# Separate UniFi Fabric administration from door access

> Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.

- Canonical URL: https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T00:43:18+00:00
- Modified: 2026-10-15T00:44:33+00:00
- Last reviewed by DSE: 2026-10-14
- Resource type: Guide
- DSE priority: Information
- Topics: Access Control, Cybersecurity
- Reading time: 2 minutes

## What you need to know

Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.

## Potentially affected

Use this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.

## DSE recommendation

DSE recommends separate approval columns for management functions, door access, and site scope.

## Article

Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.

## Source facts

Ubiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.

Source: [Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions](https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions).

## Applicability

Use this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.

## DSE recommendation

DSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.

## Verification

With an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.

## Official reference

[Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions](https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions). Reviewed October 14, 2026.

## Primary reference

- Name: Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions
- Authority: help.ui.com
- URL: https://help.ui.com/hc/en-us/articles/31557407384343-Managing-UniFi-Fabric-People-Roles-and-Permissions
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate UniFi Fabric administration from door access,” DSE Security, https://update.dsesecurity.com/updates/unifi-fabric-admin-door-access-role-review/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.