Provision customers and users

ThingsBoard Edge inherits user access from the ThingsBoard server automatically. Customers are created on the server, and users reach the Edge through the user groups assigned to it. On Edge 4.3 and later, a Tenant Administrator can also create users on the Edge, and the Edge pushes them to the server.

Two types of users can log in to ThingsBoard Edge:

• Tenant Administrator: All Tenant Administrators on the ThingsBoard server can log in to any connected Edge instance without additional configuration. For what they can change on the Edge, see Access permissions.
• Customer User: A Customer User can log in to Edge only if the Edge instance has been assigned to their Customer account on the server. Once assigned, they can view only the entities that are assigned to both the Edge instance and their Customer account. An entity assigned only to the Edge, or only to the Customer, is not visible to Customer Users.

Before assigning an Edge instance to a customer, make sure the customer account and its users exist on the server.

1. Log in to the ThingsBoard server and go to Customers & users > Customers. Click Add customer (+) and enter the customer details.

2. Open the customer and click Manage users. Click Add user and enter the user’s email address. On the Owner and groups step, select the user group.

3. Click Add. Depending on the Activation method, the dialog shows an activation link or sends an activation email. The user must activate their account before they can log in to Edge.

For details, see Customers and Users.

Users are organized into user groups. To let a customer’s users log in to an Edge, the Edge must belong to that customer, and their user group must be assigned to it:

1. On the ThingsBoard server, go to Edge management > Edges and click the Edge.
2. On the Details tab, click Manage owner and groups, select the customer as the owner, and click Update.
3. On the same tab, click Manage user groups. Then click Assign to edge (+), select the customer’s user group, and click Assign.

Users in the assigned group can now log in to the Edge and work with the entities in their group’s scope.

What each user type can do on a connected Edge:

Role	On the Edge
Tenant Administrator	Creates and edits devices, assets, entity views, dashboards, device and asset profiles, relations, calculated fields, and alarm rules. On Edge 4.0 and later, also edits rule chains. On Edge 4.3 and later, also creates users and scheduler events. Customers, entity groups, roles, integrations, data converters, and OTA packages are read-only on the Edge.
Customer User	Reads the entities that are assigned both to the Edge and to their customer.

Unassigning the user group from the Edge removes its users’ access. Tenant Administrator access is not affected.

1. On the ThingsBoard server, open the Edge and click Manage user groups on its Details tab.
2. In the row of the group, click Unassign entity group from edge and confirm.

Users in that group can no longer log in to the Edge.