Changing an Employee’s Access Level

Only an Administrator can change a user’s access level. To change it:

1. From the main menu, select Employees.

2. Click the name of the employee in the list.

3. Click the Edit button at the top right to open the Edit Profile panel.

4. Click the Account tab.

5. Select an access level from the Access Level drop-down menu.

6. Click Apply Changes.

Access Level Versus Access Control

Access levels are built-in roles that control which core features a user can see and use. They are predefined and cannot be changed.

Access Control lets you create custom, granular permission policies for non-admin users, such as regular employees. With these policies, you can define exactly which data and actions a user can view or perform. To learn more, see Zero Trust Security: How to implement access control policies in Teramind.

Access Levels Explained

The Access Level drop-down has four built-in access levels:

Administrator: Full access to everything.
Operational Administrator: Manages users and settings but cannot view monitoring data.
Infrastructure Administrator: Manages system settings only.
Employee: Sees only their own data, as allowed by an Administrator.

Two other types of access are set up elsewhere:

Department Manager: An Employee who is assigned as a manager of a department in Configurations > Departments. They can see the data of the employees in the departments they manage.
Employee With Access Control Policies: An Employee who is assigned custom permissions in Configurations > Access Control.

The access levels are prioritized as follows:

Administrator
Operational Administrator
Infrastructure Administrator
Department Manager
Employee with Access Control policies
Employee

Each user has only one access level. If you give a Department Manager or an Employee with Access Control policies one of the administrator access levels, the administrator access level replaces their previous permissions. If a Department Manager is also assigned Access Control policies, the Access Control policies apply and the Department Manager permissions do not.

Access by Menu Item

The table below shows what each access level can access, organized by the main menu. Click a menu item to open its article in the User Guide.

See the legend and footnotes below the table for what each value means.

Menu Item	Admin	Ops Admin	Infra Admin	Dept. Manager	Employee⁷
Insights⁶	Yes	Yes	Yes	No	No
Dashboards	Yes	No	No	Dept.	No
Employees	Yes	Limited	No	Dept.¹	No
Computers	Yes	Limited	No	Dept.¹	No
OCR⁶	Yes	No	No	Dept.	No
Time Worked	Yes	No	No	Dept.	Own²
Time Tracking
Time Cards	Yes	No	No	Dept.	No
Time Records	Yes	No	No	Dept.	No
Employee Cost	Yes	No	No	Dept.	No
Task Cost	Yes	No	No	Dept.	No
Configurations
Shared Lists	Yes	Yes	Yes	No	No
Behavior Policies	Yes	Yes	No	No	No
Access Control	Yes	No	No	No	No
Monitoring Profiles	Yes	Yes	Yes	No	No
Productivity Profiles	Yes	Yes	No	No	No
Departments	Yes	Yes	No	No	No
Settings	Yes	Yes	Limited	Limited	No
Schedules	Yes	Yes	No	No	No
Positions	Yes	Yes	No	No	No
Tasks	Yes	Yes	No	No	No
Locations	Yes	Yes	No	No	No
System
Download Agent	Yes	Yes	Yes	Limited³	Limited³
Video Exports	Yes	No	No	Own⁴	No
Dashboard Exports	Yes	Own	No	Own⁴	No
Integrations	Yes	Yes	Yes	No	No
System Log	Yes	No	No	Dept.	No
My Account	Yes	Limited	Limited	No	No
Other Features
Session Player	Yes	No	No	Dept.	Own⁵
My Profile	Yes	Yes	Yes	Yes	Yes
Issues (Notification Dashboard)	Yes	Yes	No	No	No

Legends:

Yes: Full access.
No: No access. The menu item is hidden.
Dept.: Only the data of employees in the departments the user manages.
Own: Only the user’s own data or items.
Limited: Partial access. See the section for that access level below.

Footnotes:

View only, cannot add/edit.
Hidden if Disable Self Productivity Report is checked in the employee’s profile. To change it, go to Employees, open the employee, click Edit and open the Account tab. See Employees: Permissions.
Revealed Agent only. See How to download and install the Teramind Agent.
Only if Allow department managers to see and execute report is turned on in Configurations > Settings, on the Security tab. If it is turned off, managers cannot export reports. See Configurations > Settings: Data Export.
Only their own past recordings, and only if Allow self-history playback is checked in the employee’s profile (Edit > Account tab). Live view is not available. See Employees: Permissions.
Insights and Integrations may not be available on all accounts. OCR depends on your plan.
An Employee who is assigned Access Control policies can also access the menu items and data those policies grant, in addition to what is shown in the Employee column.

Permissions by Access Level

Administrator

The most powerful access level. Administrators can monitor all employees and other administrators, and change any setting without restrictions. Only Administrators can change a user’s access level and see the support PIN in My Account. To learn more, see How to add an administrator or change a user’s role to administrator.

Operational Administrator

Operational Administrators can manage users and global settings but cannot view monitoring data, such as dashboards, screen recordings, Time Worked or Time Tracking.

My Profile: Can edit all information on their profile except their access level, even if Disable Self Edit is checked on their Account tab.
Employees: Can add employees with the Employee access level only. Can edit employee profiles at the same access level or lower. For higher access levels, they can see the Personal and Account tabs but cannot edit them. Cannot change any user’s access level. Cannot view an employee’s activity.
Computers: Can manage computers but cannot view a computer’s activity.
Configurations: Full access to everything except Access Control, including creating, renaming and assigning productivity profiles.
Configurations > Settings: Can only see the access tokens they created on the Access Tokens tab.
System: Can download the Agent, use Integrations, and see and download only their own dashboard exports. No access to Video Exports or System Log.
My Account: Can open My Account but cannot see or renew the support PIN.
Issues (Notification Dashboard): Full access.

Infrastructure Administrator

Infrastructure Administrators manage the system setup only. They cannot see employees or computers, monitoring data, screen recordings or productivity data. They can download the Agent, manage the subscription (cloud accounts), and change global and monitoring settings.

My Profile: Can edit their name, email, phone and avatar if Disable Self Edit is unchecked on their Account tab. Can always change their password and two-factor authentication.
Configurations: Shared Lists and Monitoring Profiles only.
Configurations > Settings: Can access all tabs except Access Tokens.
System: Can download the Agent and use Integrations. No access to Video Export, Dashboard Export, and System Log.
My Account: Can open My Account but cannot see or renew the support PIN.

Department Manager

Department Manager is not an Access Level you can set from an employee's profile. You make an employee a Department Manager by adding them as a manager of a department in Configurations > Departments. Any employee who does not have an administrator access level can be a Department Manager.

Department Managers see most of what an Administrator sees, but only for the employees in the departments they manage. If you give a manager an administrator access level, that access level replaces their Department Manager permissions.

My Profile: Can edit their name, email, phone and avatar if Disable Self Edit is unchecked on their Account tab.
Dashboards, OCR, Time Worked and Time Tracking: Can access all of them, but only see the data of employees in their departments. Can create and clone dashboards.
Session Player: Can play recordings of employees in their departments.
Employees: Can see the employees in their departments and their activity. Cannot add, edit or delete employees, view or edit their profiles, or perform actions such as locking or turning monitoring on or off.
Computers: Can see the computers of employees in their departments and their activity. Cannot see “Last Employees” or the Agent type (Stealth or Revealed) on the computer details screen. Cannot edit computers or perform actions such as locking or turning monitoring on or off.
Configurations: No access, except the Access Tokens tab in Settings, where they can only see the access tokens they created. Department Managers cannot open Departments or Tasks.
System: Can download the Revealed Agent only. Can see and download their own video and dashboard exports, unless the Allow department managers to see and execute report option is disabled. Can see the System Log for their departments.

Employee

Employees can see their own data and manage their own profile, only as allowed by an Administrator. When an employee logs in, they land on Time Worked, which shows only their own data. Their menu shows Time Worked and System > Download Agent (Revealed Agent only). They can also open My Profile to change their own details if Disable Self Edit is unchecked (see below).

Administrators control what an employee can do with these options on the employee’s profile Account tab (see Employees: Permissions):

User Can Login to Teramind Dashboard: Lets the employee log in to the dashboard at all.
Disable Self Productivity Report: When checked, hides Time Worked from the employee.
Allow Self-History Playback: When checked, the employee can play back recordings of their own past activity from Time Worked. They cannot use live view.
Disable Self Edit: When checked, the employee cannot edit their own name, email, phone or avatar.
User Can Clock In and Out Using Web Interface: Lets the employee clock in and out from the dashboard instead of the Agent.
Can See Own Online Presence: Lets the employee see their own online status.
Disable Daily Digest Report: When checked, the employee does not receive the daily digest email. See What is the daily snapshot / digest email? How can I configure it?
Allow Viewing Activity Reports, Disable Self Session Report and Disable Self Snapshots Report: These control the employee’s own Activity, Session and Snapshots reports.

Security Risks of the Operational and Infrastructure Administrator Roles and How to Mitigate Them

Operational Administrators and Infrastructure Administrators can access system settings and integrations. This creates security risks when you use an external identity provider or third-party integrations:

Credential Escalation Risk: If these roles can change authentication settings (such as LDAP, SSO or SMTP), they may be able to change them to log in as a full Administrator, for example by using a different, authorized email.
Monitoring Data Exposure: Access to monitoring profiles, settings and Integrations lets them connect external systems such as a SIEM. A SIEM integration could let them read monitoring data for all employees, bypassing dashboard restrictions.

Mitigation Strategy

Use these three measures together:

External IdP Mapping: When you integrate an external identity provider, avoid mapping users to these built-in roles. Map them to the more restrictive Employee role instead.
Internal Privilege Control: Use Access Control policies to grant only the exact privileges a user needs (for example, editing a single monitoring profile), following the principle of least privilege.
SIEM Configurations: Configure SIEM integrations to send only the security data you need. If needed, create separate integrations for different analysts or use cases.

How to change a user’s access level / account type / role