Who Has Access

Whenever you create a new resource in Axonius—such as a query, dashboard, or enforcement action—you must assign access privileges. These privileges determine:

• The data scopes in which the resource can be used.
• The users and roles that are granted specific access levels.
• By default, new dashboards and queries are assigned Private access permissions. This can be changed by admin users. See Special Permissions for more information.

When creating or editing these resources, the dialog box or drawer page has a section named Who has access where access permissions are configured.

The steps below describe how to use these options.

If you came to this page from another procedure, when you are finished configuring Who Has Access, go back to that page.

1. In the Who has access section, under General access, select one of the following:

   • Private - The resource will only be available to you within the data scope it is created. When Private is selected, “Manage permissions” is not available.

   • Public - The resource will be available to the selected roles and users within the data scope it is created.

   • Shared - The resource will be available to the selected roles and users in the data scopes you choose, or in all data scopes. When creating a dashboard or a saved query and Shared is selected, the Select data scopes list appears. Select the data scopes where you want the dashboard or query to be available.
     

     • Select data scopes appears only when data scopes are enabled on the system.
     • The default is All data scopes (Includes all existing and future data scopes). When you select a specific data scope, All data scopes is removed from the list. Select All data scopes again to share with all data scopes. An empty list also means all data scopes.
     • Users in a selected data scope see the query and run it inside their own data scope. Users who are not assigned to a data scope also see it. Users in other data scopes do not see it.
     • When you change the access from Shared to Public or Private, the list of data scopes is removed.
     • If a query uses another saved query that is shared with fewer data scopes, the message The selected query is not shared with every data scope this query is shared with appears. If you remove data scopes that another shared query needs, the message The query is used by queries shared with data scopes it would no longer be shared with: followed by the query names appears.
     • A deleted data scope can remain in the list, but it matches no users.
     • Queries that were shared before version 10.0.0 remain shared with all data scopes.
     • To share a query, you must not be assigned to a data scope, and your role needs Queries > Add and edit for all data scopes, plus Saved Queries > Create (new query) or Saved Queries > Edit (existing query) for the asset type. Allow sharing dashboards and queries to all Data Scopes must also be enabled in Special Permissions. It is enabled by default.
     • Example: Save the query Windows Servers as Shared, and in Select data scopes select only EMEA and APAC.
     • Saved views of the Adapter Fetch History and Adapter Fetch Events pages can also be Shared. On these pages, the General access options are Public and Shared. See Adapters Fetch History.

     Note

     A dashboard that has Shared or Public access cannot be changed Private access.

     

2. Under Manage permissions, select the users and roles who will have access and then select their access types. You can select a combination of users and roles. Admins and the query creator always have Editor access.

   1. From the list, select one or more users/roles. The list shows the first 5 users and the first 5 roles. To find those not shown, start typing in the search field. Select All to give the selected access to all users and roles.

      

   2. Select an access type to apply to the selected users/roles:

      • Role Access - The selected users and roles are granted access according to the permissions configured for each role. You can select a mixture of roles and users.
      • No Access - The selected users and roles will have no access.
      • Viewers - The selected users and roles only have permission to view, regardless of the permissions configured for each role.
      • Editors - The selected users and roles have permission to view and edit, regardless of the permissions configured for each role.
        See Managing Roles for more information about assigning permissions to roles at the system level.

3. Click Add to assign the selected permissions to the selected users and roles. You can change the access for each individual role or user after adding them from the list by selecting the access level from the list to the right of the role or user name.

   

   Repeat these steps to give different users and roles the appropriate access permissions. For example, select all the individual users and roles that you want to have 'System Access' and click Add. They are added to the list of allowed users and roles. Then, if you want other users and roles to have a different level of access, select them, their access level, and click Add. They are also added to the list of allowed users and roles. Do this for each access level you want to assign.

   

4. Continue with the procedure you were working on.