Roles and Permissions – Customer Help Center

Permissions control what each person in your organization can do on the Immersive platform. This article lists every permission and what it lets someone do.

For guidance on how permissions combine, how to choose between them, and module-by-module capability tables, see Immersive Permissions and Roles.

Permissions are additive. Someone can hold several at once, and the broader permissions usually already include everything the narrower ones grant. Start with the smallest permission that covers what someone actually needs to do, then add a second only when it unlocks something the first does not.

Core permissions

You will find Organization Manager, Manager, and Technical Exercise Manager in the Permissions section of a user's profile on the Users page. Team Manager is assigned per team instead.

Permission	What it does
Organization Manager	The highest level of admin access. Organization Managers administer your entire organization: every user and team, all licensing, and every platform setting. They have full read and write access to the shared lab content library of collections, career paths, and labs, whoever created it, and they can see organization-wide reporting and view data for all users. Users and licensing Invite, deactivate, and reactivate users Assign and remove licenses Manage profile visibility Applies to all users in your organization Teams Create, move, and delete teams and sub-teams Bulk import and remove users Applies to all teams Platform configuration Integrations, API keys, email customization, subsidiaries, generative AI settings, and issue logs Library Create, edit, delete, and publish all custom collections, career paths, labs, and Programs across your organization, not just their own Assignments Create, edit, close, and delete assignments Assign collections, career paths, labs, and Program deployments to individuals, teams, or your whole organization Manage Programs and participants after deployment Reporting Organization-wide reporting, board-level metrics, and Data Explorer Can see every individual's and every team's data Not included Crisis Sim, Workforce, and Technical Exercise content creation. These remain separate permissions and need to be assigned on top. Scheduling Crisis Sim or Workforce exercises, which needs its own permission. Every organization needs at least one Organization Manager, because someone has to be able to invite users and apply licenses. Keep the number small.
Manager	The cross-module permission. A Manager can create teams, build content in Crisis Sim, Workforce, and Labs, and run Programs and Goals for the teams they manage, without admin rights over the rest of your organization. Managers can edit and delete only the content they created themselves, not another Manager's work. Teams Create teams and sub-teams Manage only the teams they created or manage Users Invite users into their teams, and remove users from their teams Promote other users to Manager or Team Manager within their teams They cannot edit license assignments directly, but a user added to a team that already has a license subscription applied will inherit it Library Create, edit, publish, and delete their own Crisis Sim scenarios, Workforce scenarios, and custom labs Create custom collections and career paths Programs Create, edit, delete, view, publish, and deploy Programs Catalogue Manage the catalogue and catalogue assignments Assignments Schedule and manage their own Crisis Sim and Workforce exercises Assign labs, collections, and career paths to the teams they manage Goals Create, edit, and delete goals View goal metrics Reporting Team-based reporting, including framework heatmaps, for the teams they manage Not included Technical Exercises, which means Cyber Range Exercises and Dynamic Threat Ranges. To run those, a Manager also needs Technical Exercise Manager. Organization-wide admin and platform settings, which are Organization Manager only.
Technical Exercise Manager	Cyber Range Exercise Management View exercise scenarios Create, schedule, update, and delete Cyber Range exercises Configure participating teams View exercise performance and reports Access ranges via Single Sign-On (SSO) Dynamic Threat Range Management View, create, configure, update, and delete Dynamic Threat Range exercises Provision, start, and close Dynamic Threat Range exercises Launch and retry live attacks View participating teams, feedback, attempt history, and attack details Credit & Resource Tracking Monitor and view technical exercising credits Goal Management View overall goal metrics Create, edit, and delete performance goals Edit goal ownership
Team Manager	Team Managers have admin permissions, but only for the teams they manage. They can: Manage team members View reports/ progress for their team(s) Assign content to their team(s) Create custom collections

Specialist permissions

Specialist permissions limit someone to a single module. Use them when you want to keep privileges in one area separate from the rest of the platform.

Admin

Permission	What it does
License Manager	Can manage teams, users and licensing only.

Labs

Permission	What it does
Lab Manager	Curates the whole published Labs library, including labs, collections, and career paths other people created. Cannot assign content.
Lab Creator	Builds labs, collections, and career paths, limited to their own content. Cannot assign content.

Neither Labs permission includes assignment rights. If the same person also needs to assign what they build, give them Manager instead, or add a permission that covers assignments.

Crisis Sim

Permission	What it does
Crisis Sim Manager	Can view, create, and manage Crisis Sim exercises and reports. They can also create their own content (custom scenarios that exercises can be based on).
Crisis Sim Exercise Creator	Allows users to create and run Exercises from existing Scenarios, but does not allow them to create or edit new Scenarios. The author/creator of an exercise is automatically added to the moderator list upon creating an exercise and cannot be removed. Note that you can only view/edit exercises that you have created/authored.
Crisis Sim Scenario Creator	Builds scenarios for other people to run, limited to their own scenarios.
Crisis Sim Exercise Moderator	This is a temporary role that allows anyone invited to act as moderator for a specific exercise to start, close or edit that specific exercise, as well as invite and remove other moderators. Moderators can be added and removed from the update/create flow for exercises. Both moderators and creators have access to the after action reporting. When invited to moderate, the new moderator will receive an email notification with a link to the exercise they can now moderate.

Exercise Creator and Scenario Creator are often assigned together, because most people who build scenarios also want to schedule exercises from them.

Workforce

Permission	What it does
Workforce Manager	Runs the whole Workforce area, including other people's content and area-wide reporting.
Workforce Exercise Creator	Schedules Workforce exercises, limited to their own exercises.
Workforce Scenario Creator	Builds Workforce scenarios, limited to their own scenarios.

Cyber Ranges

Permission	What it does
Cyber Ranges Manager	Manages your sandbox Cyber Ranges environment: create and manage ranges, templates, and images, and access all of them.
Cyber Ranges Creator	Access to specific ranges only. Granted per range rather than from the permission picker.

Candidate screening

Permission

What it does

Screening Manager

Has screening-specific privileges to facilitate candidate assessments. Screening Managers can:

Create jobs

For jobs they create:

Manage jobs
Add/ remove Recruiters
Add assessment details
Invite candidates
View assessment results

Recruiter

Has screening privileges, but only for jobs they've been added to. Can:

Manage jobs
Add/ remove other Recruiters
Add assessment
Invite candidates
View assessment results

Permissions you assign outside the Users page

Four permissions never appear in the permission picker. You grant them on the object they apply to, so if you are looking for one of these on a user's profile, you will not find it.

Permission	Where to assign it
Team Manager	On the team's Members tab, in the Admin Role column.
Crisis Sim Exercise Moderator	On the exercise, by inviting the person as a moderator.
Cyber Ranges Creator	On the range, by granting the person access to it.
Recruiter	On the screening job, by adding the person to it.

No permissions assigned

Role

What it does

Individual User

A user who is engaging with the platform to gain knowledge, skills and resilience, enabling them to stand up to cyber threats.

Individual users have no management permissions but can view and export their own progress on the platform, as well as compete with others in their organization via leaderboards.

Permissions and licensing

A permission grants capability, not access. If your organization is not licensed for a module, assigning the matching permission will not open it up. Check your license first if someone holds a permission but cannot see the area it applies to.