---
title: "DEX Platform Account Permissions"
slug: "dex-platform-account-permissions"
tags: ["Users and Permissions"]
updated: 2026-08-21T11:51:09Z
published: 2026-08-21T11:51:09Z
canonical: "support.controlup.com/dex-platform-account-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set ControlUp Account Permissions

VDI & DaaS permissions

If you use ControlUp for VDI & DaaS, permissions in your VDI & DaaS environment are controlled separately from other ControlUp products. To learn how to set VDI & DaaS permissions, see [VDI & DaaS Permissions](/tim-reorg/docs/vdi-daas-permissions-1).

ControlUp uses role-based access control to assign permissions. This means that you assign permissions to roles, and then assign roles to users. A user can have multiple roles, and they can perform a certain action if at least one of their roles includes the relevant permission.

## Limit permission scope to certain devices

You can set the scope for a permission so that it applies only to certain managed physical devices. For example, you can give a help desk employee permission to remote control devices in the HR department, but not allow them to remote control devices used by senior executives.

Set the scope of a permission by targeting device groups, device tags, or a combination of both. The permission applies to a device only if the device is in one of the specified groups **OR** has at least one of the specified tags.

![PermissionScoping.png](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/PermissionScoping.png)

By default, all groups and all tags are targeted, which means that the permission applies to every device in your environment.

Note that the device group and tag dropdowns are available only for the permission categories relevant to physical devices.

## Assign user roles to SAML IdP groups

If you use SAML SSO, you can assign a role to a user based on the user groups in your IdP. [Learn more](https://support.controlup.com/docs/saml-sso-for-dex#assign-user-roles-to-idp-groups).

## Create a custom user role

To create a custom role and set permissions for the role:

1. Go to **Settings > Roles > New Role**.
2. Enter a **Name** and **Description**.
3. Select which permissions you want to add to the role.
4. If you want to limit permission scopes to only certain devices, add group and tag targets. Read [Limit permission scope to certain devices](/tim-reorg/docs/dex-platform-account-permissions#limit-permission-scope-to-certain-devices) above for details.
5. Click **Save**.

## Manually assign a role to a user

To assign roles to a specific user:

1. Go to **Settings > User Settings**.
2. Click a user's name.
3. In the **Roles** dropdown, add or remove roles.
4. Click **Save**.

To assign a role to multiple users:

1. Go to **Settings > Roles**.
2. Click on a Role.
3. Go to the **Users** tab and click **Edit Users**.
4. Use the checkboxes to assign or unassign the role to each user.
5. Click **Save**.