Access

Add/Modify

Delete

Admin Auditing

Provides access to the admin auditing log.

Dashboard

Provides access to the dashboard tiles. Tiles require additional permissions as follows:

• Alarms Panel: Requires access to Event/Alarm, links and buttons are enabled if Add/Modify is enabled.
• Summary Panel: Requires access to System Settings.
• Network Device Summary Panel: Requires access to Devices, links are enabled if Add/Modify or Delete are enabled for Devices.
• Host Summary Panel: Requires access to Users/Hosts/Adapters.
• Scans Panel—Requires access to Policy.
• User Summary Panel—Requires access to Users/Hosts/Adapters.
• License Information Panel—Requires access to System Settings.
• Persistent Agent Summary Panel—Requires access to Policy.
• Performance Summary Panel—Requires access to Event/Alarm.

Event to Alarm Mappings

Event Management

If enabled, the views shown in the left column can be accessed.

Group Membership

Allows access to Host, User, Device or Port group membership. Requires that one of the following additional permissions be enabled:

• Devices
• Locate Hosts & Users
• Manage Hosts & Ports
• Users/Hosts/Adapters

Groups

If enabled, allows access to the Groups View where you can view, add, modify or delete a group.

Guest/Contractor Accounts

If enabled, allows access to the Guest Contractor Accounts View where you can view, add, modify or delete a guest account.

Custom/Manage Guests

This tab displays when the Custom permission is enabled. Custom Options include:

• Guest Account Access: Indicates whether user can access All, Own or No guest accounts after they have been created.
• Account Types: Allows user to create Individual, Bulk and or Contractor accounts
• Create Accounts Days in Advance (Maximum): Number of days before guest registers that the account can be created.
• Create Accounts Active For Days (Maximum): Maximum number of days that accounts created by this user are allowed to be active.
• Allowed Templates: Templates that can be used to create guest accounts

Refer to Add a guest manager profile for detailed information.

Locate Hosts & Users

If enabled, the views shown in the column on the left can be accessed.

• User can view adapter, host, user, and device identity.
• User can view group membership for Hosts and Users.
• User can modify Host information including registering a host.
• User can modify User properties for network users and administrators.
• User can delete Host and Adapter records.

Alarms

Connections

Events

Scan Results

If enabled, the views shown in the column on the left can be accessed.

Users can view information about events within the system and on the network.

Manage Hosts & Ports

If enabled, the views shown in the column on the left can be accessed. Access is limited to users, hosts and adapters in groups for which user has permission. See Limit user access with groups.

User can view adapter, host, user, and device identity.

User can modify Host information including registering a host.

User can modify User properties for network user.

User can enable or disable an adapter.

User can view Port properties for the ports where an adapter is connected.

Network Device
Summary Dashboard Tile

CLI Configuration
Device Profiling Rules
L2 Polling
L3 Poling
Locate
Port Changes
Topology

If enabled, the views shown in the left column can be accessed.

Custom (FortiNAC versions 8.8.9 and above): If selected, the Network Device tab appears. "Can View Credentials" can be enabled/disabled. Disabling this option hides the device model credentials information in Topology.

Control Access

Network Device Roles

Passive Agent Configuration

Persistent Agent Properties

Policy Configuration

Remediation Configuration

Roles

If enabled, the views shown in the left column can be accessed.

The Passive Agent registration view requires access to Groups to add or modify Passive Agent Configurations.

Portal Configuration

If enabled, allows the user to view and edit settings for portals. Users with the Policies permission set enabled will also have this permission set enabled.

Custom options include:

• Access: Allows the user to view the portal settings.
• Add/Modify: Allows the user to view the settings, add new portal settings, and delete existing portal configurations. Requires that Access permissions be enabled. Permissions can be further modified to prevent the user from adding new portal configurations or modifying the default portal configuration.
• Delete: Allows the user to view portal settings, add new ones, and modify and delete existing portal configurations. Requires that Add/Modify permissions be enabled.

Profiled Devices

If enabled, allows the user to view the list of profiled devices. User can also Export devices, register a device, enable or disable a device, delete the device from the list and view details and notes for a selected device.

The Views column on the Profiled Devices View contains icons that provide access to details about the selected device. these icons only display if additional permissions are enabled for the administrator. Possible views include: Adapter Properties, group membership, port properties and Device Properties.

Adapter Properties: Requires permission for users, hosts, and adapters.

Group Membership: Requires permission for group membership.

Port Properties: Requires permission for Devices.

Device Properties: Requires permission for users, hosts, and adapters or Devices.

Custom/Profile Devices

This tab displays when the Custom permission is enabled. Custom Options include:

• Register, Delete, and Disable Profiled Devices: If enabled, the user can register, delete and disable devices that have been profiled by device profiler.
• Modify Device Rule Confirmation Settings: If enabled, the user can change rule confirmation settings on devices that have been profiled by device profiler. Rule confirmation settings control whether or not device profiler checks a previously profiled device to determine if it still meets the criteria of the rule that categorized the device.

• Manage Profiled Devices Using These Rules:

  • All Rules: includes current rules and any rules created in the future.
  • Specify Rules: you must choose the rules from the Available Rules field and manually move them to the Specify Rules field.
    
• Available Rules: Shows the existing rules you can select for this profile. Select the rule and click the right arrow to move it to the Selected Rules pane.
• Selected Rules: Shows the rules you selected from the Available Rules section. The user can only access the devices associated with the rules in this list.

Refer to for detailed information.

Analytics

Reports

If enabled, the views shown in the left column can be accessed.

Security Alarms

Security Events

If enabled, the views shown in the left column can be accessed.

User has access to view security alarms created when a security rule is matched. Users can take action on a security alarm if it was not done automatically. The user's administrator profile settings determine the actions they are allowed to complete.

Security Actions

Security Rules

Security Triggers

If enabled, the views shown in the left column can be accessed.

User can create security devices, and security event rules. Users will establish and maintain all rules and the default actions associated with each rule.

Self Registration Requests

If enabled, user can manage requests for network access submitted by Guests from the captive portal.

Send Message

User can send messages to hosts with the Persistent Agent or Mobile Agent installed.

Scheduler

Settings

If enabled, the views shown in the left column can be accessed.