The two routes to full access in Avvi

One person holds full access because they set the organisation up. Others get the same from a group toggle. Tenant-wide security investigation differs.

Full access in Avvi arrives two ways, and administrators regularly assume there is only one.

The first is the master administrator. That is whoever completed the organisation’s setup, decided automatically rather than nominated, and the access cannot be removed.

The second is the Avvi Master Admin toggle on an access group. It gives everyone in that group the same access, and unlike the first it can be turned off again.

How it works

The master administrator is the first administrator who signed in when the organisation was created. Nobody chooses the holder. The product records who was first and treats that account as having full access from then on.

Because the access is not granted by a group, no group setting restricts it and no group setting removes it.

The Avvi Master Admin toggle sits on an access group under Settings, then Users & Roles, described there as full admin access. Turning it on gives every member of that group the same reach. Turning it off takes it away again.

Both routes still answer to the organisation’s own master switches. Where on-premises features or licence purchasing are switched off for the organisation, they are off for the master administrator too.

The one difference worth knowing

Tenant-wide security investigation is the exception. Scanning a whole client at once, rather than one user at a time, is available to the master administrator by default.

An access group with the Avvi Master Admin toggle does not get it automatically. That group needs its tenant-wide investigations permission switched on separately, and that permission depends on the group’s cybersecurity access being on as well.

Everything else the two routes reach is the same.

Good to know

Needing broader access is almost never a reason to worry about who the master administrator is. An access group with the toggle answers it, and it can be adjusted later.

The master administrator is shown under Settings, then Users & Roles, on a card naming the holder and the date they were designated.

What to do next

Open Settings, then Users & Roles, and look at the Master administrator card to confirm who holds it today.

For everyday access, create an access group and grant what that group needs, rather than planning around one person.

If the master administrator has left the company, open a support conversation from the Help drawer. Say who holds it now and who should.

FAQ

Q: The setting is greyed out and I cannot change it.

A: Your account is not allowed to change that setting. Ask an administrator with full access to change it for you, or to add your group to the permission.

Q: Can we have more than one person with full access?

A: Yes. Put them in an access group with the Avvi Master Admin toggle switched on. Only the master administrator role itself is held by one person.

Q: Can the master administrator role be moved to somebody else?

A: Not from any screen in the product. Open a support conversation and explain what you need.

Q: Why can a colleague with full access not run a tenant-wide investigation?

A: Full access from a group does not include it. Switch on that group’s tenant-wide investigations permission separately.

A Global Administrator cannot get into Avvi covers the confusion this causes most often, because a senior Microsoft role is a different thing entirely.