For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/roles/administrator.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Administrator Guide

    Administrators work at two scopes. System Admin is a platform-wide system role; Organization Admin is scoped to one organization. A user may hold both. See Role Model for how system and organization roles combine.

    Administrator roles

    RoleScopeWhat it grants
    System AdminSystemHighest system administrator; all functional permissions across organizations
    Organization AdminOrganizationConsole, Audits, and Workbench within one organization

    System Admin

    System Admin can use every module and every organization. The role is intended for platform operators who configure the deployment, manage organizations and roles, and handle cross-organization access and audit requirements.

    • General — organization switching, search, profile, and dashboards
    • Console — users, groups, assets, accounts, authorizations, ACLs, and tags
    • PAM — account automation, security, integrations, and activity
    • Audits — sessions, activities, job and ticket audits, and reports
    • Workbench — job center, tickets, and tools
    • System Settings — organizations, roles, authentication, storage, components, and license
    • Client — Luna, desktop client, connectors, and troubleshooting

    Key System Settings pages:

    TaskPage
    Manage organizationsOrganizations
    Manage system and organization rolesRoles
    Configure authenticationAuthentication
    Configure security policySecurity
    Import or review the licenseLicense

    Organization Admin

    Organization Admin is scoped to a single organization. It can administer that organization's identity, assets, access policy, and audit views, but it does not change platform-wide settings or other organizations.

    Console

    Audits

    Workbench

    General

    Scope boundaries

    • System Settings, PAM lifecycle automation, and cross-organization audits are platform-level concerns. Use System Admin (or a custom role with the required permissions).
    • Organization Admin sees only the active organization. Switch organizations before managing records that belong to another organization.
    • Built-in roles cannot be edited or deleted. Create or clone a custom organization role when the default permissions do not fit.

    Assigning administrator roles

    1. Assign System Admin on the user's system roles for platform-wide administration.
    2. Invite the user to an organization with Organization Admin for organization-scoped administration.
    3. Review the role combination in Role Model before granting both.