Admin Roles and Permissions

Enpass Business includes three administrator roles — Super Admin, Admin, and Recovery Admin — each with a different scope of access.

Super Admin

The first admin created in your organization is automatically a Super Admin. Super Admins have unrestricted access to all areas of the Admin Console and can designate other Super Admins.

A Super Admin can:

• Manage users

• Manage groups

• Manage other administrators

• Manage policies

• Manage branding and billing

• Manage user provisioning via IdP

• Manage single sign-on

For accounts using Microsoft 365 or Google Workspace for data storage, Super Admins can additionally:

• Manage integrations with SIEM tools

• Manage Vault Sharing in the organization

• Access Security Audit

• Access Event Logs

• Manage Recovery Admins (see note below)

Why Super Admins should also be Recovery Admins

Super Admins do not automatically receive Recovery Admin privileges and this must be assigned separately. It is strongly recommended that all Super Admins are designated as Recovery Admins, and that your organization maintains more than one Recovery Admin at all times.

If your sole Recovery Admin loses access or leaves the organization, employee access recovery becomes impossible. Only a Super Admin who is also a Recovery Admin can add or remove other Recovery Admins, making this a critical safeguard.

Admin

Standard Admins have access to day-to-day user and policy management, but cannot manage other admins or access billing and advanced settings.

An Admin can:

• Manage users

• Manage groups

• Manage policies

Recovery Admin

The Recovery Admin role is designed specifically to handle employee access recovery. This role can be assigned to any admin or trusted user.

A Recovery Admin can:

• Review and approve Master Password reset requests from users (except their own)

This role is separate from Super Admin and must be assigned explicitly. Having multiple Recovery Admins is essential — if only one exists and they become unavailable, no one will be able to process recovery requests.

Read more about Access Recovery →

Related Topics

• Managing Admin Accounts

• Recovery Admins