Role-Based Access Control (RBAC) allows you to control what administrators can access and manage in the Evo Partner Portal.

Roles are made up of permissions and can be assigned directly to users or to groups. A user's effective access is the combined access provided by all roles assigned to them.

RBAC is managed from:

Evo Admin → Permissions → Roles

RBAC follows two important rules:

Access can only be added. There is no explicit "deny" permission. If a user has access to something, that access is coming from one of their assigned roles.

Roles are reusable. A role is not tied to a specific user or tenant. Create a role once and assign it to multiple users or groups as needed.

To create a role:

The Roles & Permissions interface uses green and blue indicators to show how access is granted. The color of an indicator, along with how it is filled, makes it easy to understand a role's access at a glance.

Evo provides a set of Built-in roles designed for common administrative responsibilities. These roles are available by default in a new environment and provide a predefined set of permissions for specific areas of the Partner Portal.

Built-in roles are identified by the BUILT-IN badge in the Roles list.

Built-in roles are managed by Evo and have a predefined set of permissions. As a partner, you can assign these roles to administrators, but you cannot modify the role itself.

Built-in roles cannot be edited or deleted. Their name, description, and permissions are managed by Evo to ensure they remain consistent across environments. Built-in roles display a View icon instead of an Edit icon, and the Delete option is not available.

Built-in roles can be assigned to users and groups. You can add or remove assignments at any time. When managing assignments for a Built-in role, the save option is displayed as Save assignments.

Built-in roles can be cloned. If a Built-in role is close to what you need but requires additional permissions or restrictions, use Clone to create a Custom role. The cloned role can then be modified and assigned as needed.

The Role-Based Permissions section includes a variety of Built-in and Custom roles, each designed to provide access to specific areas of the Evo Partner Portal.

While some role names are straightforward, others may not immediately make their purpose clear. The sections below provide an overview of each available role and the permissions it provides.

Tokens used to enroll agents and authenticate deployments.

Application registrations and permission grants.

Billing details, invoices, and payment settings for global and tenant accounts.

White-label branding such as logos and color schemes.

Environment management and global admin impersonation.

Managed computers and devices, including updates, removal, and synchronization.

Customer activity, audit events, and security event logs.

Tenant environments and their lifecycle.

Main dashboard and summary metrics.

Connected identity directories such as Azure AD and LDAP.

Elevated domain account logins and their day-to-day use.

Pending privilege elevation requests.

Rules governing privilege elevation.

User membership within groups.

User groups and their membership rules.

Help desk identity verification settings.

Product license assignment.

Local administrator accounts on managed devices.

Login keys issued to users.

Capabilities available to technicians in the Evo mobile app.

Elevation and general notification configuration.

Onboarding enrollments for bringing new users and devices into the portal.

Professional Services Automation integrations.

Partner API keys used to authenticate API access.

Password synchronization integrations.

Security policies, including the global default policy and individual policies.

RADIUS servers used for network authentication.

RMM integrations and deployment settings.

Roles and permissions that define administrator access.

Active user sessions.

Evo support access to environments.

System-level elevation capabilities.

Tenant access settings.

User accounts, profiles, and lifecycle management.

Web account credentials used for authentication.