About Team Member Roles
Invite team members from Access: in the sidebar, click the Account Menu Button, then select Access. The account owner has full access like an administrator, but other administrators cannot remove that person or strip the role. The first account owner is created when the tenant is set up; ownership can later transfer to another admin. To change or remove users, see Modify or Remove Team Members.Access Levels
Account Owner
Full access to all functionality. Other team members cannot delete the Account Owner.When creating your Iru account, the first team member has 24 hours to activate their account via email.
Administrator
Full access to all functionality. Accounts with this role can be deleted by other administrators.Additional administrators have 24 hours to activate their Iru account via email. If 24 hours pass before the account is created, an existing admin must resend the invitation from Access.
Standard
Same permissions as Administrator accounts without access to Settings.Help Desk
No access to Settings and read-only access to Blueprints and Library Items. Help Desk users can run all device actions, including deleting a device.Auditor
Limited read-only access to the Iru Web App.Secrets Auditor
Limited read-only access to the Iru Web App plus the ability to read:- macOS FileVault recovery keys
- Activation lock bypass codes
- Recovery lock password
- Device unlock PIN
Permissions Overview
Limited (Auditor): The Compliance agent runs, but control definitions are withheld. Linked actions and artifacts are still available. This matches Auditor access under Compliance Permissions (View controls is off).
Iru AI does not grant access beyond what the role already has in the web app. Device secrets (such as FileVault recovery keys) are not available through Iru AI for any role. When a question falls outside a role’s access, Iru AI says so and answers from documentation instead of returning partial data. For agent coverage and org-level enablement, see Iru AI Overview. For Compliance-only roles, see Compliance Permissions.
Web App Authorization & Session Duration
For security, team members must re-authenticate their Iru Web App session on a schedule, regardless of role.- Sign in at least once every 24 hours.
- After 60 minutes of inactivity, the session ends automatically.
Related Articles
- Compliance Permissions: roles and permissions in Iru Compliance, including Compliance-only roles that align with the access patterns above.
- Iru AI Overview: how Iru AI agents work and how to enable Iru AI for the organization.