Home
Personnel

How Do Roles Work in Dusk FSM?

## Overview of Roles in Dusk FSM

Roles in **Dusk FSM** define **user access and permissions**. They determine which information, modules and functions a user can access across the platform.

Roles can be assigned directly to Staff or inherited through **Teams**, allowing organizations to manage permissions at both an individual and group level.

Dusk FSM supports multiple Roles per user, with permissions combined across individual Roles and Team memberships. This provides flexibility for Staff who perform different responsibilities or belong to multiple Teams.

---

### Video tutorial

This video walks through how to create, assign, and manage Roles in Dusk FSM.

---

## Why use Roles

Roles help you:

* Control which information and functions users can access.
* Define who can view, edit or manage specific areas of Dusk FSM.
* Improve security and reduce accidental changes.
* Support auditing and access management at scale.
* Apply consistent permissions across Teams.
* Manage Staff who have multiple responsibilities or work across different Teams.
* Align access with your organizational structure or identity provider.

---

## What Roles control

Roles apply across both the **Dusk FSM Web Console** and the **Mobile App**.

They let you control:

* Access to modules, pages and tools.
* Which records a user can view or edit.
* Which dashboards appear for a user.
* Which Forms a user can access or administer.
* Whether the user can administer system settings.
* Whether users can export data or access the API.
* Whether Staff and Contractors can receive field Work and participate in optimization.

Each Role consists of permissions that determine the functions available to users assigned that Role.

**Important:** A user's effective permissions may come from several Roles, including Roles assigned directly to their Staff profile and Roles inherited through Team membership.

---

## Default Roles and custom Roles

Dusk FSM includes default Roles such as Administrator, Supervisor and Field Staff. You can use these as provided or update them to match your organization's requirements.

* Most default Roles can be edited.
* New Roles can be created using the **Role** button.
* The Administrator Role name is fixed and cannot be deleted or renamed.
* The Administrator Role can be duplicated to create other high-privilege Roles.
* Roles can be assigned to individual Staff or through Teams.
* Multiple Roles can contribute to a user's effective permissions.

---

## Create or edit a Role

1. Go to **Admin → Personnel → Roles**.
2. Select an existing Role to edit, or select **Role** to create a new one.
3. Enter a Role name and description.
4. Configure the required permissions, such as:
   * Portal access.
   * Mobile App access.
   * Dashboard visibility.
   * Form access.
   * Export access.
   * API access.
   * Administrator access.
   * Eligibility to receive field Work.
5. Select **Save**.

> **Tip:** Use Role descriptions that clearly explain their purpose. For example, "Can view dashboards and Work but cannot edit system configuration."

![Dusk FSM Roles](https://help.duskmobile.com/uploads/markdown/20250725-222239-525.png "Dusk FSM Roles")

---

## Web Console permissions

Web Console permissions control which functions users can access through the Dusk FSM portal.

Common permissions include:

* **Has access to the portal** — Enables access to the Web Console.
* **Has administrator access** — Grants Administrator-level access across the platform.
* **Can receive field work** — Allows Staff and Contractors to be assigned field Work and included in optimization.

You can also assign dashboards to Roles. These dashboards appear as tabs or tiles for users with the relevant Role permissions.

![Dusk FSM Roles](https://help.duskmobile.com/uploads/markdown/20261019-170539-896.png "Dusk FSM Roles")

### Can receive field work

The **Can receive field work** permission determines whether users assigned the Role are eligible to receive field Work.

When enabled, users with this permission can:

* Be assigned Work manually.
* Be included in **Optimize Now (Stage 1)**.
* Be included in **Schedule Optimizer (Stage 2)**.
* Be included in **Dynamic Optimizer (Stage 3)**.

This permission helps organizations control which Staff and Contractors can be considered for field assignments and automated scheduling.

For example, an organization may have office-based Staff who require access to Work records but should not be considered for field assignments. Their Roles can provide the appropriate Work access without enabling **Can receive field work**.

Conversely, field technicians and Contractors who need to receive assignments should have this permission enabled through an appropriate Role.

> **Important:** Because permissions are combined across Roles and Teams, a user only needs to receive **Can receive field work** from one of their assigned Roles or Team memberships to be eligible. Disabling it in another Role does not remove that eligibility.

---

## Mobile App permissions

Role permissions extend to the Mobile App, allowing granular control over:

* Which mobile features each Role can access.
* Which Forms are visible to each Role.
* Mobile-specific workflows and views.
* Field Work functionality available to Staff and Contractors.

![Dusk FSM Mobile Access Roles](https://help.duskmobile.com/uploads/markdown/20250725-222411-328.png "Dusk FSM Mobile Access Roles")

---

## Form access and Staff assignments

For each Role, you can define which Forms are accessible. You can also view which Staff members are currently assigned to the Role.

Form permissions help distinguish between users who need to access or complete Forms and users who require additional administrative capabilities.

![Dusk FSM Role Access](https://help.duskmobile.com/uploads/markdown/20250725-222443-109.png "Dusk FSM Role Access")

> **Tip:** When reviewing Form permissions, check all Roles assigned to the Staff member, including Roles inherited through Teams.

---

## Export and API access permissions

Roles can control whether users can export data and whether they can access the API.

These settings help limit how data can be extracted or integrated outside Dusk FSM and ensure that users have the appropriate permissions for external data functions.

![Data Export Permissions](https://help.duskmobile.com/uploads/markdown/20251117-192051-584.png "Data Export Permissions")

When configuring API access, review the user's effective permissions rather than only their individual Role.

---

## Assign Roles to Staff

Roles can be assigned directly from within each Staff profile.

1. Go to **Personnel → Staff**.
2. Select a Staff member.
3. Open the **Roles** tab.
4. Select one or more Roles to assign.
5. Select **Save**.

If a Staff member has multiple Roles, their effective access reflects the combined permissions granted by those Roles.

Staff may also receive additional permissions through Team membership.

---

## How Roles and Teams work together

Dusk FSM allows permissions to be managed through both **individual Staff Roles** and **Team Roles**.

This is particularly useful for organizations with regional Teams, operational departments or Staff who work across multiple Teams.

### Individual Roles

Individual Roles are assigned directly to a Staff member through their Staff profile.

The permissions granted by these Roles form part of the user's effective access.

If multiple Roles are assigned, their permissions are combined.

### Team default Roles

Teams can have default Roles that are inherited by their members.

When a Staff member belongs to a Team, they receive the permissions granted by that Team's default Roles unless member-specific Roles have been configured for them within that Team.

### Member-specific Team Role overrides

Dusk FSM allows an Administrator to assign different Roles to an individual member within a Team.

When member-specific Roles are configured:

* They **replace that Team's default Roles** for that member.
* They apply only to that particular Team membership.
* They do not remove permissions granted through the Staff member's individual Roles.
* They do not remove permissions granted through other Teams.
* Multiple Roles can be assigned to the member within that Team.

This allows an organization to configure exceptions to a Team's default permissions without changing the permissions of every Team member.

### Example: Different Roles within the same Team

A Field Operations Team has a default Role that allows members to manage Work.

Most members inherit the Team's default Role.

However, a Contractor who belongs to the same Team only needs to view and complete assigned Work.

An Administrator can assign a more appropriate Role to that Contractor on their Team membership.

The Contractor then receives the member-specific Role permissions **instead of that Team's default Role permissions**.

Any permissions the Contractor receives from individual Roles or other Teams remain in effect.

---

## How multiple Teams affect permissions

A Staff member can belong to multiple Teams.

When this happens, Dusk FSM combines the permissions granted through each Team membership with the Roles assigned directly to the Staff member.

For each Team, Dusk FSM uses either:

* The Team's default Roles, or
* The member-specific Roles configured for that Staff member.

It does not combine both sets of Roles from the same Team when a member-specific override is configured.

### Example: Staff working across multiple regions

A Staff member belongs to both the Northern Operations Team and Southern Operations Team.

The Northern Operations Team provides permissions to manage Work.

The Southern Operations Team provides permissions to view operational dashboards.

The Staff member receives the combined permissions from both Teams, along with any Roles assigned directly to their Staff profile.

If the Staff member's Roles are changed within the Northern Operations Team, their permissions inherited from the Southern Operations Team remain unchanged.

---

## Understanding effective permissions

A user's **effective permissions** are the complete set of permissions they receive from all applicable Roles and Team memberships.

Dusk FSM uses an **additive permissions model**.

This means permissions granted through different sources are combined.

| Permission source | How it contributes |
| --- | --- |
| Individual Staff Roles | Adds permissions granted directly to the Staff member. |
| Team default Roles | Adds permissions inherited through Team membership when no member-specific Roles are configured. |
| Member-specific Team Roles | Replaces the default Roles for that Team membership and contributes the permissions of the selected Roles. |
| Additional Teams | Adds permissions from each additional Team membership. |

### Important: Roles do not remove permissions granted elsewhere

Assigning a Role with fewer permissions does not automatically restrict a user if they already receive additional permissions from another Role or Team.

For example:

A Staff member has a Viewer Role assigned directly to their profile but belongs to a Team that grants Administrator access.

The Staff member will still have Administrator access because it is granted through their Team membership.

Changing their individual Role to another restricted Role will not remove that Administrator access.

To restrict access, an Administrator must review **all Roles and Team memberships** contributing to the user's effective permissions.

---

## Administrator access through Teams

Administrator access can be inherited through Team membership.

For example, the **Default** and **Administrator** Teams may have the Administrator Role configured as their default.

Members of these Teams inherit Administrator access unless a different member-specific Role configuration replaces that Team's default.

### Restricting Administrator access for a Team member

To prevent a Staff member from inheriting Administrator access through a particular Team:

1. Open the relevant Team.
2. Locate the Staff member within the Team membership list.
3. Configure member-specific Roles that provide the appropriate level of access.
4. Save the changes.
5. Review the Staff member's other Team memberships and individual Roles.

> **Important:** Replacing the Administrator Role within one Team does not remove Administrator access granted through another Team or through an individual Staff Role.

This is especially important for Staff who belong to multiple Teams.

---

## Example Role setups

Here are common Role patterns you can use as a starting point:

* **Contractor:** Mobile App access, permission to receive field Work, and access to the functions required to complete assigned Work.
* **Field Technician:** Mobile App access, field Work permissions and relevant Form access.
* **Project Manager:** Web Console access, permission to create and manage Multi Task Work, and access to relevant dashboards.
* **Dispatcher:** Web Console access and the permissions required to plan, assign and dispatch Work.
* **Customer Viewer:** Limited access to view relevant Work completed for their organization.
* **Administrator:** Full access to settings and system functions.

When applying these Roles through Teams, remember that permissions from individual Roles and other Teams are also included.

---

## Frequently Asked Questions

### Can a Staff member have multiple Roles?

Yes. A Staff member can have multiple individual Roles, and Dusk FSM combines the permissions granted by those Roles.

Multiple Roles can also be assigned to a Staff member within an individual Team membership.

### Do Team permissions override individual Staff Roles?

No. Team permissions and individual Staff Role permissions are combined.

The exception is a **member-specific Team Role override**, which replaces the default Roles of that particular Team for that member.

### What happens if a Staff member belongs to multiple Teams?

The Staff member receives the combined permissions from all their Team memberships, along with their individual Roles.

### Can I assign a different Role to one member of a Team?

Yes. Assign member-specific Roles to that Staff member within the Team.

These Roles replace the Team's default Roles for that member only.

### Does a Team member Role override affect other Teams?

No. It applies only to the Team where the override is configured.

### Can an individual Role remove permissions inherited from a Team?

No. Individual Roles can add permissions but cannot remove permissions granted through Teams.

To change permissions inherited from a particular Team, configure the member-specific Roles for that Team or change the Team's default Roles.

### Why does a Staff member still have Administrator access after I change their Role?

They may be inheriting Administrator access through a Team or another individual Role.

Review their complete Role assignments and Team memberships.

### How do I include Staff in the Optimizer?

Ensure the Staff member has a Role with **Can receive field work** enabled.

This allows them to be considered for manual Work assignment, Optimize Now, Schedule Optimizer and Dynamic Optimizer.

### Does assigning a restricted Role prevent access granted by another Role?

No. Dusk FSM combines permissions from all applicable Roles and Teams.

A restricted Role does not cancel permissions granted elsewhere.

### Do existing Team permissions change automatically?

No. If no member-specific Roles are configured, the Staff member continues to inherit the Team's default Roles.

The member-specific override takes effect when Roles are configured for that member within the Team.

---

## Maintaining Roles over time

As your organization grows, Roles should be reviewed and updated to match changes in processes, responsibilities and Team structure.

Recommended practices include:

* Review individual Roles and Team memberships when Staff responsibilities change.
* Use Team default Roles to provide consistent access across groups.
* Use member-specific Team Role overrides when individual members require different permissions.
* Review all Team memberships before restricting a user's access.
* Check Administrator access inherited through Teams.
* Ensure field Staff and Contractors have **Can receive field work** enabled where appropriate.
* Keep Role descriptions short and clear.
* Review permissions when Staff join or leave Teams.

> **Security reminder:** A user's effective permissions are determined by the combination of their individual Roles and all Team memberships. Always review every source of permissions when restricting access.

---

## 🔗 Related Articles

* [What Are Teams and How Do I Manage Them in Dusk FSM?](https://help.duskmobile.com/article/Personnel/What-Are-Teams-and-How-Do-I-Manage-Them-in-the-Dusk-FSM)
* [How Do I Add Staff in the Dusk FSM](https://help.duskmobile.com/article/Personnel/How-Do-I-Add-Staff-in-the-Dusk-FSM)
* [How to Set Up Staff and Contractors in Dusk FSM Video Walkthrough](https://help.duskmobile.com/article/Personnel/How-to-Set-Up-Staff-and-Contractors-in-Dusk-FSM-Video-Walkthrough)
* [What Is Work in the Dusk FSM Platform](https://help.duskmobile.com/article/Work/What-Is-Work-in-the-Dusk-FSM-Platform)
* [How to Create Work in Dusk FSM](https://help.duskmobile.com/article/Work/How-to-Create-Work-in-Dusk-FSM)
* [How to View and Create Multi Task Work in Dusk FSM](https://help.duskmobile.com/article/Project-Management/How-to-View-and-Create-Multi-Task-Work-in-Dusk-FSM)
* [How to Set Up Microsoft Entra ID Single Sign On for Dusk FSM](https://help.duskmobile.com/article/Integrations/How-to-Set-Up-Microsoft-Entra-ID-Single-Sign-On-for-Dusk-FSM)

---

Updated on October 20, 2026

How Do Roles Work in Dusk FSM?

Need Support?

Error

Delete Article