Role-Based Access Control for Camera-Only Administrators
The Meraki platform features multiple product lines including smart cameras (the MV series) and sensors (the MT series), creating a need for additional admin roles beyond the traditional network admins.
Camera-only roles are intentionally limited to camera-related functions. When correctly configured, local camera-only administrators can log in to both Meraki Dashboard and Meraki Vision. The Meraki Vision portal is a purpose-built CCTV portal designed for staff who need to monitor CCTV footage. Meraki Vision portal has none of the other features of Meraki Dashboard. In Meraki Dashboard, camera-only administrator access is limited to read-only access to the cameras page (other menu items are hidden), as demonstrated in Figure 4-22.
)
Figure 4-22 A Camera-Only Admin’s Limited View of Meraki Dashboard
In either portal, camera-only admins cannot make changes to camera settings such as focus, zoom, or aperture, nor can they create video walls or access the network tab of cameras. A camera-only admin’s access is therefore limited to performing only what is allowed by the following camera roles (see Figure 4-23):
No Access: These admins do not have access to any cameras.
View Live Footage: Admins with this level of access can watch live footage on a single camera or video wall.
View Any Footage: Admins with this level of access can watch live and historical footage on a single camera or video wall.
View and Export Any Footage: Admins with this level of access can watch all footage and manage video exports.
)
Figure 4-23 Camera Roles for Local Administrators at the Network Level
Local camera-only administrators can be configured at the organization or network level. Organization-wide camera admins are configured on the Organization administrators page (Organization > Administration). Privileges at the organization level must be set to None; otherwise, these privileges will override the camera privileges, giving users more access than intended.
Camera-only users should be configured in a purposeful way to limit their scope to what is required. You can configure the local camera-only users as outlined in Table 4-1 and Figure 4-24 to suit their job requirements.
Table 4-1 How to Configure Camera-Only Users to Suit Their Access Requirements
Access Required |
How to Configure |
|---|---|
The same level of access to all cameras in the organization |
Configure the user’s administrator access as follows:
|
Differentiated levels of access to cameras in the organization |
Configure the user’s administrator access as follows:
|
Access to only certain cameras |
The best way to restrict access within the same organization is to group the cameras into different networks. For example, create a camera-only network for common area devices and another for cameras in restricted or sensitive areas. Then configure the administrator’s access as follows:
|
No access to any cameras while retaining access to Dashboard |
The best way to configure this access would be to have all the cameras in their own organization, with another organization for all other devices, such as switches and access points. Only camera administrators would be given access to the camera organization. In this case, you would have two completely standalone instances of Meraki Dashboard, with neither team having any visibility of the other environment. |
)
Figure 4-24 An Example of an Administrator Configured as a Camera-Only Admin
We cover more details on this topic in Chapter 12, “Physical Security.”