A default role is the baseline role from which all user roles are based. Configuring a default role enables you to set the permissions and privileges users automatically receive upon enrollment.


  1. Navigate to Devices > Device Settings > Devices & Users > General > Enrollment and select the Grouping tab.
  2. Configure a default level of access for end users in the Self-Service Portal (SSP) by selecting a Default Role.
    These role settings are customizable by organization group.
    • Full Access - Grants users with access to higher SSP functions such as install/remove profiles and apps, reset passcodes, send device messages, and write-access to content.
    • Basic Access - Grants users with a low impact access. They can register their own device, view-only (but not install) profiles and apps, view their own account, and query and find their own device.
    • External Access - Users with External Access have all the abilities as basic access users but they also have read-only access to content on the SSP that is explicitly shared with them.
  3. Select Save.