.svg){kind=logo}
Overview
System Admins are responsible for managing user roles within the Mend Platform. This document provides a technical guide for System Admins to control and configure user roles effectively.
After assigning all relevant users to a particular group, you can assign a role to the group which will apply the required permissions to all its users.
Mend Platform Roles and Permissions
|
Role |
Permissions |
|---|---|
|
Admin |
Organization Admins have full access to all features and configurations within the organizational scope. This includes user and group management, labels, scan configurations, applications, and projects. They can:
Application Admins can also create workflows, but only within their assigned application(s). These workflows are application-scoped and separate from organization-wide workflows defined by Org Admins. |
|
Security Analyst |
Security Analysts are responsible for the triage process of all security findings. They can review scans & findings data and take the needed actions to either resolve issues or suppress if needed. |
|
Scan Manager |
Scan Managers can execute security scans using Mend CLI or through the Repository Integrations. They can configure and change the organization structure by adding new applications/projects and making the needed structure changes. |
|
Member |
Members have access to Mend Platform for viewing purposes. They can review all available data in dashboards and drill-down to visualize projects, scans, and security findings data. Members can’t access administration or configuration capabilities and can’t impact data with actions. |
|
Legal Analyst |
Legal Analysts can manually override license and copyright assignments that were applied automatically during analysis. |
|
Auditor |
Auditors have read-only access to Mend data without the ability to modify data or change settings in the platform. Use for integrations (service users), automations, or users who only need visibility. |
Understanding Application-Scoped Roles and Default Group Access
By default, the built-in admins and users groups hold organization-level roles, which give their members access to all applications in the organization. The admins group’s organization-level scope can’t be changed, and application-scoped roles can’t be added to it manually.
Restricting new applications to the admins group
If Grant admins group access to newly created applications is enabled (Administration → General), each newly created application is automatically assigned to the admins group. That application is then accessible only to:
-
Members of the admins group
-
Users in a group that has a role scoped to that application
Users whose groups have only organization-level roles, including the default users group, won’t see the new application. To give them access, add a role scoped to that application to their group (see Assign a Role to group(s) below). Repeat this for each new application the group needs.
This setting affects only applications created while it’s enabled. Existing applications keep their current access. For details, see Application Default Permissions.
Getting it done
Assign a Role to group(s)
-
Log into the Mend Platform.
-
Click the settings gear in the top right corner of the page.
-
Click Administration.
-
Click Groups in the Administration menu on the left.
-
Click on the group name you would like to assign roles for.
-
Click the Roles tab and then the + Add Role button.
-
Select which roles to assign to the selected group. The roles can be assigned at the Organization level or a specific Application. Click the Add button to confirm your selection.
Delete Group Role
-
Select the relevant group in the Groups table.
-
Click Roles.
-
Unselect the role you would like to delete from a specific group.
-
Click on the “OK” button in the pop-up message window to delete to Group Role.
