User and permissions management

Admin account role

The Administrator (Admin) account role is the top-level customer account role for Forescout Cloud. Users with this role have access to all Forescout Cloud functions and features, including change management. The following functions can only be performed by users with an Admin account role:

• Add, modify, and delete users
• Change account settings
• Assign and reassign Triage Cards to any user
• Data sources
  • Add, modify, and delete
  • Download certificates
• Add, delete, and modify application integrations
• Rule administration
  • Forescout Cloud rules
    • Enable and disable rules
    • Add, delete, and modify rule parameters
  • Enable and disable a custom rule when the custom rule outcome is trigger detection
• Delete data source connectors
• Restore logs from cold storage

Forescout Cloud Operator account role

All other Forescout Cloud functions are available to the Operator user account role.

Account Administrator role

The Account Administrator role is provisioned during initial onboarding and is limited to the sole function of adding and managing new accounts for a particular Forescout Cloud instance. This role allows you to create custom roles. For more information, see Custom Roles.

A new View Assets Risks permission has been added under the Asset Management section during role creation to provide granular control over risk data visibility. System roles receive this permission by default, and it is fully configurable for custom roles when the product type is eyeFocus. However, it has no effect for eyeScope, as risk functionalities are already absent from that product type. If a role lacks this permission, risk-related items like Risk Severity and Risk Score are hidden on the asset page. For dashboards containing risk-related widgets, the permission is granted implicitly upon role creation, though administrators can choose to remove it; doing so displays an info icon warning that dependent features, such as risk-related dashboard drill-downs, may not function.

Custom roles

Using the Users and Permissions page, you can create custom roles with individual permissions and data access (attribute) profiles and apply them to both users and groups.

To create a custom role:

1. Under Administration, select Users and Permissions.
2. Click the Roles and Permissions tab.
3. Click Manage User, and then select Create Role.
4. On the Details tab, provide the following information:
   1. Role Name
   2. Role Description
   3. Product Type
5. On the Permissions tab, you can customize the permissions and access levels for the following features:
   • Software Inventory
   • Integration Management
   • eyeSegment
   • Logs Monitoring
   • Dashboards and Reports Management
   • Vulnerability Inventory
   • Incident and Threat Management
   • Automation Management
   • Health Monitoring
   • Asset Management and Monitoring
   • Edge Management ( )
   • Access Control Management
   • Account Management
   • Label Management and Assignment
   • Location
6. On the Scope tab, you can customize the scope of the data that users have access to, helping limit the amount of information to specific roles, including:
   • Classification
   • Datasource
     Note: This is the only scope category applicable to Forescout eyeAlert users.
   • Deployment
   • Identity
   • Medical
   • Network
7. Click Create Role.

User account restrictions

For security, compliance, and performance, Forescout doesn't allow command-line interface (CLI) access to the Forescout Cloud infrastructure by any customer user account, regardless of role. As a result, Forescout Cloud customers don't have the ability to alter logs collected from the customer's environment. Forescout Cloud customers also don't have the ability to alter logs through the Forescout Cloud user interface (UI).