Overview
Every Hub user has a platform role that controls what they can see and do across the entire workspace. There are five built-in roles. This article describes each role and how to change a user's role.
Built-In Roles
Owner
The highest level of access. Typically the MSP principal or the person who created the account.
Can do: Everything — manage users, change billing and payment methods, manage products and subscriptions, create and assign roles, view the audit log, manage org settings, apply bundles, deactivate or remove users.
Cannot do: Nothing is off-limits for an Owner. MFA is required to hold this role.
Admin
Full operational management without billing control.
Can do: Invite and manage users, change user roles, grant or revoke product access, create custom roles, view the audit log, manage org settings (name, logo, branding).
Cannot do: Change payment methods, cancel subscriptions, apply bundles, or access billing screens. Those actions require the Owner or Finance role.
Finance
Billing-only access.
Can do: View and download invoices, manage payment methods, view the current plan, manage billing alerts, access usage reports.
Cannot do: Manage users, change roles, access product settings, or change org configuration. MFA is required to hold this role.
Member
The default role for technicians and day-to-day staff.
Can do: Use the products they have been granted access to, based on their per-product role (for example, PSA Dispatcher or RMM Technician). View their own profile. Access their product modules.
Cannot do: Invite users, change roles, access billing, or modify org settings. Their product-level capabilities are controlled by the product roles assigned to them.
Viewer
Read-only access across everything they can see.
Can do: View data in products they have been given access to. No ability to create, edit, or delete anything.
Cannot do: Make any changes anywhere — this role is for observational access only.
Changing a User's Role
- Go to Settings → Users (
/settings/users). - Click the user's name to open their detail page.
- Find the Platform role field and select a new role from the dropdown.
- Click Save.
The change takes effect immediately. If the new role removes capabilities the user was relying on (for example, moving someone from Admin to Member), they will lose access to those features on their next page load.
Only Owners and Admins can change roles. An Admin cannot promote someone to Owner or change the role of the org's Owner.
Frequently Asked Questions
Can I have multiple Owners?
Yes. More than one user can hold the Owner role. Each org has exactly one designated account owner (the person who created the org), but additional users can be assigned the Owner role.
Can a Member see billing?
No. Billing screens require Owner or Finance role.
What is the difference between a platform role and a product role?
Platform roles (Owner, Admin, etc.) control access to Hub settings, users, and billing. Product roles (for example, PSA Dispatcher, RMM Admin) control what a user can do inside a specific product. A Member with no product role still has the correct platform access — they just cannot do product-specific actions.
Does changing someone's role end their current session?
No, but the role change takes effect on the user's next action. If the new role removes permissions, they will see access denied on their next request.