The Roles define what a user can see and do when he logs into the management console. This allows your to create users which can log in but have limited functionality.

The Super Root Role is a default Role which always is able to see and change everything. It cannot be changed or deleted. The Self Service Role is only able to see its own user and devices. You can combine Self Service and a custom role to e.g. allow users to login and enroll devices on their own and only for their user.

Custom Roles can manually be enabled or disabled. New Roles are disabled by default. Users with a disabled role work like they do not have the role. This allows you to e.g. temporarily restrict a given role from their actions.

All Permissions are split between “Read Access” and “Full Access”. Giving a Role Read Access allows them to see the specific part of the console. Giving them Full Access allows the Role to see and change the specific part of the console.