---
updatedAt: 2026-07-16T20:42:41.000Z
---

# Roles | EPM-L

## What are roles?

Roles are a set of permissions, responsibilities, or actions assigned to a user, process, or system component in EPM for Linux that can control access, manage frameworks, and help define what entities can and cannot do in the software.

### Available roles

[block:parameters]
{
  "data": {
    "h-0": "Role name",
    "h-1": "Typical responsibilities",
    "h-2": "Key functions",
    "h-3": "Access rights",
    "0-0": "sysadmin",
    "0-1": "Configures and manages the Endpoint Privilege Management system.  \nSets up users, groups, and roles.  \nDefines and enforces privilege policies.  \nMonitors system health and usage logs.",
    "0-2": "Policy creation and deployment.  \nIntegration with directory services (e.g., LDAP, Active Directory, Microsoft Entra ID).  \nSystem updates and maintenance.",
    "0-3": "Full access to all pages in EPM for Linux.  \n  \nFull rights (**create**, **view**, **update**, and **delete**) to all pages in EPM for Linux.",
    "1-0": "policyadmin",
    "1-1": "Designs and implements policies for managing privileges on Linux endpoints.  \nEnsures compliance with organizational and regulatory requirements.",
    "1-2": "Defines rules for privilege elevation or restriction.  \nCreates workflows for just-in-time access requests.  \nAudits policies for effectiveness and compliance.",
    "1-3": "Full access to all policy management pages (**Roles**, **Secure Users**, **Secure Groups**, **Command Groups**, **Host groups**, **Schedule Groups**, **Entitlement Reports**) in EPM for Linux.  \n  \nFull rights (create, view, update, and delete) to the above pages in EPM for Linux.",
    "2-0": "auditor",
    "2-1": "Reviews logs and audit trails to ensure adherence to privilege policies.  \nIdentifies anomalies or potential misuse of privileges.",
    "2-2": "Analyzes user activity and system logs.  \nPrepares reports for audits or security reviews.  \nFlags potential policy violations for investigation.",
    "2-3": "Full access to all audit pages (**Unified Search**, **Events**, and **Search and Replay**) in EPM for Linux.  \n  \nFull rights (**create**, **view**, **update**, and **delete**) to the above pages in EPM for Linux.",
    "3-0": "accountadmin",
    "3-1": "Day-to-day use of the Linux system with role-appropriate privileges.  \nRequests temporary privilege escalation when needed.",
    "3-2": "Manages users and role assignments.",
    "3-3": "Full access to the **EPM-L Settings** page.  EPM for Linux.  \n  \nFull rights (**create**, **view**, **update**, and **delete**) to the above page in EPM for Linux.",
    "4-0": "apiuser",
    "4-1": "Connects the privilege management system to other tools and platforms.  \nEnsures seamless functionality across systems.",
    "4-2": "Configures APIs for custom integrations.  \nSynchronizes data with SIEM tools, ticketing systems, or identity providers.  \nTroubleshoots connectivity or integration issues.",
    "4-3": "Minimal access to the EPM for Linux pages.",
    "5-0": "softwareadmin",
    "5-1": "Provides first-line support for users experiencing issues with privilege management.  \nFacilitates access requests or resolves minor system issues.",
    "5-2": "Assists with privilege elevation requests if automated mechanisms fail.  \nEscalates complex issues to administrators or policy managers.  \nEducates users on the privilege management system.",
    "5-3": "Full access to the **Installers** page in EPM for Linux.  \n  \nFull rights (**create**, **view**, **update**, and **delete**) to the above pages in EPM for Linux.",
    "6-0": "Custom role",
    "6-1": "Organizations may define custom roles tailored to their specific needs. ",
    "6-2": "Examples:  \n_DevOps Role:_ Manages privileges specific to development and operations teams.  \n_Incident Responder:_ Has temporary elevated access for responding to security incidents.",
    "6-3": ""
  },
  "cols": 4,
  "rows": 7,
  "align": [
    "left",
    "left",
    "left",
    "left"
  ]
}
[/block]

## How are roles useful?

Use roles to streamline operations, enforce security policies, and effectively manage access for your EPM for Linux users.

## Important information about roles

When you edit an existing role, the edits apply to all users, hosts, and groups with the role.

> ℹ️
>
> Edit and assign allowed **users** (*Who*), **command groups** (*What*), **hosts** (*Where*), and **schedule** (*When*) to a role.
>
> Each role can have zero to many relationships with each entity type. This is managed using the lists matching the appropriate entity. The following configuration sections are available when editing role assignments:
>
> #### WHO
>
> Defines which users the policy applies to. This item is divided into two user types, **Submit Users** and **Run Users**, and these lists contain the user entities.
>
> Select **Use Default Group and Working Directory** to automatically populate the run users in a script block on the **Script Policy** page. Changing the block properties is not recommended.
>
> #### WHAT
>
> Defines which commands the policy applies to. This list contains the command entities.
>
> #### WHERE
>
> Defines which hosts the policy applies to. This item is divided into two host type, **Submit Hosts** and **Run Hosts**, and these lists contain the host entities.
>
> #### WHEN
>
> Defines which schedule the policy applies to. This list contains the schedule entities.

## Add a new role

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Select **Start Policy Edits**.\
   The **Start Policy Edits** page displays.

5. Enter a reason for the edits and select **Continue Editing**.

6. Select **Add Role**.\
   The **Roles** panel displays.

7. Enter a **Role name** and **Description**.

8. Click **Create Role** to create the role, or click **Create And Edit the Role** to configure it.\
   If you create the role, the role displays in the list on the **Roles** page.\
   If you create and edit the role, the **Edit Role** page displays.

9. Click **Save**.\
   The role and its configuration saves, and the role displays in the **Role** list on the **Roles** page.

## View a role's details

View a snapshot of a role's configurations.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to view.

5. Click ![](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> View Role Details**.\
   The **Roles** panel displays with a snapshot of the role's configurations.

## Edit a role's general details

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page opens and the **General** tab displays.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/6eb5b4fda0261cdca11e2e88fffa0f2752751fb1564e78c2ff7e02dd2d2ab248-edit-role-details.png",
        "",
        "The Edit Role page in Endpoint Privilege Management for Linux"
      ],
      "align": "center"
    }
  ]
}
[/block]

3. Modify any of the following:
   * **Role name:** A unique name.
   * **Tag:** Tags function as a filter. Use them to sort through policy roles.
   * **Description:** A brief description to identify the role.
   * **Comment:** Comments are only visible to users with the Administrator role.
   * **Role Risk Level:** The perceived risk level of the policy, from 0 - 50.
   * **Request Type:** Allows the administrator to specify which request types this policy will apply to (for example, a policy might apply to commands issued only by **pbrun** invocations).\
     Use the dropdown to select the appropriate request type, or select **Any**. The default value is to allow any request type.
   * **Policy:** Enable or disable the role (default is **Enabled**).
   * **Action:** Select whether this role triggers an **Accept** or **Reject** action (default is **Accept**).
   * **Entitlement Reporting:** Enable or disable entitlement reporting on this role (default **Disabled**).
4. Click **Save**.\
   Changes apply immediately to the role and affect all users, hosts, and groups with the role.

## Edit role assignments

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. In the left panel, click **Assignments**.\
   The **Assignments** page displays.

7. Modify the **Who** (users and groups), **What** (command groups), **Where** (hosts), and/or **When** (schedule) for the role.

8. Click **Save**.\
   The role assignments save and apply to all users, groups, and hosts with that role.

## Edit a role's reauthentication

If configured, this feature requires users to reauthenticate themselves when this policy is invoked. Only one reauthentication method can be configured per policy. Most reauthentication options allow for customization of messages and prompts to be displayed to the user as well as logs. Reauthentication can be enabled in a number of configurations:

* **None:** Reauthentication is not required.
* **Shared Secret:** Create a shared secret value. The user must provide the secret to reauthenticate.
* **Privilege Access Management (PAM):** A number of PAM modules can be selected, or a custom one can be provided. Additionally, most options allow the user to configure where the authentication will occur.

### Configure a Shared Secret reauthentication option

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. From the left panel, click **Reauthentication**.\
   The **Reauthentication** page displays.

7. In the **Type** dropdown, select **Shared Secret**.

8. Enter the **Shared Secret** and confirm it.

9. Enter a **Reauthentication Prompt** message, or use the default.

10. Enter the **Number of attempts** (retries) before reauthentication locks the user out.

11. Enter the **Failure Message** the user sees if reauthentication fails, or use the default.

12. Enter the **Log Message** you want recorded in the log when reauthentication fails, or use the default.

13. Click **Save**.\
    The reauthentication method and details save and are applied to all users, groups, and hosts with the role.

### Configure a PAM reauthentication option

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. From the left panel, click **Reauthentication**.\
   The **Reauthentication** page displays.

7. In the **Type** dropdown,  select **PAM**.

8. Select the **PAM Service** to use for authentication.

9. Select the **Location** to use, where the authentication happens.
   > ℹ️
   >
   > If you select the **Run Host** option, you only need to complete the next two steps, then click **Save**.

10. Select the **User To Be Authenticated**.\
    If you select **Custom**, enter a custom user name.

11. Enter a **Reauthentication Prompt** message, or use the default.

12. Enter the **Number of attempts** (retries) before reauthentication locks the user out.
    > ℹ️
    >
    > This may depend on the policies imposed by the authentication services that EPM for Linux accesses through PAM.

13. In the **Valid for (seconds)** box, enter the length of time you want the reauthentication attempts cached before a login is required again.

14. Enter the **Failure Message** the user sees if reauthentication fails, or use the default.

15. Enter the **Log Message** you want recorded in the log when reauthentication fails, or use the default.

16. In the **Change requested by \[loggedInUserName]** field, enter a reason for the assignment or change.

17. Click **Save**.\
    The reauthentication method and details save and are applied to all users, groups, and hosts with the role.

## Add or edit a role message

Use messages to output a message to the user when this policy is processed. This field can use variables to provide a custom, context-specific message using the EPM for Linux template syntax of **`%\<variable>%`**. A few options are available using buttons to quickly insert the most popular options. Values can also be entered freely.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. In the left menu, click **Messages**.\
   The **Messages** page displays.

7. Enter a message in the **Accept and Reject Messages** field.

8. Optionally, click one of the standard messages to the right of the **Accept and Reject Messages** field.

9. Click **Save**.\
   The message saves and is applied to all users, groups, and hosts with the role.

## Edit a role's Session Replay settings

Use the session replay settings to preview the file location for your iologs, which log standard input, standard output, and standard error information that is associated with the current task request.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. From the left menu, click **Session Replay**.\
   The **Session Replay** page displays.

7. Toggle the **Session Replay**on to save iologs logs.\
   The file location for your iologs displays in the **Preview** section.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/272a8278a31e39bfde2e5ed6183334970f07f9a11902fb09c8bd9997ec2eb624-turn-on-session-replay.png",
        "",
        "Turn on session replay for a role in EPM for Linux"
      ],
      "align": "center"
    }
  ]
}
[/block]

8. Click **Save**.

## Create or edit a custom script policy for a role

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to modify.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Edit Role**.\
   The **Edit Role** page displays.

6. From the left menu, click **Script Policy**.\
   The **Script Policy** page displays.

7. Enter your script policy.

8. Click **Save**.\
   The policy saves and is applied to all users, groups, and hosts with the role.

## Duplicate a role

Duplicate a role to create a new role with all field values (including assignments of host groups, command groups, user groups, and schedule groups) retained from the original role.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to duplicate.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Duplicate Role**.\
   The **Duplicate Role** page displays with the **General** tab open by default.

6. Rename the Add a new role name. Duplicate role names are not permitted. By default, the name is *Copy of (original role name)*.

## Delete a role

> 🛑 WARNING
>
> Deleting a role is an unrecoverable operation.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Locate the role you want to delete.

5. Click ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Delete Role**.\
   A confirmation message displays.

6. Click **DELETE**.\
   The role is immediately removed and all users, groups, and hosts with that role are no longer assigned to it.

## Move roles

Change the ordering of roles on the **Roles** page using cut and paste options.

Roles can also be moved by selecting and dragging the role to the preferred location in the list.

1. Sign into **app.beyondtrust.io**.\
   The **BeyondTrust Home** page displays.

2. Click ![Pathfinder navigation menu](https://files.readme.io/2b07f6281d5ecf5876fe350ed9437777bc2a32fd33361a3c525eca8f01648b3d-image.png) **> Endpoint Privilege Management for Linux > Policy**.\
   The **Role Based Policy** page displays.

3. Click the **Roles** tile.\
   The **Roles** list displays.

4. Select a role in the list and select  ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Cut Role**.

5. Navigate to the location in the **Roles** list.

6. Select  ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Paste Role Above** or  ![Menu icon](https://files.readme.io/eccdb0577bf70b3dd701dc6ae7172da3098bbb0e6ce89e1493d35061c4eda74a-image.png) **> Paste Role Below**.

7. To cancel, select **Clear Clipboard**.