NMM Users and Roles at the MSP level – Nerdio Help Center

Applies to: Nerdio Manager for MSP (NMM)

Users and Roles Overview

Nerdio Manager for MSP allows you to grant users access to the NMM application with varying levels of permissions at the MSP level and customer account level. For example, you can create MSP Help Desk users that are able to view specific accounts and can log in to and manage those accounts. Or you can create MSP Billing Admins, who do not have account-level access but have full access to the Billing module. Admin access can optionally be configured to expire after a set number of days. You can create two types of roles in NMM:

Built-in roles: Built-in roles are roles with pre-defined access permissions that can't be changed by anyone
Custom roles: Custom roles are roles that can be customized as per your business needs

To view existing roles, navigate to Users & Roles >Definitions:

You can only edit built-in roles, but you can edit and remove access for custom roles.

To know the role of each user, navigate to Users & Roles >Assignments:

You can search roles by name or username or based on the role type. NMM allows you to edit and remove access for custom roles. You can only edit built-in roles but cannot delete them.

Built-in roles

The built-in roles that can be created in NMM are:

Super Admin: Can manage all accounts and all admins

MSP Admin: Can manage multiple customer accounts

MSP IT Admin: Can manage AVD host pools, servers, desktop images, backups on select accounts

MSP Help Desk: Can manage users, groups, and AVD user sessions on select accounts

MSP Billing Admin: Can view billing information for all accounts

Account Admin: Manages a single customer account

Account Help Desk: Can manage users, groups, and AVD user sessions on a single account

End-user: Can manage their own desktops

Role Permissions for built-in roles

The following chart details the permissions assigned to each user role:

Granting user access

To grant a user admin access, at the MSP level of NMM, click Users And Roles >Role Assignments. Click the Add button on the right side of the page.

Select a role, accounts (if relevant), add users or groups, and select an expiration for the access.

Note: You need to select the required Access Expiration time frame option (Never, 1 hour, 8 hours, 24 hours, 7 days, 30 days, 60 days, 90 days, 180 days) from the drop-down:

If you select Access expiration = 60 days, the Account admin role will be removed from the selected user after the selected timeframe (60 days). The "Unassign users and groups from app" task will run after 60 days and remove access as scheduled:

To remove multiple roles, navigate to Users And Roles >Role Assignments and click "Select All" and then click "Remove selected" button:

You can view all role assignment related tasks under "Role assignments tasks" section:

Custom roles

Nerdio Manager for MSP allows you to create fully customizable roles at MSP and account levels. To add a custom role, navigate to Users And Roles >Role Definitions and click "Add"button at the bottom right:

On the "Role definition add" page, enter name, description and select allowed and denied permissions for the role and click "Save" button:

Here's a demo about creating a custom role called "testest" that is created with "All" allowed permissions:

On the same page, you can view all role definitions related tasks under "Role definitions tasks" section:

Once you create a custom role, you need to assign it to a user. To assign custom role to a user, navigate to Users And Roles >Role Assignments page, select a user and click "Edit" button next to it: