Who Can Do What in IoT Devices

IoT Devices has two layers of permission. Rights decide which pages, tabs and administration a person has. Access decides which device functions a person can see and use. No right lets anyone operate a device: operating always needs access to that function.

The rights

Assign these in Settings → Essential Setup → Security Roles; see How to Create and Manage Security Roles. Every IoT right except Show Tour sits under View IoT Devices. Below, a tab is one of the tabs in Settings → Devices (IoT), and a page is one of the tabs under Devices (IoT) in the menu.

• View IoT Devices: open Devices (IoT) and see the devices that access allows.
• Manage IoT Connections: link, sign in again, rename, check, sync, switch off and remove connections, on the Connections tab.
• Manage IoT Spaces: manage sites and rooms, map vendor rooms, and rename and place devices, on the Sites and spaces tab.
• Manage IoT Access: give and remove access, check who can do what, and turn safety-critical controls on or off on a device, on the Access tab.
• Manage IoT Sharing: share device access outside the organization and end shares, on the Shared page and the Sharing tab.
• Manage IoT Automations: create and change automations and site modes, on the Automations page.
• Manage IoT Alarms: write alarm rules, escalation policies and maintenance windows, on the Alarms tab.
• Acknowledge IoT Alarms: acknowledge and shelve alarms, and add notes to them.
• View IoT Activity: read the whole organization's activity and command log. Without it you see only the activity of devices you can see.
• Export IoT Data: download records as CSV files, from the Activity and Shared pages and the Data and exports tab.
• Manage IoT Settings: change the organization-wide settings on the Safety and notifications, SI and Data and exports tabs, and raise a function's safety class. Giving anyone a safety-critical control also needs this right.

Home page widgets

Four widget rights control the IoT widgets on the home page: IoT Status Widget, IoT Alarms Widget, IoT Device Widget and IoT Camera Widget. Each has the usual four child rights, Added By Default, Optional, Required and Movable, for example IoT Status Widget: Added By Default. The device and camera widgets show devices you pin to your home page.

The guided tour

Show Tour controls whether the IoT Devices guided tour is offered. It is granted by default. The tour shows the member pages first, then the settings tabs you have rights to.

The organization owner

The organization owner holds View IoT Devices and the ten administration rights above without being given them. The widget rights and Show Tour are not included.

The rule that surprises people

Owners and administrators manage access, but they operate devices only through the access they have been given. If an administrator cannot unlock a door, it is because nobody gave them the unlock function. How to See Who Can Operate a Device shows why.

Rights that SI members cannot hold

Six rights are never available to SI members: Manage IoT Connections, Manage IoT Access, Manage IoT Sharing, Manage IoT Alarms, Manage IoT Settings and Export IoT Data. See How SI Members Use Devices.