---
title: "DEX Platform Account Permissions"
slug: "dex-platform-account-permissions"
updated: 2026-02-05T15:12:41Z
published: 2026-02-05T15:12:41Z
canonical: "support.controlup.com/dex-platform-account-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set ControlUp Account Permissions

:::(Info) (VDI & DaaS permissions)
If you use ControlUp for VDI & DaaS, permissions in your VDI & DaaS environment are controlled separately from other ControlUp products. To learn how to set VDI & DaaS permissions, see [VDI & DaaS Permissions](/tim-reorg/docs/vdi-daas-permissions-1).
:::

ControlUp uses role-based access control to assign permissions. This means that you assign permissions to roles, and then assign roles to users. A user can have multiple roles, and they can perform a certain action if at least one of their roles includes the relevant permission.

## Limit permission scope to certain devices
You can set the scope for a permission so that it applies only to certain managed physical devices. For example, you can give a help desk employee permission to remote control devices in the HR department, but not allow them to remote control devices used by senior executives. 

Set the scope of a permission by targeting device groups, device tags, or a combination of both. The permission applies to a device only if the device is in one of the specified groups **OR** has at least one of the specified tags. 

![PermissionScoping.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/PermissionScoping.png){height="" width=""}


By default, all groups and all tags are targeted, which means that the permission applies to all device in your environment. If you decide to set a scope for a permission, make sure you deselect **All Devices** for both the groups and tags options (targeting a specific device group won't do anything if **all devices** are still targeted in the tags dropdown!)

Note that the device group and tag dropdowns are only available for the permission categories relevant to physical devices.

## Assign user roles to SAML IdP groups
If you use SAML SSO, you can assign a role to a user based on the user groups in your IdP. [Learn more](https://support.controlup.com/docs/saml-sso-for-dex#assign-user-roles-to-idp-groups).

## Create a custom user role
To create a custom role and set permissions for the role:

1. Go to **Settings > Roles > New Role**.
2. Enter a **Name** and **Description**.
3. Select which permissions you want to add to the role.
4. If you want to limit permission scopes to only certain devices, add group and tag targets. Read [Limit permission scope to certain devices](/tim-reorg/docs/dex-platform-account-permissions#limit-permission-scope-to-certain-devices) above for details.

![User roles groups and tags](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/GroupsAndTags1%281%29.png)

5 Click **Save**.

## Manually assign a role to a user
To assign roles to a specific user:
1. Go to **Settings > User Settings**.
2. Click a user's name.
3. In the **Roles** dropdown, add or remove roles.
4. Click **Save**.

To assign a role to multiple users:
1. Go to **Settings > Roles**.
2. Click on a Role.
3. Go to the **Users** tab and click **Edit Users**.
4. Use the checkboxes to assign or unassign the role to each user.
5. Click **Save**.