Access controls

Digital signage access controls where each layer only narrows access.

Four settings decide what a person can do in Wallboard, and each works on its own. The role sets what they can do. Teams set which folders and items they can reach. Their interface profile sets what they see. Your package sets which features exist for the account at all. Each one narrows the result, and none of them can widen what another has closed.

Book a demo Read the teams guide (documentation site) (opens in a new tab)

How it works

How the controls combine.

Role
The role is the security boundary. If it can’t do something, no team setting or profile will let the user do it.
Teams
Members reach the folders and items shared with their team. Each share is read-only or read and write.
Interface profile
A profile hides the menus, tabs or buttons a person never uses. What’s left on screen matches their job.
Package
Features outside your package don’t appear for anyone in the account, whatever their role.

The detail your IT team will ask about.

Teams with read or write access

A team is a walled-off area inside one account. It has its own users and devices, and its own content and files. For each resource you choose no access, read-only, or read and write. Members see read-only items but can’t select or use them. Account-wide switches decide what happens to resources that belong to no team and to users who aren’t in any team, and whether team members may create folders at the root of Devices, Contents or Files. Tags follow teams too, so a tag another team owns shows as read-only.

Interface profiles in five layers

Each rule says Show, Hide or Inherit. Rules resolve through five layers, which run from system and server-wide down to customer, then preset, then user. The user layer is the most specific. Hide always wins, so once a layer hides a menu, no lower layer can bring it back. Save a set of rules as a preset, assign it to many users, and export it as a JSON file to reuse in another account.

Login methods for each user

You switch each login method on or off for each user, whether that’s single sign-on, a username and password, or one-time email codes. You can also force two-factor setup at the next sign-in. A read-only option lets someone look without changing anything.

Restrict an account instead of deleting it

Restrict a user and every login method stops working, and their open sessions end at once. Their account and content stay in place. Delete a user and the change is permanent, so any content they created then needs a new owner.

Roles, teams and profiles from your identity provider

With SAML single sign-on, Wallboard can read the user’s role, team IDs and interface profile from attributes your identity provider sends. Plan the mapping before you switch it on. If an expected attribute is missing, Wallboard removes that role, team or profile at the user’s next login. The security page covers provisioning through SCIM 2.0.

Check the result with View as

Administrators and network owners can preview the interface in three modes. Admin mode reveals menus the customer’s profile hides. Team mode narrows the view to one or more teams, and Impersonate shows exactly what one user can do. A colored banner names the active mode.

Keys and AI assistants get their own limits

Each API key has a scope, for example proof-of-play read or internal datasource write, and that scope can’t change once the key exists. AI assistants connected over MCP get per-user and per-account permissions for read, create or update, and delete. See APIs, MCP and custom applications.

Partner-managed accounts

A network owner manages member accounts from one place. A customer-level profile, which the network owner can set, shapes each member’s whole workspace. To move between member portals, a user needs the Can access network members option.

Docs and guides.

Show us how your organization is split.

Tell us how your departments, regions or clients are split today. We’ll show you the teams and profiles that match it, then let you check the result with View as.

Book a demo