Endpoint Console Guide

The admin console is where operators run CtrlOne day to day. This guide tours the main areas and explains the role and tenant model that governs who can do what.

Dashboard and devices

The dashboard gives a per-tenant summary - device counts, recent alerts, operator activity, agent-version mix, and billing or storage usage - so you can see fleet health at a glance. The devices area lists every managed PC, with detail pages for each device, saved views, and bulk actions for reassigning or removing machines at scale.

Operator roles

Access is governed by a five-role matrix. Each role carries a specific set of permissions, enforced server-side on every action, so a lower-privilege operator cannot reach data or controls outside their remit.

  • Owner - full control of the tenant, including operators and billing.
  • Admin - manage devices, policies, and most settings.
  • Helpdesk - day-to-day device operations and support tasks.
  • Auditor - review posture, audit logs, and compliance evidence.
  • Viewer - read-only visibility, scoped so fleet-wide totals don't leak.

Multi-tenant management

CtrlOne is multi-tenant. Each customer's devices, policies, and evidence are isolated by tenant, with a master-admin view for providers who manage many tenants. Per-tenant storage quotas and soft-archiving keep large deployments tidy.

The agent-console desktop

Alongside the web console there is an optional desktop Agent Console for the managed PC itself. It talks to the local agent over a loopback bridge, so a technician at the machine can review and apply policy locally - useful for offline or hands-on support. It is distributed as its own download, separate from the agent installer.

Frequently asked questions

Can I limit what a support technician can do?

Yes. Assign the helpdesk or viewer role. Permissions are enforced server-side, so the UI and the API both respect the operator's role.

How are tenants kept separate?

Every device, policy, and evidence record is scoped to a tenant and authorization is checked on each request, so one tenant's operators cannot see or act on another's.

Do I need the desktop app?

No - it's optional. The web console manages everything remotely; the desktop app is for local, at-the-machine review and apply.

Configure your first policy

Head to the policy configuration guide to build, version, and roll back the restrictions your devices enforce.