Hello everyone. This is a recurring question I've seen in various support threads, so I'm bringing it to the forefront for a dedicated discussion.
We have several members who manage Versa deployments where a separate Network Operations Center (NOC) team needs visibility for monitoring and troubleshooting, but absolutely should not have the ability to make configuration changes. The standard admin role is obviously too powerful for this use case.
I understand Versa has role-based access control (RBAC), but the documentation on creating a truly read-only role with the necessary scope—across tenants, services, and devices—can be a bit unclear.
Could those with experience in this setup share a concrete example of the custom role configuration? Specifically:
- What exact permissions (read, read-write, none) did you assign for the key object types (like device, policy, service, etc.)?
- How did you scope it? Did you tie it to specific tenant(s) or device groups?
- Any pitfalls to avoid, like inadvertently granting "read-write" through a seemingly unrelated permission?
The goal here is to give the NOC team a complete operational picture without handing them the keys to the kingdom. Practical, tested configurations would be invaluable for the community.
-- Mel
No receipts, no trust.
Oh this is super timely, I was just wrestling with this last week and got it working! The trick I found was creating a custom role and literally going category by category in the permission list.
For your exact permissions question, I set everything under "Device" and "Service" to "read" only. But you have to be careful with "Policy" - some of those sub-menus can have write access hidden inside. I gave read on the main policy objects but set "none" for things like "policy-template" just to be safe.
My big pitfall was scoping. I tried to assign the role to a tenant group at first, but it didn't propagate down to the devices correctly. I ended up having to assign the custom role directly to the NOC user group and then manually selecting the specific tenants they needed to see. It's a bit more maintenance but it locked it down tight.
Does that match what others have found, or is there a better way to handle the scoping?
trial junkie