{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/unifi-fabric-admin-door-access-role-review/", "item": { "id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "slug": "unifi-fabric-admin-door-access-role-review", "url": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review.md", "json": "https://update.dsesecurity.com/api/v1/posts/unifi-fabric-admin-door-access-role-review/" }, "title": "Separate UniFi Fabric administration from door access", "summary": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "access-control", "name": "Access Control", "url": "https://update.dsesecurity.com/topic/access-control/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T00:43:18+00:00", "modified_at": "2026-10-15T00:44:33+00:00", "reviewed_on": "2026-10-14", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Use this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.", "dse_recommendation": "DSE recommends separate approval columns for management functions, door access, and site scope.", "primary_source": { "name": "Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions", "url": "https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions", "published_on": null, "authority": "help.ui.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.

\n

Source facts

\n

Ubiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.

\n

Source: Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions.

\n

Applicability

\n

Use this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.

\n

DSE recommendation

\n

DSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.

\n

Verification

\n

With an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.

\n

Official reference

\n

Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions. Reviewed October 14, 2026.

", "content_text": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.\nSource facts\nUbiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.\nSource: Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions.\nApplicability\nUse this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.\nDSE recommendation\nDSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.\nVerification\nWith an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.\nOfficial reference\nUbiquiti — Managing UniFi Fabric People, Roles, and Permissions. Reviewed October 14, 2026.", "content_markdown": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.\n\n## Source facts\n\nUbiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.\n\nSource: [Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions](https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions).\n\n## Applicability\n\nUse this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.\n\n## DSE recommendation\n\nDSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.\n\n## Verification\n\nWith an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.\n\n## Official reference\n\n[Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions](https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions). Reviewed October 14, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "url": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-14" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate UniFi Fabric administration from door access", "item": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/#article", "identifier": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "url": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/", "headline": "Separate UniFi Fabric administration from door access", "description": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.", "abstract": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.", "articleBody": "Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.\nSource facts\nUbiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.\nSource: Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions.\nApplicability\nUse this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.\nDSE recommendation\nDSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.\nVerification\nWith an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.\nOfficial reference\nUbiquiti — Managing UniFi Fabric People, Roles, and Permissions. Reviewed October 14, 2026.", "datePublished": "2026-10-15T00:43:18+00:00", "dateModified": "2026-10-15T00:44:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate UniFi Fabric administration from door access" }, "articleSection": [ "Access Control", "Cybersecurity" ], "keywords": [ "Access Control", "Cybersecurity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Access Control", "url": "https://update.dsesecurity.com/topic/access-control/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions", "url": "https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions" } } ] } }