Fleet operations8 min
Teams, accounts and audit
Give each operator the smallest durable access they need and keep actions attributable.
Outcome
Individual technician accounts with scoped workflows and central revocation.
Before you start
- Owner/admin access
- Defined operational roles
- Device groups or tenants
Invite people as individuals
- 1Invite the technician's own email.
- 2Assign the smallest useful role.
- 3Place them in the correct group.
- 4Have them sign in and complete any second factor.
Grant workflow access
- 1Begin with no broad fleet access.
- 2Grant the device group and tool needed.
- 3Use managed Winbox instead of shared router logins.
- 4Review first-task activity.
- 5Revoke temporary access when the job ends.
Operational note: Shared accounts erase attribution and make revocation disruptive.
Review access routinely
- Remove inactive members.
- Review owner/admin roles separately.
- Rotate exposed target credentials.
- Retain audit records according to your plan and policy.
Verify the result
Technician signs in individually.
They reach the intended device/tool.
They cannot reach another group.
Their session appears in activity.
Common issues
Technician sees a device but cannot open a tool.
Likely cause
Inventory visibility and protocol access are separate.
Fix
Grant the specific workflow without expanding unrelated fleet access.
Removed user still has a live session.
Likely cause
Revocation blocks new authorization but an established session may remain.
Fix
Terminate the session and verify a new connection is denied.