Manage users, access profiles and 2FA

Choose a reusable profile

Open Administration → Users and access profiles. Create or review a profile before assigning several team leaders the same permissions. Page access and individual actions are separate: opening Recordings, for example, does not mean that every playback, download or analysis action should be granted.

Configure the account

Create the username and display name, choose the role and select profile-based or custom permissions. Review existing users through the search and active/inactive filters before creating another account.

Limit live resources
Select allowed queue groups or individual queues for Dashboard, Wallboard and Videowall. Configure Monitor and Status extension scopes separately.
Choose session and 2FA policy
Use a normal session for an operator and the dedicated Display session for a read-only shared screen. Set the account’s two-factor policy; enrollment is completed in Profile.

Build a profile, then define visibility

Start from the work the team leader actually performs. A reusable profile grants a consistent set of page and action permissions to multiple accounts; each account’s live resource scopes decide the queues and extensions visible within the supported views. Review these two decisions separately.

Setting	Practical effect
Page permissions	Allow the pages needed for the job, such as Dashboard or Recordings.
Action permissions	Review individual commands such as live supervision, recording actions or exports independently of page access.
Live resource scopes	Set Dashboard queues and the separate Monitor and Status resources. Hidden shared resources remain excluded.
Session mode	Choose a normal working account or a Display account for the supported live screens in read-only mode.

Select groups and individual exceptions

In each resource domain, choose All or Only selected items. With selected items, allowed groups and individually selected resources are combined: selecting a group plus one queue includes both. An empty selection means no resources, not all resources. Use search and the inventory refresh to find newly available identifiers.

Test with the actual account

Sign in with the configured account and check both permitted and excluded resources. Verify that a visible page exposes only the intended commands. When editing a reusable profile, review every account that depends on it: the effect can extend beyond the person currently being configured.

Understand the scope boundary

Resource scopes currently filter the supported live views. They are not a queue-level restriction on historical reports, exports or recordings. Personal preferences can further organize allowed resources but cannot add permissions. Keep an administrator access path available when changing authentication requirements.

Use the controls, understand what changes

Review page permissions and action permissions separately from live resource scopes. In selected-only mode, selected groups and individual resources are combined; an empty selection grants no resources. Test with the target account, because an administrator does not reproduce its restricted view.

Choose the live resources visible to the account

Open Users and edit the intended account. Page and action permissions are configured above this panel; the live resource scope determines which permitted resources the account can see. Under Dashboard and Wallboard, choose Selected items only, then select groups and any additional individual queues. Selecting a group includes its current and future members.

The full screenshot also contains the independent Monitor and Status scopes. A restricted scope with no selection displays no resources; globally hidden items remain excluded. Save the user and verify with that account. These resource scopes apply to live views, not to the records in reports or recordings, which have separate page and action permissions.

A focused view of the original screenshot; example values.Open the complete screenshot

Set the account’s two-factor authentication policy

In the user editor, locate Two-step verification. Choose Disabled, Optional or Required at next sign-in according to the intended policy, and check whether the account already has 2FA configured. Requiring 2FA protects access; it does not add page permissions or broaden the live resource scope.

Reset the device and recovery codes only when a reset is needed. Changing the policy or resetting enrollment requires your administrator password and, when your own 2FA is active, a valid code. These confirmation fields are not required for ordinary permission changes. Save the user; if a reset leaves 2FA required, the user must configure it again at the next sign-in.