS
Edit
Windows 10
apps
Edit default app rating and review settings
View external integration settings
Edit
Apple
Push Notification settings
Edit SMTP server settings
1
Edit
Apple
DEP settings
Edit
BlackBerry 2FA
server settings
Edit
BlackBerry Connectivity Node
settings
2
View One-Time Password tokens
Create and edit One-Time Password tokens
Edit company directory settings
Edit
Microsoft Intune
settings
Edit
Microsoft Exchange
gatekeeping settings
Edit
Android
work profile settings
Edit certification authority settings
Edit
Samsung Knox
bulk enrollment settings
View trusted certificates
Add trusted certificates
Delete trusted certificates
View
BlackBerry Connectivity Node
servers
Create and edit
BlackBerry Connectivity Node
servers
Delete
BlackBerry Connectivity Node
servers
View
BlackBerry Secure Gateway
settings
Edit
BlackBerry Secure Gateway
settings
View administrator users and roles
View licensing summary
Edit licensing settings
View migration settings
Edit migration settings
View infrastructure settings
Edit logging settings
1
Edit server-side proxy settings
1
View servers
1
Edit servers
1
Delete servers
1
Manage servers
1
View audit settings
1
Edit audit settings and purge data
1
View
BlackBerry Secure Connect Plus
settings
1
Edit
BlackBerry Secure Connect Plus
settings
1
View server certificates
1
Update server certificates
1
View
BlackBerry Control
settings
Edit
BlackBerry Control
settings
View
BlackBerry Dynamics
NOC proxy server settings
1
Edit
BlackBerry Dynamics
NOC proxy server settings
1
Edit SNMP settings
1
Import IT policy pack and device metadata
1
View collaboration service settings
1
Edit collaboration service settings
1
View
BlackBerry Dynamics
settings
View
BlackBerry Dynamics
app services
Edit
BlackBerry Dynamics
app services
Create
BlackBerry Dynamics
app services
Delete
BlackBerry Dynamics
app services
View
BlackBerry Dynamics
server properties
1
Edit
BlackBerry Dynamics
server properties
1
View
BlackBerry Dynamics Direct Connect
settings
Edit
BlackBerry Dynamics Direct Connect
settings
View
BlackBerry Dynamics
server cluster settings
1
Edit
BlackBerry Dynamics
server cluster settings
1
View
BlackBerry Dynamics
reporting
View
BlackBerry Dynamics
communication settings
1
Edit
BlackBerry Dynamics
communication settings
1
View
BEMS
Mail settings
2
Edit
BEMS
Mail settings
2
View
BEMS
Docs settings
2
Edit
BEMS
Docs settings
2
View
Enterprise Identity
settings
View
Enterprise Identity
Enterprise settings
Edit
Enterprise Identity
Enterprise settings
View
Enterprise Identity
service settings
Edit
Enterprise Identity
service settings
1
On-premises environments only
2
Cloud environments only

Dashboard

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View dashboard

Auditing

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
View system audit logs
1
View device performance logs
1
1
On-premises environments only

Workspaces

Permission
Security Administrator
Enterprise Administrator
Senior HelpDesk
Junior HelpDesk
Organization administrator
Helpdesk administrator
Audit helpdesk administrator