> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Administrative Permissions

> Reference for Syteca's seven administrative permissions — what each one grants, prerequisites, and the actions it unlocks on the Users page, Configuration, dashboards, and reports.

Administrative permissions define what a user can do at the **system level** — across the whole Syteca deployment, regardless of which Clients they're scoped to. The seven administrative permissions are the canonical access-control surface for the Management Tool, granted directly to users or inherited from [user groups](/docs/administration/users/users).

For per-Client permissions, see [Client permissions](/docs/administration/users/client-permissions). For how user permissions and user-group permissions combine, see [Example of permission inheritance](/docs/administration/users/client-permissions#example-of-permission-inheritance).

## Granting and revoking

Administrative permissions are granted on the **Administrative Permissions** tab when [adding](/docs/administration/users/users#add-a-user) or [editing](/docs/administration/users/users#edit-a-user) a user or [user group](/docs/administration/users/users#add-a-user-group). Permissions can be either:

* **Inherited from a user group** — automatic; revoke by removing the user from the group.
* **Granted directly to the user** — independent of group membership.

<Note>
  If an Active Directory user is added as an independent internal user **and** as a member of a Windows domain user group, **the user's own permissions take priority** over the domain-group-inherited ones.
</Note>

## The seven permissions

### Management Tool Access

Allows the user to [open](/docs/get-started/management-tool-basics#open-and-sign-in) and use the Management Tool. **This permission is a prerequisite for every permission below** — without Management Tool Access, the other administrative permissions don't take effect.

### Client Installation and Management

Grants a wide set of operational capabilities:

* [Install Clients](/docs/administration/clients/windows) and manage them.
* Manage [Client groups](/docs/administration/clients/windows).

- Manage [alerts](/docs/session-monitoring/alerts).
- Define [Global Alert Settings](/docs/session-monitoring/alerts#global-alert-settings).
- Create and manage [Scheduled Report rules](/docs/session-monitoring/reports/scheduled-reports).
- View the list of [generated reports](/docs/session-monitoring/reports/overview#the-generated-reports-tab).
- Define [Email Sending Settings](/docs/administration/configuration/email-sending-settings).

* Create and manage [USB monitoring & blocking rules](/docs/session-monitoring/usb-devices/usb-rules).
* [Block users](/docs/session-monitoring/block-on-alert).

<Note>
  This permission is **also required** for a user to assign or unassign licenses to/from Clients — even if they have the License Management permission.
</Note>

### Database Management

Allows the user to:

* Access information about the database.
* Perform [database cleanup operations](/docs/administration/deployment/database-management).
* [Delete Clients](/docs/administration/clients/delete-clients) from the database.

### License Management

Allows the user to [assign licenses to Clients](/docs/administration/licensing/assign-endpoint-licenses) and unassign them.

<Warning>
  Assigning/unassigning licenses also requires the **Client Installation and Management** permission.
</Warning>

### Privileged Accounts Management

Allows the user to:

* Access the [Account Discovery](/docs/pam/discovery/overview) page and use the feature.
* Configure [Syteca Web Connection Manager](/docs/pam/access/web-connection-manager).

### Tenant Management and System Configuration

*Only available for users in the built-in default tenant.*

Allows the user to:

* [Manage tenants](/docs/administration/multi-tenant/manage-tenants) and [grant or ungrant licenses](/docs/administration/multi-tenant/manage-tenants#change-the-licenses-granted-to-a-tenant) to them.
* Define the [system configuration](/docs/administration/configuration/system-settings).
* [Activate](/docs/administration/licensing/manage-serial-key) and deactivate serial keys.
* View the **System State** tab on the [System Health page](/docs/administration/dashboards/system-health-dashboards).
* [Download the Application Server and Management Tool log files](/docs/resources/troubleshooting/logs).

### User Management

Allows the user to:

* [Manage users and user groups](/docs/administration/users/users) and define their [permissions](/docs/administration/users/administrative-permissions).
* View the [Audit log](/docs/administration/audit-log).

### Viewing Archived Data

Allows the user to [view](/docs/session-monitoring/archived-sessions) and export sessions from archived databases.

### Viewing Monitoring Results

Allows the user to:

* Open Client sessions — including [archived sessions](/docs/session-monitoring/archived-sessions) — to view recorded screen captures and metadata.
* Generate [dashboards](/docs/session-monitoring/dashboards/user-activity-dashboards).
* Generate [reports](/docs/session-monitoring/reports/overview).

<Note>
  This is the canonical separation-of-duties permission. Granted alone (without Client Installation and Management), it lets an investigator review activity without being able to change the deployment — useful for restricting system administrators from viewing sensitive monitoring data, or vice versa.
</Note>

## PAM User Access

A separate permission for **PAM users** who don't otherwise have Management Tool Access. Allows them to log in to the Management Tool with **limited access — to the Password Management page only** — so they can create and manage their own [Workforce Password Management (WPM)](/docs/pam/secrets/workforce-password-management) secrets.

Use this when you have many users of [Syteca Connection Manager](/docs/pam/access/desktop-connection-manager) who need to manage personal WPM vaults but shouldn't see the rest of the Management Tool.

## Permission combinations

| User type                                   | Typical permissions                                                                                        |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Platform administrator**                  | All permissions (or membership in **Administrators** group).                                               |
| **Investigator / Auditor**                  | Management Tool Access + Viewing Monitoring Results + (optionally) Viewing Archived Data.                  |
| **Help desk / Operator**                    | Management Tool Access + Client Installation and Management + License Management.                          |
| **User-management-only admin**              | Management Tool Access + User Management.                                                                  |
| **Compliance officer** *(Supervisors role)* | Management Tool Access + Viewing Monitoring Results across all Clients (default Supervisors group).        |
| **PAM end user**                            | PAM User Access only (for WPM); or no Management Tool access at all (uses Syteca Connection Manager only). |

## Related

<CardGroup cols={2}>
  <Card title="Users and user groups" icon="users" href="/docs/administration/users/users">
    Where permissions are actually granted — Add/Edit User and Add/Edit User Group.
  </Card>

  <Card title="Client permissions" icon="lock" href="/docs/administration/users/client-permissions">
    Per-Client permission grants — narrower scope than administrative permissions.
  </Card>

  <Card title="Disable the default admin" icon="shield-check" href="/docs/administration/users/users#disable-the-default-admin">
    Harden the deployment by eliminating the built-in `admin` account.
  </Card>

  <Card title="Multi-Tenant overview" icon="users-round" href="/docs/administration/multi-tenant/overview">
    Tenant Management and System Configuration only applies in Multi-Tenant mode.
  </Card>
</CardGroup>