Overview
Custom roles let Owners and Admins define a precise set of permissions beyond the five built-in roles. Use them when a built-in role grants too much or too little access for a specific team member or job function.
Creating a Custom Role
- Go to Settings → Roles (
/settings/roles). - Click New Role.
- Enter a name and optional description for the role.
- Set the scope:
- MSP Staff — for your own team members.
- Client Portal — for users in your managed clients' portals.
- In the permission tree, tick each permission you want to grant. Permissions are grouped by product and resource type (for example,
psa.ticket.create,rmm.device.remote_control). - Click Validate permissions to check for any conflicts or high-risk combinations before saving.
- Click Save role.
The role is now available to assign when inviting or editing users.
Alternatively, start from a template: go to the Templates tab on the Roles page, find a system template that is close to what you need, and click Clone. This creates a copy you can then edit.
Assigning Permissions
The permission tree groups everything by product. Expand a product to see its available permissions. Some permissions have a warning label — these are marked as sensitive because they grant powerful capabilities (for example, the ability to delete data or modify billing settings).
Tips:
- You can use wildcard grants within a product (for example, granting all ticket permissions at once). The Hub expands wildcards automatically.
- The Validate permissions button surfaces warnings if two permissions conflict or if a combination is flagged as unusual. Fix any issues before saving.
- Changing permissions on a saved role affects everyone already assigned to it. The change propagates within about 15 minutes, or immediately on the user's next sign-in.
Applying Custom Roles to Users
Once a custom role is saved:
- Go to Settings → Users and open the user's detail page.
- Change their Platform role dropdown to your custom role name, or assign it as a product role under a specific product.
- Click Save.
Custom roles appear in the same dropdown as built-in roles.
To assign a custom role during invite, select it in the Platform role field on the Invite user form.
Editing or Deleting a Custom Role
- Go to Settings → Roles and click the role name.
- Edit permissions and click Save — or click Delete role to remove it.
Deleting a role that is currently assigned to users will remove it from those users. Review who holds the role before deleting (the Roles detail page shows a count of users assigned to it).
Frequently Asked Questions
Can I create a role that only has access to one product?
Yes. Leave all other product permissions unchecked and only tick permissions for the product you want. Assign the user a platform role of Member and your custom product role.
Can custom roles override built-in role restrictions?
Custom roles work alongside platform roles, not instead of them. A user always has both a platform role (which controls Hub-level access) and can have additional custom or product-specific roles.
How long until a role change takes effect for users already signed in?
Permission cache updates within 15 minutes in the background, or immediately the next time the user signs in.
Who can create custom roles?
Owners and Admins only.