---
title: "Where are Scan Permissions Configured?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/where-are-scan-permissions-configured"
language: "en"
last_updated: "2026-06-01T17:12:30.363Z"
---

# Where are Scan Permissions Configured?

Scan permissions in the Spirion Sensitive Data Platform (SDP) are configured in the User Management section of the console, primarily through Role-Based Access Control (RBAC).

There are 2 main locations where these configurations take place:

## 1\. Role Level (The Primary Location)

This is where you define the baseline permissions for groups of users.

-   **Path:** `User Management` -> `Roles` tab -> Select a Role -> `Manage Permissions`.
-   **What is configured here:**
-   -   **Target Permissions:** You can grant a role access to specific targets (e.g., "Finance SharePoint") or all targets. If a role has "None" for a target, users in that role cannot see or run scans against it.
    -   **Tag Permissions:** You can grant access based on **Agent Tags** or **Target Tags**. This is the most scalable way to manage permissions (e.g., "This role can manage all agents tagged with 'London'").
    -   **Result Permissions:** Determines if the role can view the findings from those scans and whether they can "Unmask" (see the raw sensitive data).

## 2\. Individual User Level (Overrides)

You can set specific permissions for a single user that differ from their assigned role.

-   **Path:** `User Management` -> `Users` tab -> Select a User -> `Edit Permissions`.
-   **What is configured here:**
-   -   Individual overrides for specific Targets or Tags. These settings **always take precedence** over the role-level settings.

* * *

## Key Permission Concepts to Remember

-   **Owner Permissions:** These are **not** configured by an admin. They are automatically assigned to the user who *created* the Target or Tag. Owners always have full permissions, and currently, these cannot be overridden by role settings.
-   **Admin Role:** Users assigned the default "Admin" role have full permissions across the entire platform. Their permissions cannot be modified or restricted.
-   **Visibility vs. Execution:** Being able to "see" a scan (View permission) is different from being able to "run" a scan (Manage/Full permission). If a user can see a scan but the "Run Scan Now" button is missing, their permission level for the associated Targets or Tags is likely set to "View" instead of "Manage."
-   **Target vs. Agent Permissions:** To run a scan, a user typically needs permissions for **both** the Target (the data source) and the Agent (the worker) involved in the scan definition.