mROC User Roles and Permissions

Qualys mROC (Managed Risk Operations Center) controls access through role-based access control (RBAC). A role is a set of permissions. Each permission grants access to one action, such as viewing customers, running bulk actions, or managing user accounts.

mROC provides 8 default roles. Assign one or more roles to each user account. The account receives every permission from all of its assigned roles. Each account also belongs to one user group, which determines the customers the account can access.

Default Roles

mROC has 8 default roles. These roles are system-defined and cannot be edited or deleted. When a default role does not match a job function, create a custom role.

1. Partner Administrator: Full access to all 27 mROC permissions, including customer, tag, bulk action, role, user, user group, activity log, and security settings management.
2. Access Administrator: Manages user accounts, roles, and user groups, including password resets and account activation. View-only access to customers, tags, bulk actions, activity logs, and security settings.
3. Practice Manager: Manages customers, tags, and bulk actions, including customer license details, customer reports, and customer SSO. View-only access to roles, users, user groups, activity logs, and security settings.
4. mROC Analyst: Views customers and customer licenses, downloads customer reports, signs in to customer accounts through SSO, and runs bulk actions. Also views users and activity logs.
5. Account Manager: View-only access to customers, customer licenses, tags, bulk actions, users, roles, user groups, activity logs, and security settings. Downloads customer reports.
6. Program Manager: Adds and updates customers, and creates, edits, and deletes tags. Downloads customer reports. View-only access to customer licenses, bulk actions, users, roles, user groups, activity logs, and security settings.
7. Audit Report User: Provides view-only access to customers, customer licenses, tags, bulk actions, bulk action jobs, users, roles, user groups, activity logs, and security settings. Downloads customer reports.
8. Customer API Only: Views the customer list and customer license details only.

Existing Manager accounts are migrated to the Partner Administrator role. Existing Sub Manager accounts are migrated to the mROC Analyst role.

User Roles Comparison

The mROC permissions are organized into 8 permission categories. The following table lists the permissions in each category and the default roles that include each permission:

Permission Categories	Description	Default Roles
		Partner Administrator	Access Administrator	Practice Manager	mROC Analyst	Account Manager	Program Manager	Audit Report User	Customer API Only
Manage Customers Permissions	View Customers	✔	✔	✔	✔	✔	✔	✔	✔
	View Customer Licenses	✔	N	✔	✔	✔	✔	✔	✔
	Delete Customers	✔	N	✔	N	N	N	N	N
	Download Reports	✔	N	✔	✔	✔	✔	✔	N
	Customer SSO	✔	N	✔	✔	N	N	N	N
	Manage Customers	✔	N	✔	N	N	✔	N	N
Tags Management Permissions	View Tags	✔	✔	✔	N	✔	✔	✔	N
	Manage Tags	✔	N	✔	N	N	✔	N	N
	Delete Tags	✔	N	✔	N	N	✔	N	N
Bulk Actions Permissions	View Bulk Actions	✔	✔	✔	✔	✔	✔	✔	N
	Manage Bulk Actions	✔	N	✔	N	N	N	N	N
	View Bulk Action Jobs	✔	✔	✔	✔	N	N	✔	N
	Run Bulk Actions	✔	N	✔	✔	N	N	N	N
	Delete Bulk Action Results	✔	N	✔	N	N	N	N	N
Roles Permissions	View Roles	✔	✔	✔	N	✔	✔	✔	N
	Manage Roles	✔	✔	N	N	N	N	N	N
	Delete Roles	✔	✔	N	N	N	N	N	N
Users Permissions	View Users	✔	✔	✔	✔	✔	✔	✔	N
	Manage Users	✔	✔	N	N	N	N	N	N
	Reset User Passwords	✔	✔	N	N	N	N	N	N
	Manage User Status	✔	✔	N	N	N	N	N	N
User Groups Permissions	View User Groups	✔	✔	✔	N	✔	✔	✔	N
	Manage User Groups	✔	✔	N	N	N	N	N	N
	Delete User Groups	✔	✔	N	N	N	N	N	N
Activity Logs Permissions	View Activity Logs	✔	✔	✔	✔	✔	✔	✔	N
Security and Compliance Permissions	View Security Settings	✔	✔	✔	N	✔	✔	✔	N
	Manage Security Settings	✔	N	N	N	N	N	N	N

Custom Roles

Create a custom role to grant a permission set that no default role provides. A custom role contains a name, an optional description, the selected permissions, and the assigned user accounts.

• The role name must be unique within the partner account.
• Creating and editing roles requires the Manage Roles permission.
• Deleting roles requires the Delete Roles permission. Deleting a role removes it from all assigned user accounts.
• Default roles are skipped when multiple roles are deleted together.

Default User Groups

A user group controls the customers that its members can access. A user group grants access to all customers or to the customers that match its tags. Each user account belongs to one user group. mROC provides 2 default user groups. These groups are system-defined and cannot be edited or deleted.

User Group	Customer Access	Migrated Accounts
System All Customers	All customers	Existing Manager accounts
System No Customers	No customers through the group	Existing Sub Manager accounts

Creating and editing user groups requires the Manage User Groups permission. Deleting a user group requires the Delete User Groups permission. When a user group is deleted, its members are no longer assigned to any user group.