You can change the account type/access level/role of an employee from their profile:

1. From the main menu, select Employees.

2. Scroll down to the employee who's account you want to change. Then click the Three Dots in front of their name. This will open the Context Menu.

3. From the Context Menu, select the Edit Profile option. This will open a panel on the right side of the screen.

4. Click the Account tab.

5. Select an account role from the Access Level drop-down menu.

6. Click the Apply changes button to set the access level.

Teramind has several account access levels you can assign to users to limit which features and options they can access. You can change the account access level of a user from their profile.

The most powerful access level. They can monitor all employees, other admins, and change any settings with no restrictions.

A step down from an Administrator access level, Operational Administrators are granted the ability to manage global settings without being able to view monitoring data.

The table below details the specific permissions and restrictions for users assigned this access level. It outlines their capabilities across various system features, including profile management, employee and computer administration, and configuration settings, providing a comprehensive overview of their operational scope.

This access level has more limited access than an Administrator or Operational Administrator. Infrastructure Administrators are not able to list employee or computer accounts or view any monitoring data, screen recordings, or productivity metrics but they are allowed to edit the subscription (cloud accounts), download agents, and adjust global dashboard settings and monitoring settings.

The table below outlines the specific permissions and restrictions for users holding this access level. It details their capabilities concerning profile management, configurations and monitoring profiles, and certain system functions, providing a clear overview of their role in managing system infrastructure.

This is a special type of permission not available under the Account Type and can only be created from the Departments menu. Please see the section Configure > Departments on the Teramind User Guide to learn more about departments.

Any employee that is not assigned one of the administrator roles can be assigned as a department manager. These managers can then view/manage the employees in their assigned department.

The reports accessible in the dashboards will be very similar to what an Administrator can see but the results will be filtered to the employees that are listed in the Employees field for Departments that person manages.

The table below details the specific permissions and restrictions for users assigned this access level. It outlines their capabilities concerning profile management, dashboard access and creation, and the ability to view and manage tasks and employee/computer data relevant to their department.

An employee can access their activity reports and mange their profile - only if allowed by an administrator.

The table below outlines the specific permissions and restrictions for standard users with employee access. It details their capabilities for managing their own profile and viewing various dashboards and reports related to their personal activity.

The Operational Administrator and Infrastructure Administrator roles are granted access to system settings. This privilege presents several security risks when used with an external identity provider or third-party integrations:

Credential Escalation Risk: If these roles have control over authentication solutions (such as LDAP, SSO, or SMTP configurations), they may be able to manipulate settings to authenticate and log in as a full Administrator (e.g., by using a different, authorized email).

Monitoring Data Exposure: Access to monitoring profiles and system settings also enables them to integrate with external systems, such as a SIEM solution. A SIEM integration could allow them to read and access all monitoring data for employees, bypassing dashboard-level restrictions.

To mitigate the security risks, employ a three-pronged strategy: