Skip to main content
Version: 5.7

Roles: access and administration rights

The roles that can be assigned to users are:

  • Access rights to applications (webmail, contacts, etc.)
  • rights to use specific features (creating an external identity, enabling automatic email forwarding, etc.)
  • administrative rights in order to delegate the management of certain areas (users, domain, etc.).
info

To assign roles to users, see the pages Edit users and Editing Groups.

The different administrators​

The platform administrator​

Also known as admin0, global administrator or super-administrator, this is the only such role in BlueMind and has the username admin0@global.virt. This role is responsible for the technical aspects of the platform.

They do not have a user account; when they log in to BlueMind, they only access the administration console. They are responsible for the installation and technical configuration of domains: server addresses, disk space, specific scheduled jobs, etc. They also have access to the same management functions as the functional administrator.

The ‘admin0’ account is created automatically and cannot be configured.

The system administrator​

The system administrator is a user who has been assigned the role of Gestionnaire système either individually or via a group. They are responsible for managing the entire BlueMind installation and its configuration.

The system manager has rights equivalent to those of ‘admin0’. In particular, they have full access to user accounts, settings and data – including emails, contacts and calendars – right down to the details of their private events.
The fact that a system manager can access applications may also cause technical issues.

For reasons of privacy and to avoid technical conflicts, it is strongly recommended that you create users dedicated to system management, WITHOUT ACCESS TO THE MAIL APP, CONTACTS AND CALENDAR APPLICATIONS.

System administrator settings​

  • Assign the default group admin (optional)

  • Ensure that the roles ‘ Messagerie et Contacts ’ and ‘ Agenda et Tâches ’ are deselected

    💡 The user must therefore not be a member of the user group or any group with these rights.

  • Tick the role Gestionnaire système or only the desired inherited roles

    💡 Although not recommended, a user may hold application roles and roles inherited from Gestionnaire système without causing any conflict.

  • Tick the role console d'administration

Warning message

In the event of a conflict between application roles and the Gestionnaire sytème role, a warning message is displayed at the time of saving:

The domain functional administrator​

Commonly referred to as the domain administrator, this is a user who has been assigned domain management roles (see below), either individually or via a group.

Several users may hold the role of functional administrator within the same domain.

The functional administrator manages users, groups and resources via the BlueMind administration console, as well as the configuration of the domain and shared objects (mailboxes, calendars, address books). They can delegate their rights by creating additional administrators (see Organizational Units and Delegated Administration for further details)

Domain administrator settings​

Assignable roles​

Administration​

  • System Manager: enables management of the entire BlueMind installation and its configuration

    ⚠️ The user must only access the administration console​

    This role must not be assigned to a user who has access to the mail app, contacts and calendar applications.
    See the section ‘The system administrator’ above for further details

    • Monitoring console: access to the monitoring console
    • Certificate management: allows you to manage the SSL certificate (see the page SSL Certificates)
    • Management via DataProtect: allows access to the DataProtect interface to restore data across the entire domain
    • Manage system configuration: provides access to the System configuration
    • Manage your BlueMind subscription: allows you to install and update BlueMind Subscription
    • Managing domains
      • Domain administrator
        • Performing restores via DataProtect: allows access to the DataProtect interface in order to restore data for the entire domain (users, shared mailboxes, etc.) - For further information see Single-user restoration - DataProtect Navigator
        • Managing external users: allows you to create and manage external users
        • Manage shared mailboxes: allows you to create, edit or delete shared mailboxes
          • Manage shared mailbox sharing rights: allows you to modify the sharing rights for shared mailboxes
        • Manage domain calendars: allows you to create, edit and delete domain calendars
          • Manage domain calendar sharing: allows you to modify the sharing rights for domain calendars
        • Managing domain address books: creating, editing and deleting domain address books (see Internal Address Books)
          • Manage domain address book shares: allows you to modify the sharing rights for domain address books
        • Managing external LDAP address books: allows you to create, edit or delete domain address books synchronised with an external LDAP server (see LDAP Synchronization)
        • Manage S/MIME domain certificates: allows you to Configuring S/MIME
        • Manage groups: allows you to create, edit and delete groups (see the page Editing Groups )
          • Manage group members: allows you to add and remove members from groups
          • Manage group shares: allows you to assign, modify or remove sharing rights on group mailboxes
        • Manage resources: allows you to create, edit or delete resources (see the page Resources)
          • Manage resource sharing: allows you to modify resource sharing rights
        • Manage resource types: allows you to create, edit or delete resource types
        • Manage organizational units: allows you to create and delete organizational units, which are used for the delegation of administration (see the page Organizational Units and Delegated Administration)
          • View organizational units: allows you to view organizational units but not to make changes to them or create new ones
        • Manage users: allows you to create, edit and delete users
          • Manage external accounts: allows you to manage users’ external accounts for applications that require them to log in (for example, Connecting with Nextcloud for its Drive service, Teams for video conferencing, etc.)
          • Manage user subscriptions: allows you to modify users’ subscriptions to shared address books and calendars
          • Manage users’ devices (ActiveSync): allows you to grant or revoke EAS synchronisation permissions for users’ third-party devices
          • Manage user identities: allows you to add, edit or delete user identities
          • Manage user information: allows you to edit user information intended to appear in the directory (profile photo, name, contact details, etc.)
          • Manage user passwords: allows you to change user passwords (see Editing users > Password)
          • Manage user settings: allows you to modify users’ personal settings
          • Manage user sharing: allows you to manage sharing rights for users’ mailboxes, address books and calendars
          • Manage External ID: grants edit access to the External ID field in the user record so that it can be modified
          • Mailbox indexing: makes it possible to run the mailbox indexing operation for users
          • Validate user: allows you to initiate the user validation and repair operation

  • Manage servers: provides access to the “Application servers” section of the administration console; allows you to add and remove servers, as well as modify their settings and roles (see Managing Servers)

  • Managing maximum domain values: managing the maximum number of users permitted on the domain within its General configuration

  • Sudo (privilege escalation): allows you to log in to BlueMind on behalf of users without knowing their password

Access to applications​

  • [obsolete] Mail app and Contacts: this role is no longer supported by BlueMind – users have access to mail even if this box is not ticked
  • Calendar and Tasks: enables the use of the Calendar and Tasks applications
  • Mobile synchronisation: enables you to connect and synchronise mobile devices
  • CalDAV and CarDav synchronisation: allows the CalDAV and CarDav protocols to be used to synchronise third-party devices or software, after verifying their Compatibility
  • Thunderbird connector synchronisation: allows you to download and use the Thunderbird connector
  • Outlook synchronisation: allows you to connect Outlook after the Implementing MAPI for Outlook
  • Telephony: enables the use of telephony integration within web applications
  • Administration console: provides access to the administration console – required for all management roles
  • Manage corporate signatures: provides access to the signature and disclaimer management application
  • API Docs integration: provides access to the API documentation integrated into BlueMind: an ‘API Docs’ link is added to the top banner of BlueMind, alongside the other applications

General​

  • Edit settings: allows the user to change their BlueMind preferences and Set up your user account
  • Change password: allows the user to change their password at any time
  • Editing personal details1: allows the user to edit the details that will be visible in their directory profile
  • API access to manage their ActiveSync devices1: allows the user to manage access to their own devices via EAS (Exchange ActiveSync) synchronisation
  • Managing external accounts: allows you to link an external account for applications that require a connection to it (for example, Nextcloud or Alfresco for Adding attachments, Teams for video conferencing, etc.)

Mail​

  • Access to the new webmail: allows the user to use the webmail developed by BlueMind

  • Enable S/MIME on webmail: allows the user to Enabling S/MIME encryption and to send and receive encrypted and/or digitally signed emails

  • View domain filters: displays the Domain filters in the user preferences management interface

  • Global delegation permissions: allows the user to send emails either “on behalf of” (Write from me) or “as” (Write as me) any e-mail address within the domain — generally used for service accounts or accounts used for automated mailing systems

  • Managing mail filters: allows the user to Applying sorting and action filters on their emails

  • Managing email identities: allows the user to create and configure their email identities using their main address, an alias or a shared mailbox (see the page Managing Account Identities)

  • External identity: allows the user to create identities using an external address as the issuer 2

  • Forwarding emails to external addresses: allows all received emails to be automatically forwarded to an email address outside the domain.

    Internal transfer​

    When this role is disabled, the user can enable global forwarding of their mail to internal addresses only.

Cloud​

  • Drive: option to retrieve and resend attachments previously detached by the user and stored on the server
  • Detached attachments: option to detach attachments from emails so that they are presented to recipients as download links

For further information see the page Adding attachments.

Videoconferencing​

  • Collaborative video conferencing: when the BlueMind Video application is installed, this allows the user to create video conferences with no time limit and up to 100 participants (see Video Conference with BlueMind Video)

Find out more​

Related BlueMind documentation pages

Footnotes​

  1. Note: No interface is currently available for managing the user’s BlueMind settings; this functionality only allows actions to be performed via scripts using the user’s API key (see Manage API keys in the user settings) ↩ ↩2

  2. Mail addresses for other domains in the system are considered external addresses. Also, assigning the "External identity" role (see Mail roles) to a user enables him, for example, to create an identity from the mail address of a member of another domain, and thus send emails in that user's name.

    ↩