Roles

A role decides what someone may do: features in CompanyGPT, models, agent capabilities and rights in the extensions. Everyone has exactly one role. The ticks of that one role apply; nothing is added from other roles. Anyone not assigned to another role usually has the USER role (also shown as “User” in the interface). If automatic role assignment is active, your environment can set a different Fallback role for this.

You find the roles under Access → Roles.

Role list

Above the list the page explains how Entra groups become roles. The Role sync in this tenant box shows whether automatic role assignment from Microsoft Entra ID is active and, if so, with Claim, Order, Fallback role and Admin group. If it is off, it says Role sync is off. Roles are only assigned here.

Column	Content
ID	Name of the role
Description	Its description, visible to administrators only
Users	Number of people with this role
Origin	System, Role sync, Manual or the admin role

Use Search ID or description and the Origin filter to narrow the list. Clicking a row opens the role.

System roles (ADMIN and USER) ship with CompanyGPT and can be neither deleted nor renamed.

Creating a role

1. In the Create role section, enter an ID and optionally a Description.
2. If the role should belong to an Entra group, pick the group under From Entra group. The ID then automatically becomes the group’s object ID. This picker only exists when automatic role assignment runs through Entra groups; otherwise enter the object ID by hand as the ID.
3. Click Create.

The new role starts with USER’s feature rights (companyGPT tab). It does not take over USER’s model releases or the extension rights USER holds on its own; rights opened with For everyone apply to the new role as well. If a provider is restricted under Providers and models, the new role only sees its models once you release them on its Models & providers tab. Adjust the role afterwards on the detail page.

Assigning roles automatically from Entra ID

An Entra group does not give a role by itself. For all members of an Entra group to receive a role automatically at sign-in:

1. Create the role. The ID must be exactly the Entra group’s object ID (Entra portal → Groups → group → Overview → Object ID). If your environment uses app roles instead of groups, the ID is the app role’s value, for example POWERUSER.
2. Have innFactory register the role for your environment. Without this registration nobody gets the role automatically.
3. Set the role’s rights, models and agent capabilities.
4. People sign in again. Only then do they have the role, and they get it again at every sign-in.

Administrators keep ADMIN. Someone in several registered groups gets the role listed first in the registration.

Caution

A registered role can be neither deleted nor renamed, because automatic role assignment at sign-in needs it. If a registered role is missing, companyADMIN creates it itself. If it is no longer needed, innFactory first removes the registration; afterwards it can be deleted.

A role’s detail page

The detail page has the tabs Overview, companyGPT, Models & providers, Extensions and Members, plus the danger zone Delete role.

Overview

• You change the name with Rename. This only works while nothing is set up for the role yet (models, capabilities, rights, shares), because those settings would otherwise stay behind under the old name. In that case create a new role.
• Description explains what the role is for. Only administrators see it.
• In addition you see the Origin, the Entra mapping with Entra group and Members in Entra, and Notes, for example that role sync overwrites manual assignments at sign-in.

companyGPT

Here you decide what people with this role may do in CompanyGPT. The ticks for features and admin rights apply at once; they need no save button. For each feature the page offers only the actions CompanyGPT supports.

Feature	Actions
Agents	Use, Create, Share, Share publicly
Prompts	Use, Create, Share, Share publicly
Skills	Use, Create, Share, Share publicly
MCP servers	Use, Create, Share, Share publicly, Configure OBO
Remote agents	Use, Create, Share, Share publicly
Marketplace	Use
Memories	Use, Create, Update, Read, Opt out
File search	Use
File citations	Use
Run code	Use
Web search	Use
Multi-conversation	Use
Temporary chat	Use
Scheduled chats	Use, Create
Bookmarks	Use
Shared links	Create, Share, Share publicly
People picker	View users, View groups, View roles

• Share publicly decides whether members may release content to the whole environment, not just to individual groups.
• Remote agents allows calling agents from outside through the API.
• Configure OBO allows setting up on-behalf-of access for MCP servers, where a tool accesses a third-party system in the name of the signed-in person. Grant this right deliberately.
• Scheduled chats are chats with an agent that run at set times. Whether the feature is switched on at all is controlled under Agent runtime.

Some ticks are locked and carry a note. These values come from the base configuration or are reset by CompanyGPT at every restart. This mostly concerns the USER and ADMIN roles. The note names the way out, such as a custom role or switching memories off per role or group. innFactory makes changes to the base configuration.

Admin rights in LibreChat

This section grants the rights for the administration area, such as Access the admin area, Manage roles or View audit log. The full list with explanations is under Direct grants. Revoking asks first; people with the role lose the right at once.

Caution

Whoever holds Manage roles or Manage groups can effectively give anyone admin rights. If you grant these rights to a role other than ADMIN, companyADMIN therefore asks for explicit confirmation.

Below follow the role’s settings for memories, retention, agent builder and file uploads. Each of these sections has its own Save button; only that applies the change, otherwise it is lost. The settings correspond to the settings under Agent runtime → Per role or group. Which capabilities agents have for this role is under Agent capabilities.

Models & providers

Which providers and models people with this role see, including those inherited from the base configuration. Expanding a row shows the individual models; taking something away asks first. You edit all roles at once under Providers and models → Model access.

Extensions

This role’s rights in the extensions, for example Use translation or Use Microsoft 365. A tick grants the right; removing it asks first. A revoked right is gone at once; extensions cache the answer for at most a minute.

• ADMIN always holds rights of the class Admins automatically.
• Nobody gets rights of the class Explicit only automatically. Only administrators with the ADMIN role can grant them; for everyone else such rights are hidden as long as the role does not hold them.
• If a right is opened with For everyone, this is shown. You change that under Extensions.

All rights and what they mean are described in Extensions.

Members

Here you assign the role to people:

1. In the Add person section, type at least two characters into the Search person (name or email) field.
2. In the results, click the entry “Add name (email)”.

Whoever is assigned here loses their previous role. People you remove from the role get the USER role.

On the USER role itself adding does not work, and removing is not offered. To give someone USER, remove them from their current role.

Caution

If automatic role assignment from Entra ID is active, CompanyGPT sets the role again from the Entra groups at the next sign-in. Assignments made here are lost then.

Deleting a role

Delete role in the danger zone first shows how many people hold the role. All members get the USER role afterwards. Deleted with the role are its settings (including model limits), its shares and its rights in CompanyGPT and the extensions. This cannot be undone.

Related pages

• Groups decide with whom content is shared.
• Agent capabilities control which capabilities agents can use for people with a role.
• Providers and models control the models per role.