Team and Roles

Team is where you manage who belongs to your Organization and what each person is allowed to do. Every member holds exactly one role, and that role's permission set decides which features appear in their sidebar and which requests the API accepts from them.

Overview

Open Team from the bottom of the sidebar, next to Settings. The page has three tabs: Users lists everyone who currently has access, Pending invitations lists the invitations that have been sent but not yet accepted, and Roles holds the permission sets you assign to people. The Roles tab only appears for users whose own role allows reading roles.

Membership belongs to the Organization, not to the platform. One account can be a member of several Organizations and hold a different role in each, so removing someone from your Organization does not delete their account or affect their access elsewhere.

Users

The Users table shows the member's name and email, their Last Login, and their Role. Phone Number and MFA are available too but hidden by default: turn them on from the columns toggle in the toolbar. The search box matches on name, email and phone number, the Role chip filters the list down to selected roles, and the export button writes the filtered rows to a file.

Use the row menu and choose Edit to open a member. Their page has three tabs.

Information is a read-only summary: first name, last name, email, role, and whether MFA is required.

Permissions is where you change what they can do. Role picks one of the Organization's roles, Assigned Locations limits the sites they work with, and Multi-factor Authentication decides whether they must verify with a second factor when signing in. Each control saves as soon as you change it, so there is no separate save button. You cannot change your own role or your own MFA requirement, and the page says so when you open your own record.

The Permissions tab for a team member, with the role selector, assigned locations and the multi-factor authentication switch — The Permissions tab for a member: role, assigned Locations and MFA, each saved on change

Login History lists that member's sign-ins, defaulting to the last 90 days, with a date range picker for older activity.

At the bottom of the Permissions tab, Remove User From Organization revokes access to your Organization. It does not delete the account. The confirmation asks you to type the member's email address before it proceeds.

Inviting Users

Click Invite User on the Users tab. The invite page asks for three things: the Email Address, a role from the Select a role for the user list, and whether to answer yes to Require Multi-factor Authentication?, which is on by default. Each role in the list shows its description, so you can see what you are granting before you send anything.

The Invite User page with an email address entered and one of the organization roles selected — Inviting a user: the role list shows each role and its description

What happens next depends on the address. If it already belongs to a ControlCom Connect account, that person is added to your Organization straight away with the role you picked, and nothing lands in their inbox. If it is new to the platform, an invitation email goes out and the invitation appears under Pending invitations until it is accepted.

Invitations are valid for seven days. The Pending invitations tab shows the Pending User Email, the Expires At date and the Invited As Role, and the tab label carries a count while any are outstanding. Expired invitations drop off the list on their own. To withdraw one before it expires, use the row menu and choose Cancel invite, or tick several rows and use Cancel invitations in the bar that appears.

Roles

A role is a named set of allowed features. The Roles tab lists each one with its description, how many users hold it, how many API keys use it, and how many features it allows.

Every Organization starts with three roles:

Role	What it allows
Administrator	Every feature, including Team, Roles, API keys and Organization settings.
Editor	Dashboards, Diagrams, Devices, Assets, Locations, Reports, scheduled jobs and the AI assistant, with no access to administration.
View	Read-only access: viewing Dashboards, Diagrams, Devices, Variables, commands, Assets, Locations, reports and Alarms.

The Roles tab listing the built-in Administrator, Editor and View roles alongside a custom role, with user counts and allowed permission counts — The Roles tab: the three built-in roles plus a custom one, with the users and API keys each is bound to

Click New Role to build your own. Give it a Role Name and a Description, choose its permissions, then click Create Role. To change an existing role, use the row menu and choose Edit; the same form opens with Save Changes at the bottom. Editing a role takes effect for everyone who holds it.

Deleting a role only works while nothing is bound to it. If any users or API keys still use it, the Cannot Delete Role dialog lists them so you can move them onto another role first.

How Permissions Work

The Permissions card in the role form lists every feature your subscription includes, grouped into categories such as Dashboards, Devices, Alarms, Reports, Energy Manager, Team and Roles. Each feature is a checkbox: ticked means the role allows it, unticked means the role denies it. The badge next to a category counts how many of its features are allowed, and Allow All and Deny All work either on one category or on the whole role.

The Create Role form with a name and description filled in and the Dashboards permission category expanded to show its individual feature checkboxes — Building a role: each category expands into the individual features it covers

Within a category the features follow the same pattern as the actions in the app, so Dashboards covers reading, creating, modifying and deleting a Dashboard, and Devices additionally covers Variables, commands and Edge Server configuration. Granting a create or delete permission without the matching read permission is possible but rarely useful, since the person still cannot open the list the item lives in.

Three rules govern the outcome:

A member holds one role per Organization, and there is no stacking or inheritance between roles. If a feature is not allowed by that single role, it is denied.

Denied features disappear from the interface rather than failing on click. Sidebar entries, action buttons and row menu items are all filtered by the same permission set, so someone without Create Dashboard never sees the button.

The interface is a convenience, not the boundary. The API applies the same permission set to every request, including requests made with an API key, so a denied feature stays denied outside the app.

Only features your plan includes can be granted. If a category you expect is missing from the role form, the feature is not part of the Organization's subscription yet.

API Keys and Roles

API keys carry a role in exactly the same way a person does. A key created under Settings → API keys is assigned one of your roles and inherits its permissions, which is why the Roles tab counts keys alongside users and why a role with keys bound to it cannot be deleted.

Give integrations their own narrow role rather than an administrator key: a role that allows only what the integration reads or writes limits the damage if the secret leaks. See Authentication for how keys are created and used against the API.