Role-Based Access Control Using Systems Manager Limited Access Roles
There are additional roles known as limited access roles when using Meraki Systems Manager for mobile device management (MDM). Limited access roles allow you to create roles that have defined privileges, for a defined scope of Systems Manager devices. These roles apply only to System Manager commands such as rebooting devices, requesting device check-in, and pushing out notifications. These commands are targeted at managed end-user devices such as phones, tablets, and computers. Here are some examples of use cases where this functionality could come in handy:
A trainer wants to reboot all classroom devices at the end of a lesson.
A store manager wants all devices in the store to check in at the start of the day (to verify they are functioning and that none have gone missing).
You may have administrators responsible for end-user technology whom you want to give limited access to Meraki Dashboard. You could create a role that provides full access to Systems Manager, while limiting their access to the rest of Dashboard.
Limited access roles remain hidden in Meraki Dashboard until all three of these prerequisites are met:
At least one Systems Manager Agent license has been added.
A Systems Manager Network has been created.
At least one device has been enrolled.
Once the prerequisites are in place, follow these steps to tag your Systems Manager devices and configure limited access roles:
Step 1. Log in to Meraki Dashboard (https://dashboard.meraki.com).
Step 2. If you want to use the built-in tags such as IOS devices or Android devices, you can go straight to Step 5. To use custom tags, navigate to Systems Manager > Devices, as demonstrated in Figure 4-26.
)
Figure 4-26 Navigating to the Systems Manager Devices Page
Step 3. Select the devices you want to tag, as shown in Figure 4-27, and then click the Tag drop-down menu.
)
Figure 4-27 Selecting Systems Manager Devices to Tag
Step 4. Input the tag name in the Add: text input box and click Add. In the example in Figure 4-28, we created a tag called Store_device to identify all the devices that are used in retail store locations.
)
Figure 4-28 Creating a System Manager Tag and Adding It to Our Device(s)
Step 5. Now create the limited access role by first navigating to Systems Manager > General (under Configure) for a standalone Systems Manager (SM) network or Network-wide > Administration (under Configure) in a combined network. Scroll down to Limited Access Roles (see Figure 4-29).
)
Figure 4-29 Limited Access Roles on the Network-Wide Administration Page
Step 6. Click Add a New Limited Access Role.
Enter a name for this role in the text input box under Role Name. Then set the appropriate scope. In the example shown in Figure 4-30, we created a role for a store manager with a scope of With ANY of the Following Tags.
)
Figure 4-30 Entering Name and Scope to Create a Limited Access Role
Step 7. Select the tags that identify the devices that this admin should have access to. In the example in Figure 4-31, we selected the Store_device tag. Click Save in the bottom-right corner.
)
Figure 4-31 Selecting the Tag(s) to Create a Limited Access Role
The Limited Access Roles section should now look like the screen in Figure 4-32. A banner at the top of the page confirms that the changes have been saved (not shown here).
)
Figure 4-32 A Completed Limited Access Role
Step 8. Navigate to the Organization administrators page (Organization > Administrators), as demonstrated in Figure 4-33.
)
Figure 4-33 Navigating to the Organization Administrators Page
Step 9. From page shown in Figure 4-34, click the name or email address of an existing administrator that you want to modify (or create a new one).
)
Figure 4-34 The Organization Administrators Page
Step 10. In the dialog box shown in Figure 4-35, set the Organization access to None. Set the Target to the network containing the Systems Manager devices, and under Access, choose the name of the role you have just created. Here, we chose the Store Manager role. Finish by clicking Update Admin.
)
Figure 4-35 An Example of an Administrator Configured in a Limited Access Role
Step 11. You now return to the Organization administrators page. Click Save Changes for the changes to be applied.
Perform the following steps to verify that the changes are in effect:
Step 1. Log in as the user with the limited access role. Navigate to Systems Manager > Devices. Note the limited view of Dashboard that this user has, as demonstrated in Figure 4-36.
)
Figure 4-36 Navigating to the Systems Manager Devices Page (Limited Access Role)
Step 2. Test that the privileges for this new limited access role are working as intended by requesting a device check-in. Before starting, to make it possible to determine the check-in time, enable the columns for Tags and Last Check-in (MDM) by clicking the settings (or sprocket) icon on the far right. Once this is done, the Device List page should look like Figure 4-37 with the additional columns showing. In this example, you can see that the last check-in time for this device was 7:37 a.m.
)
Figure 4-37 Confirming the Most Recent Check-In Date/Time
Step 3. Check the box on the row for the device(s) you want to check in and select Request Check-in from the Command drop-down menu, as demonstrated in Figure 4-38.
)
Figure 4-38 Requesting a Device Check-In with Systems Manager
Step 4. Click Confirm on the pop-up window, as shown in Figure 4-39. You see the Devices List page again with confirmation that the check-in request has been sent, as demonstrated in Figure 4-40.
)
Figure 4-39 Confirming the Check-In Request
)
Figure 4-40 Systems Manager Devices Page After Check-In Request Sent
You can now see that this device has successfully completed check-in, with a new check-in time of 7:54 a.m., as demonstrated in Figure 4-41.
)
Figure 4-41 Successful Check-In with Updated Time
If you would like to know more about limited access roles, please check out https://documentation.meraki.com/SM/Other_Topics/Limited_Access_Roles. For more information on Meraki Systems Manager, refer to Chapter 11, “Securing End-User Devices.”