In this chapter, you learn the following:
The organizational hierarchy and the built-in access levels available in Meraki Dashboard
The various roles available in Meraki Dashboard
How to configure role-based access control (RBAC) within Meraki Dashboard to adhere to the principle of least privilege
The principle of least privilege and role-based access control (RBAC) are key themes across industry best practices. RBAC is an essential feature that enables you to assign appropriate access rights to users based on their roles and responsibilities. Practical use cases for differentiated administrative roles include the following:
Providing help-desk staff with limited access to Dashboard to be able to collect vital troubleshooting information, thereby enabling incidents to be resolved faster.
Providing CCTV operators with the access they need to view and edit footage, while limiting access to network settings.
Assigning limited read-write access for junior administrators. Having fewer admins with full access at the organizational level reduces the likelihood of mistakes that can have a wide-ranging impact.
Meraki Dashboard incorporates RBAC, providing a built-in way to precisely control administrative access to specific parts of the Meraki organization. In addition to the built-in roles, you can create distinct and granular roles if required.
Meraki Dashboard’s Administration Hierarchy
Meraki Dashboard administrator privileges are controlled at the organization and network levels:
Organization administrators have visibility of the organization and all its networks. Organizational admins do not necessarily have the highest permissions. Access can be restricted; for example, it is possible to have an organizational administrator with only read-only access.
Network administrators have visibility of individual networks. Network administrators can have complete or limited control over these networks but do not have access to organization-level information (licensing, device inventory, and so on) unless granted such access at the organization level.
The privileges grant control over what a user can see and do in Meraki Dashboard. Permissions granted at the organization level cannot be reduced at the network level. If required, a user can have access to multiple networks and multiple organizations. We cover how to assign access to multiple networks later in the section titled “Assigning Permissions Using Network Tags.”
For more information on the Meraki Dashboard’s hierarchical structure, see https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Meraki_Dashboard_Organizational_Structure.