Role-Based Access Control for Sensor-Only Administrators
Sensor-only administrators are admin accounts that have access to sensor devices and nothing else in Dashboard. Three additional roles apply to sensor-only admins, as illustrated in Figure 4-25:
No Access: These users do not have access to any sensors.
Read-Only Sensor Access: Admins with this level of access can read sensor readings and configurations but not make any changes.
Full Sensor Access: Admins with this level of access can both monitor and edit sensor readings and configurations.
)
Figure 4-25 Sensor Roles for Local Administrators at the Network Level
At the time of writing, access control for sensors is still undergoing heavy development. It is important to note the following:
Sensors connect via a gateway; both the gateway and the sensor need to be in the same network. This means you can’t have a true sensor-only network.
There is no equivalent to All Cameras in This Organization for sensors. This would be an elegant solution, so do not be surprised to see it added in the future.
It is not possible to select a subset of sensors on the network-wide administration page.
It is important to remember that sensors are used to collect data such as temperature, air quality, and moisture readings, none of which is personally identifiable information. Nevertheless, to create a local sensor-only user (this user will have the same level of access for all sensors in the organization), configure their administrator profile as follows (Organization > Administration):
Organization Access to None
Target to the network containing the sensors and their gateways
Access to the highest access the user requires, such as full access
When single sign-on is configured, permissions for camera and sensor admins can also be assigned using Security Assertion Markup Language (SAML). The organization-wide roles used by single sign-on can be defined in Dashboard by navigating to Organization > Camera and Sensor Roles. The permissions mapping is done at time of login, and the admin user is mapped to one of these locally configured roles. It is recommended to use single sign-on for medium to large organizations or where administrators require differentiated access. Configuring single sign-on using SAML is explained in detail in Chapter 5, “Securing Administrator Access to Meraki Dashboard.”
For more information on role-based access for cameras and sensors using SAML, see https://documentation.meraki.com/MT/MT_General_Articles/Camera_and_sensor-only_admin_(IoT_Admin).