Configure Roles & Permissions
Robopack supports granular role-based access control so you can give each team member exactly the permissions they need — no more, no less.
What you'll need
- Organisation Administrator or Security Writer permissions in Robopack
Step-by-Step Guide
1. Plan your access model
| Team | Recommended roles |
|---|---|
| IT admins | Organisation Administrator (full access) |
| Packaging team | Package Writer + Robopatch Writer |
| Read-only stakeholders | Package Reader + Robopatch Reader |
| Security / compliance | Security Reader |
2. Assign roles in Robopack
Go to Settings > Users, click on a user, select their roles, and save.
3. Assign roles via Entra ID (optional)
For larger organisations, you can assign roles through Entra ID enterprise application group membership:
- Go to Entra Portal > Enterprise Applications > Robopack > Users and Groups
- Assign users or security groups to the appropriate roles
Using Entra ID security groups means new team members automatically get the right permissions when they're added to the group.
4. Configure per-tenant permissions
If you manage multiple tenants, you can scope permissions per tenant in Settings > Tenants:
| Permission | Controls |
|---|---|
| See / read information | Who can view apps, settings, and Radar data for this tenant |
| Upload apps | Who can import packages to this tenant |
| Set configuration | Who can modify tenant settings |
| Set permissions | Who can manage access control for this tenant |
Access can be granted to all users, specific users, or an Entra ID security group.
Roles and tenant permissions are separate, and a user needs both: the role decides which features they can use, and the tenant permission decides which tenants they see. A user with a Reader or Writer role but no See / read information permission on a tenant does not see that tenant. If the groups you want to use live in a directory Robopack does not manage, see Groups from another Entra directory.
5. Set sign-in policy
| Policy | Use case |
|---|---|
| Allow both Entra ID and password sign-ins | Maximum flexibility |
| Only allow Entra ID sign-ins | Recommended for security |
| Only allow password sign-ins | For organisations not using Entra ID |
Before switching to Entra ID-only sign-ins, ensure all users who need access are already signing in with Entra ID.
6. Enable two-factor authentication (optional)
For accounts using password sign-in, you can enable 2FA:
- Per-user: Go to Settings > Account and set up an authenticator app (Microsoft Authenticator, Google Authenticator, etc.)
- Organisation-wide: Go to Settings > Account > Organisation Settings to require 2FA for all password logins
Groups from another Entra directory
Your technicians may sign in with accounts from an Entra directory that is not one of the Intune tenants you manage in Robopack, for example an MSP's own company directory. You can give their security groups access to the tenants you manage.
- Associate the directory: The directory your technicians sign in with must be associated with your Robopack organisation, with SSO turned on. In Settings > Tenants, open Details for the directory and tick Enable SSO.
- Assign Robopack roles in that directory: In the Microsoft Entra admin center for that directory, go to Enterprise applications > Robopack > Users and groups and assign your security groups to the Robopack roles they need. Creating a group, or giving it an Entra directory role, does not grant a Robopack role.
- Grant access to each managed tenant: In Robopack, go to Settings > Tenants and select + Add tenant permission. In Tenant, choose the managed tenant. Leave Grant to all users in organization unticked, choose Entra ID group, select the directory that holds your groups in the second Tenant field, and then select the group. Tick the permissions and select Save changes. Repeat for every managed tenant the group should reach.
Result: Technicians who sign in with their Entra account from that directory see each tenant their group was granted, with the features their Robopack role allows.
A typical split:
| Team | Robopack roles | Tenant permissions |
|---|---|---|
| Readers | Package Reader, Robopatch Reader | See / read information |
| Writers | Package Writer, Robopatch Writer | See / read information, Upload apps |
Keep Set configuration, Set permissions, Security Writer and Organisation Administrator for the people who administer Robopack itself, because they control tenant settings and who has access.
What's next?
- Features overview — explore all Robopack features
- Troubleshooting
- FAQ