Least privilege in network monitoring

Why monitoring access matters

A monitoring system is a map of the network: device names, addresses, what's vulnerable when it's down. Giving everyone the full map is convenient and unnecessary. A printer technician needs printers; a branch manager needs their branch; a PSA integration needs status, not configuration.

Two dimensions: what you can do, what you can see

• Role decides actions: admins configure, operators acknowledge and schedule maintenance, viewers read.
• Scope decides visibility: device types and sites. Scopes combine, so "printers at the Denver warehouse" is one scope.

Keeping the two separate avoids role explosion. You don't need a "Denver printer operator" role; you need the operator role with a Denver-printers scope.

Enforce on the server

Hiding devices in the interface isn't access control. Monitaria applies scope in every API response, including history, events, reports, dashboards and API tokens, and checks it again on every acknowledgement and maintenance window. An operator who crafts a request for a device outside their scope gets "not found".

Recommended patterns

• Specialist technicians (printers, phones, cameras): operator, scoped to their device types.
• Site or branch leads: viewer, scoped to their site.
• Customer contacts at an MSP: viewer on the hub, scoped to their sites.
• Integrations: read-only API tokens, scoped and with an expiry; one token per system so it can be revoked alone.
• Admins: few, with two-factor sign-in required, and their actions reviewed in the audit log.

Review regularly

Quarterly, export the user list and audit log, remove people who left, end stale sessions and revoke unused tokens (the token list shows last use).