> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Administrator Guide

Administrators work at two scopes. **System Admin** is a platform-wide system
role; **Organization Admin** is scoped to one organization. A user may hold
both. See [Role Model](https://www.jumpserver.com/docs/roles/role-model.md) for how system and organization roles
combine.

## Administrator roles

| Role               | Scope        | What it grants                                                                |
| ------------------ | ------------ | ----------------------------------------------------------------------------- |
| System Admin       | System       | Highest system administrator; all functional permissions across organizations |
| Organization Admin | Organization | Console, Audits, and Workbench within one organization                        |

## System Admin

System Admin can use every module and every organization. The role is intended
for platform operators who configure the deployment, manage organizations and
roles, and handle cross-organization access and audit requirements.

- [General](https://www.jumpserver.com/docs/features/general/index.md) — organization switching, search, profile, and dashboards
- [Console](https://www.jumpserver.com/docs/features/console/index.md) — users, groups, assets, accounts, authorizations, ACLs, and tags
- [PAM](https://www.jumpserver.com/docs/features/pam/index.md) — account automation, security, integrations, and activity
- [Audits](https://www.jumpserver.com/docs/features/audits/index.md) — sessions, activities, job and ticket audits, and reports
- [Workbench](https://www.jumpserver.com/docs/features/workbench/index.md) — job center, tickets, and tools
- [System Settings](https://www.jumpserver.com/docs/features/system-settings/index.md) — organizations, roles, authentication, storage, components, and license
- [Client](https://www.jumpserver.com/docs/features/client/index.md) — Luna, desktop client, connectors, and troubleshooting

Key System Settings pages:

| Task                                 | Page                                                                                                  |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------- |
| Manage organizations                 | [Organizations](https://www.jumpserver.com/docs/features/system-settings/general/organizations.md)    |
| Manage system and organization roles | [Roles](https://www.jumpserver.com/docs/features/system-settings/general/roles.md)                    |
| Configure authentication             | [Authentication](https://www.jumpserver.com/docs/features/system-settings/security/authentication.md) |
| Configure security policy            | [Security](https://www.jumpserver.com/docs/features/system-settings/security/security.md)             |
| Import or review the license         | [License](https://www.jumpserver.com/docs/features/system-settings/license.md)                        |

## Organization Admin

Organization Admin is scoped to a single organization. It can administer that
organization's identity, assets, access policy, and audit views, but it does not
change platform-wide settings or other organizations.

### Console

- [Users](https://www.jumpserver.com/docs/features/console/users/index.md) and [Groups](https://www.jumpserver.com/docs/features/console/users/groups.md)
- [Assets](https://www.jumpserver.com/docs/features/console/assets/index.md), [Zones](https://www.jumpserver.com/docs/features/console/assets/zones.md), and [Cloud Sync](https://www.jumpserver.com/docs/features/console/assets/cloud-sync.md)
- [Accounts](https://www.jumpserver.com/docs/features/console/accounts/index.md) and [Templates](https://www.jumpserver.com/docs/features/console/accounts/templates.md)
- [Authorizations](https://www.jumpserver.com/docs/features/console/policies/authorizations.md) and [ACLs](https://www.jumpserver.com/docs/features/console/policies/acls/index.md)
- [Tags](https://www.jumpserver.com/docs/features/console/tags.md)

### Audits

- [Asset Sessions](https://www.jumpserver.com/docs/features/audits/sessions/asset-sessions.md)
- [Session Commands](https://www.jumpserver.com/docs/features/audits/sessions/session-commands.md)
- [File Transfer](https://www.jumpserver.com/docs/features/audits/sessions/file-transfer.md)
- [Login Logs](https://www.jumpserver.com/docs/features/audits/activities/login-logs.md), [Password Change Logs](https://www.jumpserver.com/docs/features/audits/activities/password-change-logs.md), and [Operate Logs](https://www.jumpserver.com/docs/features/audits/activities/operate-logs.md)
- [Tickets Audit](https://www.jumpserver.com/docs/features/audits/tickets.md)

### Workbench

- [Access Assets](https://www.jumpserver.com/docs/features/workbench/my-assets/access-assets.md)
- [File Transfer](https://www.jumpserver.com/docs/features/workbench/my-assets/file-transfer.md)
- [Personal Credentials](https://www.jumpserver.com/docs/features/workbench/my-assets/personal-credentials.md)
- [Job Center](https://www.jumpserver.com/docs/features/workbench/job-center/index.md)
- [Tickets & Approvals](https://www.jumpserver.com/docs/features/workbench/tickets/index.md)

### General

- [Organizations](https://www.jumpserver.com/docs/features/general/workspace/organizations.md) — switch the active organization
- [Global Search](https://www.jumpserver.com/docs/features/general/workspace/global-search.md), [Notifications](https://www.jumpserver.com/docs/features/general/workspace/notifications.md), and [Profile](https://www.jumpserver.com/docs/features/general/account/profile.md)

## Scope boundaries

- **System Settings**, **PAM lifecycle automation**, and **cross-organization
  audits** are platform-level concerns. Use System Admin (or a custom role with
  the required permissions).
- Organization Admin sees only the active organization. Switch organizations
  before managing records that belong to another organization.
- Built-in roles cannot be edited or deleted. Create or clone a custom
  organization role when the default permissions do not fit.

## Assigning administrator roles

1. Assign **System Admin** on the user's system roles for platform-wide administration.
2. Invite the user to an organization with **Organization Admin** for organization-scoped administration.
3. Review the role combination in [Role Model](https://www.jumpserver.com/docs/roles/role-model.md) before granting both.