Start with scope
Record the customer, tenant, site, and device boundary for every assignment. A narrow capability across every customer can still be excessive privilege.
29 fields · Public CSV · No signup
Review who can do what in your RMM.
Map each technician or role to its customer scope, device scope, privileged capabilities, business justification, approvals, authentication controls, review dates, and remediation owner.
Separate capabilities
Review remote control, background tools, scripts, automation, patch approval, alert changes, credential access, role administration, APIs, and commercial data independently.
Require evidence
Name the business reason, approver, approval time, last review, next review, and any temporary expiration rather than treating a role name as proof.
Close exceptions
Record retain, reduce, revoke, or investigate as a decision, then assign every open exception a ticket and remediation owner.