Access Control

Navigate to Main menu > Admin > Access Control, the Members, Roles, Scopes, Groups and Spaces tabs enable you to manage access across the Ivanti Neurons Platform.

The Spaces tab and the associated options are only available for Unified Product Experience tenants. For more information, see Unified Product Experience.

The Groups tab and the associated options are available when syncing groups using SCIM provisioning protocol. For more information on setting up SCIM provisioning for IDPs, see SCIM Provisioning.

Members

When a company signs up for the Ivanti Neurons Platform, the first person who logs in becomes a member and is assigned the role of Administrator. Other people can be invited to become Neurons Platform members and use the features the Neurons Platform has to offer.

There is no connection between the list of users who are members of the Neurons Platform and the user data such as Function, Feature, and Directory that is imported using an Active Directory connector.

  1. Go to Main menu > Admin > Access Control > Members.
  2. On the Members tab, click + Invite New Member.
  3. Provide the email address and name of the person, and assign the desired roles.
    To invite more than one user, click Add another until you've added everyone you want to invite.
  4. Click Send invitations. An email is sent to each address you provided, and each person is invited to log in.

When the invitation is sent, the person's name appears in the Members list and the status is set to Invitation sent. To resend the invitation, click More Options (ellipsis icon) to the right and select Resend invitation.

After they log in for the first time, the status is set to Joined.

  1. Go to Main menu > Admin > Access Control > Members.
  2. Find the person in the list.
  3. Click More Options (ellipsis) to the right and select Deactivate or Delete.
  1. Go to Main menu > Admin > Access Control > Members.
  2. Find the person in the list and click on their Name to open the member Details page.
    The Roles section of the page lists roles that are already assigned to the member.
  3. Click Assign Roles for a list of available roles and their associated permissions.
    The Select Roles dialog appears.
  4. Select the roles you want to assign to the member.
  5. You can select the space for a specific role by clicking (spaces) in the Selected Roles section.
    The Select spaces for Custom-MDM-Role section appears.
  6. Select the desired space(s) by clicking on the check boxes.
  7. Click X in the Selected Roles section.
  8. You can go to the Effective Permissions tab to review the resulting access profile for the member.
  9. You can go to Spaces and click Remove Member to remove the member from the space.
  10. When you have made the desired changes, click Save & Close.
    If the role requires to select a space, refer to the

Roles

Configure the permissions of your members by assigning them one or more Roles.

The Neurons Platform comes with several pre-configured roles that cannot be changed. If these roles do not meet your needs, you can also create custom roles.

Space aware roles - The permissions are specific to each space, so you can assign roles to a specific space only. Examples are Device Management, App Management in a space. To learn more, refer to the Roles Management section in the Ivanti Neurons for MDM Administrator guide.

General roles - The permissions are, by nature, applicable to all roles. Examples are tenant-level settings such as MDM Certificates, App Catalog Settings.

  1. Go to Main menu > Admin > Access Control > Roles.
  2. Click +Add Custom Role.
    The New Role page appears. 
    1. Enter the Name.
    2. Enter a Description.
  3. Click the Permissions tab to specify the set of permissions for the selected role.
    You can set permissions for multiple products. For example, when you are creating a role in the Neurons Platform tenant, you can set permissions associated with both Neurons Platform and MDM at the same time.
    You can add or remove permissions in two ways:
    Select by Category:
    1. Select a permissions category from the left-hand column, for example, MDM Actions.
    2. Select the required permission categories under MDM Actions.
    3. In the Select Permissions column, select the desired permissions from the MDM Actions category. The planet icon indicates space-aware permission.
    4. The Selected column displays an overview of all selected permissions across categories.
      You can also use the check box at Select Permissions to add or remove all the permissions in the category.
      checkbox with blue background and white dash symbol indicates some permissions in the category have been selected.
      check box with blue background and white tick indicates all permissions in the category have been selected.
      Alternatively, click Remove from the Selected column to remove the existing permission.
    5. Repeat for other categories you may need.
    Select by Name:
    1. If you know (part of) the name of the permission, type it in the Search.
      A list of matching permissions appears and is updated as you type. You can add permissions using the check boxes in these search results.
    2. Continue with step 3 (d) under Select by Category.

  4. Use the Members tab to assign the role to members or remove it.
    1. Click the Assign to Member(s) button.
      The Assign to Member(s) dialog appears.
    2. Select the members you want to assign the role to.
    3. Click Assign to Selected.
    4. To remove a member, select them and click Remove Selected Member(s).
    5. Select the member to assign the role(s).
    6. Click Assign Roles in the Roles Panel.
      The Select Roles dialog appears.
    7. Select the roles you want to assign to the chosen member.
      To remove the selected role(s), click X in the Selected roles section.
    8. Once you have made the changes, click X to close the Select roles dialog.

  5. Click Save & Close. 

  1. Go to Main menu > Admin > Access Control > Roles.
  2. Click Permissions tab. Follow the steps 3 to 6 from the create a custom role section.

Scopes

Use scopes to define which devices members can see and manage. Administrators can create a scope containing a static list of devices or they can create a scope that works dynamically based on filters.

Members can have multiple scopes assigned to them. Scope creation and assignment requires the Access Control > Modify Scopes permission.

Scopes currently apply to only the following areas of Ivanti Neurons platform:

  • Devices
  • People
  • Smart Advisors
  • Dashboard components that get data from Devices or People
  • Bots (Custom Action)
    The use of Custom Actions can now be restricted using Neurons Scopes, providing enhanced security by controlling which device groups or people a bot is allowed to execute actions against, based on the scope access of the user who triggered the bot. For more information on Scope for Run now, see Run now.
  • App Control
    Scopes enable administrators to set limitations on what users and devices can see or access in App Control.
  • Patch Management
    In certain scenarios, the number of devices found in a scope may be higher than the number of devices available in Patch Management once this device scope is assigned. The icon shows the information in the column is not as per specified scope. A banner also indicates this on the top of the page.
  • Patch Management Reports
    Patch Management reports are generated based on the device scopes assigned.
    Learn more about Patch Management Reports.
  • Edge Intelligence (Device Scope supported)
    In certain scenarios, the number of devices found in a scope may be higher than the number of devices available in Edge Intelligence once this device scope is assigned.
    Scenarios are:

    1. When configuring a scope, the used filter criteria can result in identical devices. For an example: multiple devices with the same computer name.

    2. Not all devices have the Edge Intelligence engine or capability installed.

    3. Device being offline for longer than 30 days, which Edge Intelligence will clean up.

  1. Go to Main menu > Admin > Access Control > Scopes.
  2. Click the scope you want to modify or click Create new > Create device scope, to open the new device scope page.
  3. Enter a Scope name.
  4. Under Scope type, select Static.
  5. Click Add devices.
  6. Click Add or select the box next to each device you want to include in the scope. Use the search field to filter the list.
  7. Click OK when you have finished adding devices. The devices you selected appear in the scope's device list.
  8. At the bottom of the page, click Save & Close.
  1. Go to Main menu > Admin > Access Control > Scopes.
  2. Click the scope you want to modify or click Create new > Create device scope, to open the new device scope page.
  3. Enter a Scope name.
  4. Under Scope type, select Dynamic. It's the default.
  5. Under Scope filters, build a filter that includes the devices you want.
  6. At the bottom of the page, click Save & Close.
  1. Go to Main menu > Admin > Access Control > Members.
  2. Find the person in the list and click on their Name to open the member Details page.
  3. Click the Scopes field.
  4. Click Add Scope > Device Scope.
  5. From the Device scopes list, select the scopes you want to assign to the member.
  6. Click Assign scopes.
  7. When you have made the desired changes, click Save & Close.
  1. Go to Main menu > Admin > Access Control > Scopes.
  2. On the required scope, click and select Remove Members to remove a member from the scope.

    If the scope is not assigned to a member, the Remove Members option will be disabled for that particular member.

  1. Go to Main menu > Admin > Access Control > Scopes.

  2. Click Create New > Copy from Device Group.
    The Device Group window appears.

  3. Select the desired device group or use the search box to filter out the device.

  4. Click Copy to Scope.
    The New Device Scope page appears.

  5. Enter the Scope Name.

  6. Configure the scope as required.

  7. Click Save & Close on the top right of the page.

Groups

Groups allows you assign roles through SCIM from your Identity Provider (IdP). You can control assigned roles through group membership at the IdP. With this setup, Neurons admins don’t need to assign the same default roles to every new member. Instead, new members receive access based on the roles of the groups they belong to.

The Groups tab displays groups that are synced using SCIM provisioning protocol from your IdP. For more information on configuring SCIM, see SCIM Provisioning.

To assign roles, follow these steps:

  1. Navigate to Admin > Access Control.
  2. Go to the Groups tab.
    This displays the list of existing and newly added groups.

    The Member column shows the number of users who have logged in from a group with roles and the number of directly invited members in that group.
    The Population column indicates the number of users in that group, irrespective of whether the group has been assigned a role.

    Ensure you note the following information to interpret the count under the Member column:

    • A group has a non-zero member count only if the group is assigned a role and the users in that group have logged in.

    • When a directly invited member (including an unaccepted invite) is a user of a group with roles, they are included in the member count.

  3. On the Groups tab, you can do the following:
    • To assign role-based access control (RBAC): Select the required group, then click Assign Role to Group option, select roles that you want to assign, and click Save.
    • To authenticate member login via Ivanti Neurons: Enable the check-box under the Can Authenticate column for a group, and click Save Authentication Settings.
    • To deny access to all members in a group: Disable the check-box under the Can Authenticate column for the group.

Once the changes are saved, the users can log in based on:

  • Users from groups with the Can Authenticate option enabled can authenticate via Ivanti Neurons and log in.

  • If the group has roles assigned, the Can Authenticate option will be enabled automatically. Users in groups with roles can log in and access Ivanti Neurons with those roles.

  • If a group has the Can Authenticate option enabled but no roles assigned, users in that group can log in, but their access to Ivanti Neurons content is restricted.

  • If the group has the Can Authenticate option disabled, users from that group will not have access to Ivanti Neurons.

  • After users log in with assigned roles, the Members page will list users from groups with roles.

Spaces

The Spaces tab and the associated options are only available for Unified Product Experience tenants. For more information, see Unified Product Experience.

Spaces allow you to categorize mobile devices based on their characteristics or the user they belong to, making it easier to facilitate delegation management. Spaces can be created to reflect an organizational hierarchy or geography. Ivanti Neurons for MDM supports single-level delegation with a central management entity referred to as a Default Space, and a number of subordinate management entities referred to as Delegated Spaces.

To learn more about Spaces, see the Ivanti Neurons for MDM Administrator guide.

  1. Go to Main menu > Admin > Access Control > Spaces tab.
  2. Click +Add Space.
    The Add Space panel appears.
  3. Enter the Space Name.
  4. Set Priority. By default the priority is set to the next level available.
  5. Define Rule. Select Any when you want a device to be placed in this space if it matches any of the rules you have specified. Select All when the device must match all rules to be placed in this space.
  6. Click Add Space.
  7. Click Preview Changes to see how many devices will be assigned to the space.
  8. Click Save to publish the space.
  1. Go to Main menu > Admin > Access Control > Spaces tab.
  2. Click to modify the space.
    1. Click Edit name to modify the space name.
    2. Click Edit rule to modify the defined rules.
    3. Click Move up to increase the priority by one and decrease the priority of the space above this space by one.
    4. Click Move down to decrease the priority by one and increase the priority of the space below this space by one.
    5. Click Delete space to delete the space.