A mobile role defines which devices, or Spots, a user can view and work with. Create or edit the role in the browser as an administrator in the account where the user needs to work. The user must have a mobile user account in that account before you can add them to the role.
The role's permissions apply to all its users. If only one user needs different permissions, assign them a separate role. Permissions granted by the user's different roles are combined.
Open the role and select users
- In the browser menu, open Manage user accounts → User roles.
- Select Create new mobile user role at the top of the page. To open an existing mobile role, click its name or the pencil icon on its row.
- Enter the Name of the role and a description if needed. An existing role's settings are on the Mobile user role tab.
- Open the Users section of the form. Use the transfer buttons between the lists to move the people who belong to the role from Kaikki mobiilikäyttäjät to Selected users. You can search for a user by name or email address. To remove a member, move them back to the list on the left.
Select folders and the required permissions
In the Access rights to folders and their contents section of the form, select Role grants permissions for folders and other content. The Select folders to add permissions into table opens below it.
Expand a folder's subfolders using the arrow next to its name. Select a permission by clicking the plus icon where that folder's row intersects with the permission column. A selected permission appears as a check mark; click it to clear the selection. Above the table, you can search for a folder or filter the view using Show only the selected folders. These filters change the table view, not the permissions.
| Column group | Effect of the permissions |
|---|---|
| Folders and Spots | Read allows users to view the folder's Spots. Edit allows users to change a Spot's details and add Spots to the folder. Also select Read if the user needs to open a Spot's details. Edit alone does not grant permissions for messages or attachments. |
| Messages and reservations | Read allows users to view messages. Create allows users to add messages and create and edit Spot reservations. Broader reservation permissions are also defined separately on the Permissions for Reservations row. |
| Attachments | Read allows users to view attachments for the Spot and folder. Create allows users to add them. Create does not grant a general permission to delete files. |
The Select all column selects the row's read, edit and create permissions together. It does not enable the Tag read only restriction. Clicking a selected Select all icon clears the row's selections.
Permissions granted for a folder also cover its subfolders and their Spots. If the user needs access to only one subfolder, grant permission directly to that subfolder. Permission granted for a parent folder cannot be overridden by leaving the subfolder's permission unselected.
Permissions from different roles are also combined. If another role grants read or edit permission for the same folder, clearing the selection in this role does not remove the user's permission. Check all the user's mobile roles when restricting access.
When should I use the Tag read only restriction?
Tag read only restricts the visibility of Spots in lists and searches when access is granted through this folder permission. The user can open a Spot using its attached NFC or QR tag if they have been granted Folders and Spots → Read permission for that folder.
First select the required folder and content permissions, then select Tag read only on the same row. The tag restriction cannot be selected without other permissions. Reading a tag does not grant access to a Spot for which the user has no read permission.
Despite its name, Tag read only does not turn other granted permissions into view-only access. In a Spot opened using a tag, the user can, for example, edit details or add messages and files if those permissions are selected. If another role grants ordinary read permission for the same Spot, the Spot may also appear in lists.
For tag reading methods, see Opening a Spot using an NFC or QR tag.
Set other feature permissions separately
Below the folder table is the Roolin muut oikeudet ominaisuuksiin section. It defines separate permissions for reservations, warehouses, products, customers, contacts and vendors. Read means viewing information, Create means adding new information, Edit means changing existing information, and Delete means deleting information in functions where that option is available.
Select role template fills in the permission selections in this section according to a predefined template. The template does not replace the settings in the folder table. After applying a template, check every required permission row and warehouse selection.
Permissions for Reservations defines separate create, read, edit and delete permissions for reservation sites and reservations. Creating and editing a Spot reservation requires Messages and reservations → Create permission in the folder table. Folder edit permission alone does not grant it.
Permissions for Products and Permissions for Warehouses are set separately. Warehouse permissions alone do not grant permission to view, create or edit products. On the Permissions for Products row, select the required Create, Read and Edit permissions. Delete cannot be selected for products. Product read permission also grants access to the product's files. Product and warehouse functions require the warehouse feature to be enabled for the account.
Product create, read and edit permissions matching the warehouse permissions have been transferred to existing mobile roles. This was a transfer of existing permissions; the permission rows do not follow each other when later changes are made. Check both when editing a role.
On Android and iOS, the button for adding a new product to the product list also requires Permissions for Warehouses → Create permission to be visible. Saving a product still requires product create permission. If the add button is missing, check both permissions.
Use the dropdown on the Permissions for Warehouses row to select the warehouses the role can access. Warehouse Read permission is required to view warehouse information, and Edit is required for warehouse events such as inventory, purchases, sales and transfers. Check both the permissions and the selected warehouses: saving an existing role clears its warehouse permissions if no warehouses are selected in either warehouse dropdown.
Transfer From only warehouses is a separate warehouse selection for restricted transfer use. Selecting a warehouse on this row alone does not grant permission for warehouse events; warehouse read permission and the edit permission that allows transfers are also required. Do not use this row as a substitute for full warehouse management, and check the permissions the user receives from other roles.
Distinguish access permissions from work responsibilities
In the Responsibilities and rights in Tasks and Service Requests section of the form, selecting Role functions as a responsible for tasks and/or service request makes the role available for selection as a responsible role. This alone does not grant access to Spots in the folder tree. The same role can act as both a responsible role and a role that grants folder permissions; at least one of these purposes must be selected.
Being assigned to a task can grant separate permissions for that task. If you want task permissions to be based on the Spot's folder, open Settings → Task settings in the browser, then open Visibility of tasks to non-responsible parties. Its form includes Show tasks based on folder permissions: when enabled, folder read permission allows users to view tasks, and edit permission also allows them to change tasks. The same form can extend task visibility based on status. Tasks in planning and tasks with no assignee are still restricted separately.
Visibility and handling of service requests also depend on the service request type's responsible role, mobile observers, and the settings for open requests and requests that are On hold. Being able to see a folder alone does not grant all service request permissions. See configuring service request visibility and permissions.
Save and check the user's actual permissions
Save a new role using the Create new mobile user role button at the bottom of the form, or an existing role using Save. Wait for the notification confirming that saving was successful.
If you clear Role grants permissions for folders and other content and save, the role's folder permissions are removed and the separate feature permissions in the form are cleared. Folder permissions must be configured again if you later restore the role's permission-granting purpose. Removing permissions does not delete the Spots themselves or their content.
Changing the role's members may update, in the background, the assignees of unfinished tasks and group tasks that follow the role, as well as assignee information in operating-hour maintenance templates and offers. It may also add or remove resourcing information that follows the role in tasks, task templates and contracts. Check these items after changing membership. Removing the last user may be prevented if the role is needed in work or resourcing settings. Clearing the responsible role selection is prevented if the role still has tasks or service requests that are not completed.
- Open the mobile app using the user's own credentials. Check that the correct account is selected; if needed, see switching accounts in the mobile app.
- On Android or iOS, select Home → Browse folders and spots. Check the folder for which access was granted, and also open a Spot in one of its subfolders.
- If you use the Tag read only restriction, check both that the Spot is absent from the list and that it opens using a tag. Take into account any ordinary read permission granted by other roles.
- From the Spot's details, open the required Messages, Reservations and Files functions. Verify viewing and the required add or edit function using agreed test content. Reopen the saved information to confirm the result.
- Separately check the required task or service request, as well as product and warehouse functions. If a permission remains in effect after it has been removed, check the user's other roles.