Access Groups (role-based access control)

PERMISSIONS  In respective module: Superuser, Administrator, Global Administrator, Security Admin (Datto Partner Portal)

Role-based access control (RBAC) is the process of assigning permissions to users based on their role within an organization. But rather than assigning permissions to users individually, you assign permissions to a group, and then assign users to the group.

To use this feature, start by creating and assigning users to groups, as described in Manage groups. Once you've set up groups and assigned users, use the procedures in this article to enable RBAC for your Kaseya platform modules.

Instructions follow on how to set up role-based access control (RBAC) for a module. You do this by defining mapping rules between KaseyaOne groups and module roles (or security levels) to control user access. The purpose of defining mapping rules is to mimic or maintain the same levels of user access between KaseyaOne and the module. You set up RBAC for a module by configuring Access Groups from within the individual module.

  • If you enable Access Groups, then RBAC from KaseyaOne will be allowed for the module and you will be able define mapping rules (by mapping KaseyaOne groups to the same or similar module roles) to control user access.

  • If you disable Access Groups, then RBAC from KaseyaOne will not be allowed for the module.

Enable Access Groups from individual modules

Instructions to configure Access Groups from individual modules follow.

BEFORE YOU BEGIN  Log In with KaseyaOne must be enabled in the module before you can enable Access Groups. Refer to Enable Log In with KaseyaOne for details.

To enable Access Groups for Autotask, do the following:

  1. Open Left Navigation Menu > Admin > Extensions & Integrations > Kaseya Integrations > KaseyaOne.
  2. On the KaseyaOne Settings page, select Enable Log In with KaseyaOne.
  3. Under User Exceptions, begin typing a user's name or use the data selector and select the users who will be exempt from the Require Log In with KaseyaOne condition, if enabled. Enter the URL that exempt users will use.
  4. Navigate to KaseyaOne Configuration Settings. The exact location will differ depending on the module.
  5. In the Access Groups section, turn on the Enable Access Groups toggle to enable the feature.
  6. Create mapping rules (or access groups) to control user access:
    • Click Add Access Group to create a new KaseyaOne Group-to-[Module] Role mapping.
    • Map each KaseyaOne Group to the same or a similar [Module] Role.
    • You can map more than one module role to a KaseyaOne group.

For more information, refer to KaseyaOne integration for Autotask in the Autotask Help.

To enable Access Groups for BMS/Vorex, do the following:

  1. Log in to BMS in the usual way and from the home page, navigate to Admin > My Company > KaseyaOne Settings.

  2. Turn on the toggle under Access Group Mapping to enable the feature.

  3. Create mapping rules to control user access as follows:

    • Click Add Access Group to create a new KaseyaOne Access Group-to-BMS/Vorex Security Role mapping.

    • Map each KaseyaOne Access Group to the same or a similar BMS/Vorex Security Role.

    • You can map more than one security role to a KaseyaOne group.

  4. Click Save.

For more information, refer to KaseyaOne Settings: JIT in the BMS/Vorex Help.

To enable Access Groups for ConnectBooster, do the following:

  1. Log in to ConnectBooster in the usual way and click Configurations > KaseyaOne on the left navigation menu.

  2. In the Access Groups section, turn on the Enable Access Groups toggle to enable the feature.

  3. Create mapping rules to control user access:

    • Map each KaseyaOne Access Group to the same or a similar [Module] Role.

    • You can map more than one module role to a KaseyaOne group.

  4. Click Save.

For more information, refer to Associate your ConnectBooster and KaseyaOne Accounts in the ConnectBooster Help.

To enable Access Groups for Datto EDR, do the following:

  1. Log into Datto EDR.
  2. Hover over your username in the top-right corner and select Admin.
  3. In the left navigation menu, select Settings and click the KaseyaOne tab.
  4. In the Unified Login section, verify that Enable Log In with KaseyaOne is turned on.

If not, turn it on:

  1. Turn on the Enable Log In with KaseyaOne toggle.

  2. A modal is displayed indicating that you will be redirected to KaseyaOne. Click Continue.

  3. In the KaseyaOne login page, enter your KaseyaOne credentials and the verification code. This registers Datto EDR as a single sign-on (SSO) module in your KaseyaOne instance. You are redirected back to the Datto EDR portal.

  1. (Optional) To require users to login with their KaseyaOne credentials, turn on the Require Log In with KaseyaOne toggle.
  2. (Optional) To allow specific users to continue to log into Datto EDR using their local Datto EDR credentials, in the User Exceptions list, select the applicable users.

IMPORTANT  Create an Admin group in KaseyaOne by following the steps in the Manage KaseyaOne groups article. Be sure to include your Admin account as part of the group. Then, enable access groups and map the access group to the Admin role, per step 7 below.

  1. To enable access groups:
    1. In the Access Groups section, click the Enable Access Groups toggle.
    2. Click the Add Access Group button.
    3. In the KaseyaOne Group list, select the desired group.
    4. In the EDR Role list, select the desired role.

For more information, refer to Integrating with KaseyaOne in the Datto EDR Help.

IMPORTANT  Before enabling this feature, make sure that your KaseyaOne groups are assigned the Datto RMM module and that you have created new or renamed existing Datto RMM security levels to match the KaseyaOne group names (names are case insensitive) and level of user access.

To enable Access Groups for Datto RMM, do the following:

  1. Log in to Datto RMM in the usual way and navigate to Setup > Integrations > KaseyaOne.

  2. Review the mapping rules in the Access Groups section under Automatic Mappings Found:

    • Review the KaseyaOne group-to-Datto RMM security level mappings to make sure they are what you want. For example, each KaseyaOne group should map to a Datto RMM security level that has the same or similar level of user access.

    • Click Sync to confirm all groups match to the intended Datto RMM security level.

    • If the mappings match as expected, then proceed to the next step.


  3. Turn on the Enable Access Groups toggle to enable the feature.

For more information, refer to Unified Login with KaseyaOne in the Datto RMM Help.

NOTE  The My Glue and Network Glue modules are add-ons to IT Glue, and you access them from the IT Glue portal. After Unified Login is enabled for the IT Glue portal, each module can be accessed through Log In with KaseyaOne.

To enable Access Groups for IT Glue, My Glue, and Network Glue, do the following:

  1. Log in to IT Glue in the usual way.

  2. In the top navigation menu, click Admin.

  3. On the Settings page that opens by default, click the Authentication tab.

  4. In the Single Sign-On section, ensure that the Enable Log In with KaseyaOne toggle is turned on.

NOTE  This toggle must be turned on before you can enable Access Groups. Refer to Enable Log In with KaseyaOne for IT Glue, My Glue, Network Glue for details.

  1. In the Access Groups section, turn on the Enable Access Groups toggle.

  2. Click Save.

Once enabled, the following behavior applies to IT Glue groups and the users assigned to them:

  • KaseyaOne and IT Glue groups with matching names are linked.
  • Users are automatically added to or removed from the corresponding IT Glue groups as their KaseyaOne group membership changes.
  • User membership is synchronized only between matched KaseyaOne and IT Glue groups. IT Glue groups without a matching KaseyaOne group, including their user memberships, are not modified.

NOTE  All RapidFire modules (Compliance Manager, Cyber Hawk, Network Detective Pro, VulScan), although purchased individually, are accessed from the RapidFire Tools portal. After Unified Login is enabled for the RapidFire Tools portal, each module can be accessed through Log In with KaseyaOne.

To enable Access Groups for Rapid Fire Tools, do the following:

  1. In the RapidFire Tools portal, click IT Complete > Settings on the left navigation menu.

  2. In the Access Groups section, turn on the Enable Access Groups toggle to enable the feature.

  3. Create mapping rules to control user access:

    • Click Add Access Group to create a new KaseyaOne Access Group-to-RapidFire Tools Portal Role mapping. Map KaseyaOne access group to the same or a similar role in Rapid Fire Tools.

    • Map each KaseyaOne Access Group to a specific Global Access Level in Rapid Fire Tools.

    • For Site Restricted users:
      - Select a site (from the Site(s) drop-down) to which the Group will have access.
      - Likewise, select a site role (from the Site Role drop-down).

For more information, refer to Rapid Fire Tools Help.

To enable Enable Access Groups for VSA 10, do the following:

NOTE  A prerequisite to enabling this feature is to enable Unified Login with KaseyaOne — refer to Enable Log In with KaseyaOne for VSA 10.

  1. Log in to VSA 10 in the usual way.
  2. Navigate to Administration > Configuration > Settings on the left navigation menu and select KaseyaOne Log In Settings.

  3. Under Access Groups, turn on the Enable Access Groups toggle.


  4. In Team Mappings, click Edit Access Groups.

    .

  5. In the Edit Access Groups window, map each existing KaseyaOne access group to the same or a similar VSA 10 team in the Default VSA X Team field.

    • You can assign additional teams to the KaseyaOne access group in the Other VSA X Teams field.

    NOTE  By default, the All Module Access KaseyaOne access group is selected for configuration. To configure additional KaseyaOne access group mappings, click + Add Access Group and choose which group you want to configure mapping rules for.

  6. Click Apply and review the mappings.

  7. Click Save.

For more information, refer to Unified Login with KaseyaOne in the VSA 10 Help.