About Team Member Roles
Invite team members from Access: in the sidebar, select the Account Menu Button, then select Access. The account owner has full access like an administrator, but other administrators cannot remove that person or strip the role. Any Admin can reset the passkey for the Account Owner. The first account owner is created when the tenant is set up; ownership can later transfer to another admin. To change or remove users, see Modify or Remove Team Members.Access Levels
Account Owner
Full access to all functionality. Other team members cannot delete the Account Owner. Any Admin can reset the passkey for the Account Owner.A tenant’s first invitation goes to the Account Owner and stays valid for up to 14 days, as long as that Account Owner hasn’t signed in yet.
Administrator
Full access to all functionality. Accounts with this role can be deleted by other administrators.Additional administrators have 24 hours to activate their Iru account via email. If 24 hours pass before the account is created, an existing admin must resend the invitation from Access.
Standard
Same permissions as Administrator accounts without access to Settings.Help Desk
No access to Settings and read-only access to Blueprints and Library Items. Help Desk users can run all device actions, including deleting a device.Auditor
Limited read-only access to the Iru Web App.Secrets Auditor
Limited read-only access to the Iru Web App plus the ability to read:- macOS FileVault recovery keys
- Activation lock bypass codes
- Recovery lock password
- Device unlock PIN
Permissions Overview
View Local Admin Password (LAPS): This is the one device secret a Secrets Auditor cannot reveal. Displaying a LAPS password starts Automatically rotate after viewing (hours) only if a LAPS Library Item is assigned, so the permission is limited to Help Desk and higher.
Limited (Auditor): The Compliance agent runs, but control definitions are withheld. Linked actions and artifacts are still available. This matches Auditor access under Compliance Permissions (View controls is off).
Iru AI does not grant access beyond what the role already has in the web app. Device secrets (such as FileVault recovery keys) are not available through Iru AI for any role. When a question falls outside a role’s access, Iru AI says so and answers from documentation instead of returning partial data. For agent coverage and org-level enablement, see Iru AI Overview. For Compliance-only roles, see Compliance Permissions.
Web App Authorization & Session Duration
For security, team members must re-authenticate their Iru Web App session on a schedule, regardless of role.- Sign in at least once every 24 hours.
- After 60 minutes of inactivity, the session ends automatically.
Related Articles
- Compliance Permissions: roles and permissions in Iru Compliance, including Compliance-only roles that align with the access patterns above.
- Iru AI Overview: how Iru AI agents work and how to enable Iru AI for the organization.
- Configure the LAPS Library Item: rotate local administrator passwords, including who can reveal them and what happens on the device when they do.