Permissions control what each person in your organization can do on the Immersive platform: who they can manage, what content they can build, what they can assign, and whose results they can see.
This article explains every permission available, how to decide which one to give someone, and what each permission lets them do in each part of the platform.
How permissions work
Permissions are additive
Someone can hold several permissions at once, and the broader permissions usually already include everything the narrower ones grant. If a person already holds Manager or Crisis Sim Manager, you do not need to add Crisis Sim Exercise Creator as well, because their existing permission already covers it.
Start with the smallest permission that covers what someone actually needs to do, then add a second permission only when it unlocks something the first one does not.
Library and Assignments
Most of the tables in this article split capabilities into two groups:
- Library covers building and publishing custom content.
- Assignments covers deploying content to people.
Anyone who can create custom content can also see their own creations alongside the Immersive catalog, within the limits of your license. Anyone with assignment rights can assign any published content, whether that is custom content created inside your organization or the out-of-the-box content and templates that came with your license.
Reporting
Reporting follows the same pattern across the platform:
- Everyone can see their own results and their own framework heatmap, such as MITRE ATT&CK, whatever permissions they hold.
- Team-scoped permissions, which means Team Manager, or Manager for the teams they manage, can see their team's heatmap and progress.
- Organization Manager can see every individual, every team, your organization-wide heatmap, and Data Explorer.
Permissions and licensing
A permission grants capability, not access. If your organization is not licensed for a module, assigning the matching permission will not open it up. Check your license first if someone holds a permission but cannot see the area it applies to.
Core permissions
Three core permissions are available in the permission picker, which you will find in the Permissions section of a user's profile on the Users page.
A fourth core permission, Team Manager, is assigned per team rather than from this picker. It is covered below.
Organization Manager
The highest level of admin access. Organization Managers administer your entire organization: every user and team, all licensing, and every platform setting. They have full read and write access to the shared lab content library of collections, career paths, and labs, whoever created it, and they can see organization-wide reporting and view data for all users.
Organization Manager does not include Crisis Sim, Workforce, or Technical Exercise content creation. Those remain separate permissions and need to be assigned on top.
Every organization needs at least one Organization Manager, because someone has to be able to invite users and apply licenses. Keep the number small.
| Capability group | Scope |
|---|---|
| Users and licensing | Invite, deactivate, and reactivate users; assign and remove licenses; manage profile visibility. Applies to all users in your organization. |
| Teams | Create, move, and delete teams and sub-teams; bulk import and remove users. Applies to all teams. |
| Platform configuration | Integrations, API keys, email customization, subsidiaries, generative AI settings, and issue logs. |
| Library | Create, edit, delete, and publish all custom collections, career paths, labs, and Programs across your organization, not just their own. Does not cover Crisis Sim, Workforce, or Technical Exercise content, which need their own permissions. |
| Assignments | Create, edit, close, and delete assignments; assign collections, career paths, labs, and Program deployments to individuals, teams, or your whole organization. Does not cover scheduling Crisis Sim or Workforce exercises, which need their own permissions. |
| Reporting | Organization-wide reporting, board-level metrics, and Data Explorer. Can see every individual's and every team's data. |
Manager
The cross-module permission. A Manager can create teams, build content in Crisis Sim, Workforce, and Labs, and run Programs and Goals for the teams they manage, without admin rights over the rest of your organization.
Managers can edit and delete only the content they created themselves, not another Manager's work.
Technical Exercises, which means Cyber Range Exercises and Dynamic Threat Ranges, are not included. To run those, a Manager also needs Technical Exercise Manager.
| Capability group | Scope |
|---|---|
| Teams | Create teams and sub-teams; manage only the teams they created or manage. |
| Users | Invite users into their teams; remove users from their teams; promote other users to Manager or Team Manager within their teams. They cannot edit license assignments directly, but a user added to a team that already has a license subscription applied will inherit it. |
| Library | Create, edit, publish, and delete their own Crisis Sim scenarios, Workforce scenarios, custom labs, and Programs. They can also create custom collections and career paths. |
| Assignments | Schedule and manage their own Crisis Sim and Workforce exercises; deploy their own Programs; assign labs, collections, and career paths to the teams they manage. |
| Goals | Create, edit, and delete goals; view goal metrics. |
| Reporting | Team-based reporting, including framework heatmaps, for the teams they manage. |
| Not included | Technical Exercises, which require Technical Exercise Manager in addition. Organization-wide admin and platform settings, which are Organization Manager only. |
Technical Exercise Manager
Runs and manages technical exercising: Cyber Range Exercises and Dynamic Threat Ranges. Technical exercises consume technical exercising credits, so this permission is kept separate from the rest. Assign it to the people who schedule and run exercises.
Organization Manager does not include this permission, so assign it separately. It stacks with the others: give someone both Manager and Technical Exercise Manager if they run technical exercises as part of wider cross-module work, or Technical Exercise Manager on its own if that is all they do.
| Capability group | Scope |
|---|---|
| Cyber Range Exercises | View scenarios; create, schedule, update, and delete exercises; configure participating teams; view performance and reports; SSO access to ranges. |
| Dynamic Threat Ranges | View, create, configure, update, and delete exercises; provision, start, and close exercises; launch and retry live attacks; view participating teams, feedback, attempt history, and attack details. |
| Credits | Monitor and view technical exercising credit consumption. |
| Goals | Create, edit, and delete goals; view goal metrics. |
Team Manager
Admin capability scoped to one or more specific teams. Unlike the three permissions above, Team Manager is not assigned from the permission picker. You set it per team, on the team's Members tab, in the Admin Role column.
Holding Manager counts as holding Team Manager, so a Manager already has Team Manager-level team administration plus cross-module content rights on top. Team Manager on its own suits someone who should administer a team without creating content.
| Capability group | Scope |
|---|---|
| Team members | Manage the members of their team or teams. |
| Library | Create custom collections and career paths. |
| Assignments | Assign content to their team or teams. |
| Reporting | View reports and progress for their team or teams, including team framework heatmaps. |
| Goals | Create, edit, and delete goals; view goal metrics. |
Specialist permissions
Specialist permissions limit someone to a single module. Use them when you want to keep privileges in one area separate from the rest of the platform, for example a regulated team that should be able to build Crisis Sim scenarios and nothing else.
You will find most of them grouped by module in the Specialist Permissions section of the permission picker.
Admin
| Permission | What it does |
|---|---|
| License Manager | Configures users, teams, and licensing, and nothing else. No content, assignment, or reporting access. Use it when user administration needs to sit with a different group from content and assignments, such as an IT team handling joiners, movers, and leavers. |
Labs
| Permission | What it does |
|---|---|
| Lab Manager | Curates the whole published Labs library, including labs, collections, and career paths other people created. Cannot assign content. |
| Lab Creator | Builds labs, collections, and career paths, limited to their own content. Cannot assign content. |
Neither Labs permission includes assignment rights. If the same person also needs to assign what they build, give them Manager instead, or add a permission that covers assignments.
Crisis Sim
| Permission | What it does |
|---|---|
| Crisis Sim Manager | Runs the whole Crisis Sim module: edit any scenario, edit any exercise, and see module-wide reporting. |
| Crisis Sim Exercise Creator | Schedules exercises from existing scenarios, limited to their own exercises. |
| Crisis Sim Scenario Creator | Builds scenarios for other people to run, limited to their own scenarios. |
| Crisis Sim Exercise Moderator | Moderation access to one specific exercise. Granted by invitation on the exercise itself, not from the permission picker. Useful when you want a second moderator on hand during a presentation exercise. |
Exercise Creator and Scenario Creator are often assigned together, because most people who build scenarios also want to schedule exercises from them.
Workforce
| Permission | What it does |
|---|---|
| Workforce Manager | Runs the whole Workforce area, including other people's content and area-wide reporting. |
| Workforce Exercise Creator | Schedules Workforce exercises, limited to their own exercises. |
| Workforce Scenario Creator | Builds Workforce scenarios, limited to their own scenarios. |
Cyber Ranges
| Permission | What it does |
|---|---|
| Cyber Ranges Manager | Manages your sandbox Cyber Ranges environment: create and manage ranges, templates, and images, and access all of them. |
| Cyber Ranges Creator | Access to specific ranges only. Granted per range rather than from the permission picker. |
Candidate screening
| Permission | What it does |
|---|---|
| Screening Manager | Creates screening jobs, and manages the jobs they created: add and remove recruiters, add assessment details, invite candidates, and view results. |
| Recruiter | Screens candidates for the jobs they have been added to. Granted per job rather than from the permission picker. |
Permissions you assign outside the Users page
Four permissions never appear in the permission picker. You grant them on the object they apply to, so if you are looking for one of these on a user's profile, you will not find it.
| Permission | Where to assign it |
|---|---|
| Team Manager | On the team's Members tab, in the Admin Role column. |
| Crisis Sim Exercise Moderator | On the exercise, by inviting the person as a moderator. |
| Cyber Ranges Creator | On the range, by granting the person access to it. |
| Recruiter | On the screening job, by adding the person to it. |
Cyber Ranges and Technical Exercises
These two names sound similar and work differently.
Cyber Ranges are sandbox range environments. You cannot assign them to people on the Immersive One platform, and they do not consume credits. Cost depends on the size of the ranges and the machines inside them. Use Cyber Ranges Manager and Cyber Ranges Creator for these.
Technical Exercises, which covers Cyber Range Exercises, Dynamic Threat Ranges, and AI Ranges, are Immersive-built exercises that you can assign on the Immersive One platform and that run a set of machines. A Technical Exercise Manager schedules each one and runs it for a team, and it consumes technical exercising credits.
Choosing the right permission
Organization Manager, Manager, or Team Manager
Every organization needs at least one Organization Manager, because someone has to be able to invite users and apply licenses. To keep control tight, limit how many people hold Organization Manager beyond that core group of administrators.
Choose Manager when someone needs to be able to create and manage their own teams and build and assign content scenarios, exercises, labs, programs, and goals. Use it in general for all managers who don't need administrative privileges. This may be a department head, an L&D manager, or a team lead who delegates content creation but still needs to manage membership and track progress.
You can increase the manager's scope to cover more teams by making them a Team Manager of other teams.
Use Team Manager on it's own when all you need is someone who can update team membership and review the team's progress. or use it in combination with the Manager permission to get full content & assignment capability.
Use broad permissions to keep things easy:
For most organizations, the simplest approach is to assign Manager directly and let each Manager create and shape their own teams, content and assignments as they need them.
Strict, least-privilege permissions:
If you need stricter separation and control over your modules and teams, pre-build your team structure as an Organization Manager and assign Team Managers where appropriate, then add the specialist permissions alongside Team Manager, instead of using the broader-scoped Manager permission.
Manager tier or Creator tier within a module
The same pattern repeats across Crisis Sim, Workforce, and Labs. If someone's whole job is producing content that other people then run or publish, the narrower Creator-tier permission is enough. If they need to run the entire area, including other people's content and area-wide reporting, they need the Manager-tier permission for that module.
- Crisis Sim: use Crisis Sim Exercise Creator or Crisis Sim Scenario Creator for people who only build scenarios and schedule their own exercises. Use Crisis Sim Manager when someone needs to act as an admin for the whole module, including other people's exercises and area-wide reporting.
- Workforce: the same logic applies. Workforce Exercise Creator or Workforce Scenario Creator for someone building their own content, Workforce Manager for someone managing the full area.
- Labs: Lab Creator for someone building labs, collections, or career paths without touching anyone else's work. Lab Manager for someone curating the full published library, including editing or retiring content other people authored.
- Technical exercises: there is no narrower tier. Running Cyber Range Exercises or Dynamic Threat Ranges always requires Technical Exercise Manager.
Module reference
Use these tables when you want to answer a question like "who can do this in Crisis Sim".
Crisis Sim
| Capability | Organization Manager | Manager | Crisis Sim Manager | Crisis Sim Exercise Creator | Crisis Sim Scenario Creator | Crisis Sim Exercise Moderator |
|---|---|---|---|---|---|---|
| Create and manage scenarios | No | Own only | All | No | Own only | No |
| Schedule and manage exercises, including start, close, edit, and inviting or removing other moderators | No | Own only | All | Own only | No | Their moderated exercise only |
| Assign exercises | No | Teams they manage, and individuals in those teams | All individuals, all teams, and organization-wide | Teams and organization-wide | No | Teams and organization-wide |
| After Action Reports | No | Own exercises only | All exercises | Own exercises only | No | Their moderated exercise only |
| Organization-wide Crisis Sim reporting, including Capability by area and Data Explorer | Yes | Yes | Yes | No | No | No |
Workforce
| Capability | Organization Manager | Manager | Workforce Manager | Workforce Exercise Creator | Workforce Scenario Creator |
|---|---|---|---|---|---|
| Create and manage scenarios | No | Own only | All | No | Own only |
| Schedule and manage exercises | No | Own only | All | Own only | No |
| After Action Reports | No | Own exercises only | All exercises | Own exercises only | No |
| Organization-wide Workforce reporting, including Capability by area and Data Explorer | Yes | Yes | Yes | No | No |
Cyber Ranges and Technical Exercises
| Capability | Cyber Ranges Manager | Cyber Ranges Creator | Technical Exercise Manager |
|---|---|---|---|
| Create and manage ranges, templates, and images | All | No | No |
| Access ranges | All | Only ranges they have been granted access to | SSO access to exercise ranges |
| View, create, edit, and delete Technical Exercises, and spend technical exercising credits | No | No | All exercises |
Candidate screening
| Capability | Screening Manager | Recruiter |
|---|---|---|
| Create jobs | Yes | No |
| Manage jobs, add and remove recruiters, add assessment details, invite candidates, and view results | Jobs they created | Jobs they have been added to |
What everyone can do without a permission
With the right license, every individual can do the following even with no permissions assigned. This list is illustrative rather than exhaustive.
- Take part in any activity they are assigned.
- Self-serve any published Lab content they are licensed for, whether custom or created by Immersive.
- View their own reporting and progress, including their own framework heatmap such as MITRE ATT&CK.
- Self-enroll into any Program deployment a Manager has flagged as self-enrollable.
- View the leaderboard.
Without a permission, they cannot:
- View detailed reports for other users.
- View, create, or manage teams.
- View, create, or manage content.
- View, schedule, or manage assignments.