Overall Security tab (roles)

Enables the permission to manage all security entries on this part of the system.

Enables users to connect to the Management Server.

This permission is enabled by default.

You can temporarily deny connection permission on roles for maintenance purposes, and then reapply access to the system.

This permission must be selected to allow access to the system.

This permission is a highly privileged administrative permission that gives significant access rights to the XProtect VMS, including access to sensitive data such as credentials configured in the system.

Enables the permission to access a wide range of functionality, including:

• Logging in with the Management Client
• List of current tasks
• Server logs

It also enables access to:

• Remote Connect Services
• Smart Client Profiles
• Management Client Profiles
• Matrix
• Time Profiles
• Registered Servers and Service Registration API

This permission also reveals some sensitive information to the client:

• Credentials for any configured external IDP
• Credentials, IP-addresses, and other information for all cameras in the XProtect VMS
• Credentials for configured mail server
• Credentials for any configured Matrix
• Credentials configured for the Milestone Interconnect feature
• Credentials configured for license activation

This permission does not reveal credentials for users of the XProtect VMS. This includes Basic Users, Windows users and users from external IDPs.

Enables the permission to modify data in a wide range of functionality, including:

• Options
• License Management

It also enables users to create, delete, and edit the following:

• Remote Connect Services
• Device groups
• Matrix
• Time Profiles
• Notification Profiles
• Registered Servers

Enables the permission to configure local IP ranges when configuring the network on the recording server.

Enables the permission to perform queries on the Status API located on the recording server. This means that the role with this permission enabled has access to read the status of the items located on the recording server.

Enables the permission to add and detach the current site to other sites in a federated site hierarchy.

If you set this permission to allowed on the child site only, the user can still detach the site from the parent site.

Enables the permission to create backups of the system configuration using the system's backup and restore functionality.

Enables the permission to authorize users when they are asked for a second login in XProtect Smart Client or Management Client. You define if a role requires login authorization on the Info tab.

Enables the permission to manage permissions for the Management Server.

It also enables users to create, delete, and edit the following features:

• Roles
• Basic users
• Smart Client Profiles
• Management Client Profiles

Enables the permission to manage all security entries on this part of the system.

Enables the permission to edit properties on the recording servers, except for network configuration settings that require edit permission on the management server.

Enables the permission to delete recording servers. To do this, you must also give the user delete permissions on:

• Hardware security group if you have added hardware to the recording server

If any of the devices on the recording server contains evidence locks, you can only delete the recording server if it is offline.

Enables the permission to add hardware on recording servers.

Enables the permission to administrate storage containers on recording server, that is, to create, delete, move, and empty storage containers.

Enables the permission to manage security permissions for recording servers.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to see and access failover servers in the Management Client.

Enables the permission to create, update, delete, move, and enable or disable failover servers in the Management Client.

Enables the permission to manage security permissions for the failover servers.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to see and access mobile servers in the Management Client.

Enables the permission to edit and delete mobile servers in the Management Client.

Enables the permission to manage security permissions for the mobile servers.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to edit properties on hardware.

Enables the permission to delete hardware.

If any of the hardware devices contains evidence locks, you can only delete the hardware if the recording server is offline.

Enables the permission to send special commands to the drivers and thereby control features and configuration on the device itself.

The Driver commands permission is for special developed MIP plug-ins in the clients only. It does not control standard configuration tasks.

Enables the permission to manage security permissions for the hardware.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view camera devices in the clients and the Management Client.

Enables the permission to edit properties for cameras in the Management Client. It also enables users to enable or disable a camera.

Enables the permission to view live video from cameras in the clients and the Management Client.

Enables the permission to view live restricted video from cameras in the clients and the Management Client.

Enables the permission to play back recorded video from cameras in all clients.

Enables the permission to play back recorded restricted video from cameras in all clients.

Enables the permission to retrieve recordings in the clients from cameras on remotes sites or from edge storages on cameras.

Enables the permission to read the sequence information related to, for example, playing back recorded video in the clients.

Enables the permission to use the Smart search function in the clients.

Enables the permission to export recordings from the clients.

Enables the permission to create bookmarks in recorded and live video in the clients.

Enables the permission to search for and read bookmark details in the clients.

Enables the permission to edit bookmarks in the clients.

Enables the permission to delete bookmarks in the clients.

Enables the permission to create and extend evidence locks in the clients.

Enables the permission to search and read evidence locks in the clients.

Enables the permission to delete or reduce evidence locks in the clients.

Enables the permission to create and extend restrictions in the clients.

Enables the permission to see a list of existing restrictions in the clients.

Enables the permission to delete and reduce restrictions in the clients.

Enables the permission to start manual recording of video in the clients.

Enables the permission to stop manual recording of video in the clients.

Enables the permission to use auxiliary (AUX) commands on the camera from the clients.

AUX commands offer users the control of, for example, wipers on a camera connected via a video encoder. Camera-associated devices connected via auxiliary connections are controlled from the client.

Enables the permission to use PTZ functions on PTZ cameras in the clients and the Management Client.

Enables the permission to move PTZ cameras to preset positions, start and stop patrolling profiles, and pause a patrolling in the clients and the Management Client.

To allow this role to use other PTZ functions on the camera, enable the Manual PTZ permission.

Enables the permission to add, edit, and delete PTZ presets and patrolling profiles on PTZ cameras in the clients and the Management Client.

To allow this role to use other PTZ functions on the camera, enable the Manual PTZ permission.

Enables the permission to lock and unlock PTZ presets in the Management Client. This prevents or allows other users from changing preset positions in the clients and in the Management Client.

Enables the permission to set PTZ cameras in reserved PTZ session mode in the clients and the Management Client.

In a reserved PTZ session, other users with higher PTZ priority are not able to take over the control.

To allow this role to use other PTZ functions on the camera, enable the Manual PTZ permission.

Enables the permission to release other users' PTZ sessions from the Management Client.

You can always release your own PTZ sessions - without this permission.

Enables the permission to delete stored video recordings from the system via the Management Client.

Enables the permission to temporarily lift privacy masks in XProtect Smart Client. It also enables the permission to authorize other XProtect Smart Client users to lift privacy masks.

Lifting privacy masks only applies to privacy masks configured as liftable privacy masks in the Management Client.

Enables the permission to manage security permissions in the Management Client for the camera.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view microphone devices in the clients and the Management Client.

Enables the permission to edit microphone properties in the Management Client. It also allows users to enable or disable microphones.

Enables the permission to listen to live audio from speakers in the clients and the Management Client.

Enables the permission to listen to live restricted audio from speakers in the clients and the Management Client.

Enables the permission to play back recorded audio from microphones in the clients.

Enables the permission to play back recorded restricted audio from microphones in the clients.

Enables the permission to retrieve recordings in the clients from microphones on remotes sites or from edge storages on cameras.

Enables the permission to read the sequence information related to, for example, the Playback tab in the clients.

Enables the permission to export recordings from the clients.

Enables the permission to create bookmarks in the clients.

Enables the permission to search for and read bookmark details in the clients.

Enables the permission to edit bookmarks in the clients.

Enables the permission to delete bookmarks in the clients.

Enables the permission to create or extend evidence locks in the clients.

Enables the permission to search and read evidence lock details in the clients.

Enables the permission to delete or reduce evidence locks in the clients.

Enables the permission to create and extend restrictions on microphones in the clients.

Enables the permission to see a list of existing restrictions on microphones in the clients.

Enables the permission to delete and reduce restrictions on microphones in the clients.

Enables the permission to start manual recording of audio in the clients.

Enables the permission to stop manual recording of audio in the clients.

Enables the permission to delete stored recordings from the system.

Enables the permission to manage security permissions in the Management Client for microphones.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view speaker devices in the clients and the Management Client.

Enables the permission to edit properties for speakers in the Management Client. It also allows users to enable or disable speakers.

Enables the permission to listen to live audio from speakers in the clients and the Management Client.

Enables the permission to listen to live restricted audio from speakers in the clients and the Management Client.

Enables the permission to speak through the speakers in the clients.

Enables the permission to play back recorded audio from speakers in the clients.

Enables the permission to play back recorded audio from speakers in the clients.

Enables the permission to retrieve recordings in the clients from speakers on remotes sites or from edge storages on cameras.

Enables the permission to use the Sequences feature while browsing recorded audio from speakers in the clients.

Enables the permission to export recorded audio from speakers in the clients.

Enables the permission to create bookmarks in the clients.

Enables the permission to search for and read bookmark details in the clients.

Enables the permission to edit bookmarks in the clients.

Enables the permission to delete bookmarks in the clients.

Enables the permission to create or extend evidence locks to protect recorded audio in the clients.

Enables the permission to view recorded audio protected by evidence locks in the clients.

Enables the permission to delete or reduce evidence locks on protected audio in the clients.

Enables the permission to create and extend restrictions on speakers in the clients.

Enables the permission to see a list of existing restrictions on speakers in the clients.

Enables the permission to delete and reduce restrictions on speakers in the clients.

Enables the permission to start manual recording of audio in the clients.

Enables the permission to stop manual recording of audio in the clients.

Enables the permission to delete stored recordings from the system.

Enables the permission to manage security permissions in the Management Client for speakers.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to receive metadata in the clients.

Enables the permission to edit metadata properties in the Management Client. It also allows users to enable or disable metadata devices.

Enables the permission to receive live metadata from metadata devices in the clients.

Enables the permission to play back recorded data from metadata devices in the clients.

Enables the permission to retrieve recordings in the clients from metadata devices on remotes sites or from edge storages on cameras.

Enables the permission to read the sequence information related to, for example, the Playback tab in the clients.

Enables the permission to export recordings in the clients.

Enables the permission to create evidence locks in the clients.

Enables the permission to view evidence locks in the clients.

Enables the permission to delete or reduce evidence locks in the clients.

Enables the permission to create and extend restrictions on metadata in the clients.

Enables the permission to see a list of existing restrictions on metadata in the clients.

Enables the permission to delete and reduce restrictions on metadata in the clients.

Enables the permission to start manual recording of metadata in the clients.

Enables the permission to stop manual recording of metadata in the clients.

Enables the permission to delete stored recordings from the system.

Enables the permission to manage security permissions in the Management Client for metadata.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view input devices in the clients and the Management Client.

Enables the permission to edit properties for input devices in the Management Client. It also enables users to enable or disable an input device.

Enables the permission to manage security permissions in the Management Client for input devices.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view output devices in the clients.

Enables the permission to edit properties for output devices in the Management Client. It also enables users to enable or disable an output device.

Enables the permission to activate outputs in the clients.

Enables the permission to manage security permissions in the Management Client for output devices.

Enables the permission to manage all security permissions in XProtect Management Client.

Enables the permission to view a video wall in XProtect Smart Client.

Enables the permission to edit properties for the Smart Wall definition in XProtect Management Client.

Enables the permission to delete existing Smart Wall definitions in XProtect Management Client.

Enables the permission to activate and modify Smart Wall definitions, for example to change and activate presets or apply cameras on views in XProtect Smart Client and in XProtect Management Client.

You can associate Operate with time profiles that define when the user permission applies.

Enables the permission to create new Smart Wall definitions in XProtect Management Client.

Enables the permission to manage security permissions in XProtect Management Client for the Smart Wall definition.

Enables the permission to play back recorded data from a video wall in XProtect Smart Client.

You can associate Playback with time profiles that define when the user permission applies.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view View Groups in the clients and in the Management Client. View groups are created in the Management Client.

Enables the permission to edit properties on the View Groups in the Management Client.

Enables the permission to delete View Groups in the Management Client.

Enables the permission to use View Groups in XProtect Smart Client, that is, to create and delete subgroups and views.

Enables the permission to create View Groups in the Management Client.

Enables the permission to manage security permissions in the Management Client for View Groups.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view user-defined events in the clients.

Enables the permission to edit properties on user-defined events in the Management Client.

Enables the permission to delete user-defined events in the Management Client.

Enables the permission to trigger user-defined events in the clients.

Enables the permission to manage security permissions in the Management Client for user-defined events.

Enables the permission to create new user-defined events in the Management Client.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view analytics events in the Management Client.

Enables the permission to edit properties on analytics events in the Management Client.

Enables the permission to manage security permissions in the Management Client for analytics events.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view generic events in the clients and the Management Client.

Enables the permission to edit properties on generic events in the Management Client.

Enables the permission to manage security permissions in the Management Client for generic events.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to select and send video to the Matrix recipient from the clients.

Enables the permission to edit properties for a Matrix in the Management Client.

Enables the permission to delete a Matrix in the Management Client.

Enables the permission to create a new Matrix in the Management Client.

Enables the permission to manage security permissions in the Management Client for all Matrix's.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view existing rules in the Management Client.

Enables the permission to edit properties for rules and to define rule behavior in the Management Client.

It also requires that the user has read permissions on all the devices that are impacted by the rule.

Enables the permission to delete rules from the Management Client.

It also requires that the user has read permissions on all devices that are impacted by the rule.

Enables the permission to create new rules in the Management Client.

It also requires that the user has read permissions on all devices that are impacted by the rule.

Enables the permission to manage security permissions in the Management Client for all rules.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view other sites in the Management Client. Connected sites are connected via Milestone Federated Architecture.

To edit properties, you need Edit permissions on the Management Server on each site.

Enables the permission to manage security permissions on all sites.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view system monitors in XProtect Smart Client.

Enables the permission to edit properties for system monitors in the Management Client.

Enables the permission to manage security permissions in the Management Client for all system monitors.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to manage alarms in the Smart Client. For example, changing priorities of alarms, re-assigning alarms to other users, acknowledging alarms, changing the alarm state of multiple alarms (for example from New to Assigned). To edit alarm settings, you also need the Edit alarm settings permission.

Only when you set this to allowed does the Alarms and Events tab in the Options dialog appear.

Enables the permission to view the Alarm Manager tab in XProtect Smart Client and retrieve alarms and alarm settings through the API.

To view alarms in XProtect Smart Client, you must enable the View permission for at least one alarm definition. You view alarms from third-party solutions by default.

Enables the permission to disable alarms.

Enables the permission to manage security permissions for alarms.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view alarm definitions, alarm states, alarm categories, alarm sounds, alarm retention, and event retention.

Enables the View permission.

Enables the permission to manage security permissions for alarm definitions.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view the Metadata Use functionality in Management Client and its related settings, but does not enable the permission to change the settings.

Enables the permission to enable or disable metadata search categories, for example metadata for people or vehicles, in the Management Client.

Enables the permission to manage security permissions for metadata searches.

Enables the permission to manage security permissions in the Management Client for search.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to manage security permissions for alarms.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view properties for the Transaction sources in the Management Client.

Enables the permission to edit properties for the Transaction sources in the Management Client.

Enables the permission to manage security permissions in the Management Client for all Transaction sources.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to view properties for the Transaction definitions in the Management Client.

Enables the permission to edit properties for the Transaction definitions in the Management Client.

Enables the permission to manage security permissions in the Management Client for all Transaction definitions.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to edit properties for the Access Control systems in the Management Client.

Enables the permission to manage security permissions for all Access Control systems.

Enables the permission to manage all security entries on this part of the system.

Currently not in use.

Allows the user to use the Privacy Blur feature in XProtect Smart Client.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to use any LPR-related features in the clients

Manage match lists

Enables the permission to add, import, modify, export, and delete match lists in the Management Client.

Enables the permission to view match lists.

Enables the permission to manage security permissions in the Management Client for LPR.

Enables the permission to manage all security entries on this part of the system.

Enables the permission to edit properties for webhooks in the Management Client.

Enables the permission to view properties for webhooks in the Management Client.

Enables the permission to manage security permissions in the Management Client for all webhooks.