SoftwareCentral · Settings

Security Roles

SoftwareCentral has a simple and flexible security model. It limits what each user of SoftwareCentral can see and do, through security roles linked to groups.

Groups Interfaces Sites and collections Intune Reports

1 What a security role is

A security role sets the access for a group of users. Users get the role through a group, so you manage access by managing group membership.

Security roles are based on group memberships. Each role is linked to an Active Directory group, or to a Microsoft Entra ID group in an installation that takes role members from Microsoft Entra ID. The role then specifies which parts of SoftwareCentral the members can use.

To create, change or delete a role, see Security roles.

2 What a role can limit

A security role can limit users to:

  • Interfaces in SoftwareCentral, including many sub-functions in the interfaces (the menu functions)
  • SCCM sites
  • Computers and users, based on their collection memberships
  • Available software, based on Package Security Groups
  • SCCM queries
  • The number of devices or users to manage in a single operation
  • Operating System Task Sequences
  • Computer templates, and whether a template must always be used when importing a computer
  • Application templates
  • Dashboards in the Dashboard interface
  • SCCM reports and Power BI reports
  • Users, AD groups and organizational units in the Active Directory module
  • Intune tenants, Intune devices, users and groups, and Intune application templates, when SoftwareCentral is connected to Intune

Each of these is set in a step of the role wizard. Not every step is shown in every installation; see the table in Create a security role.

3 The shop is not limited by roles

The shop and the software available in it are not limited by security roles.

The shop uses an Active Directory based model, so shop users do not necessarily need a security role for SoftwareCentral. See the Shop Setup Guide for how to configure the security model for the shop.

4 Best practice

  • Create the Active Directory or Microsoft Entra ID group before you create the role. The role wizard only lists groups that already exist.
  • Manage access by changing group membership. The role stays the same and its members change, so you do not need to edit the role when someone moves to another team.
  • Give a security role only to people who need to use or manage SoftwareCentral. Shoppers who only use the shop do not need one.