Separate UniFi Fabric administration from door access

Review the combined permissions of every assigned Fabric role when deciding who can administer sites or open doors.

Source facts

Ubiquiti distinguishes Admin Permissions for UniFi management from User Permissions for Endpoint services such as Smart Door Access. Fabric roles group permissions and the sites to which they apply. A person can hold several roles, and effective access is the most permissive combination of those roles. People can be added manually or synchronized from an identity provider. The documented Fabric workflow requires Consolidated People Management.

Source: Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions.

Applicability

Use this guide for the cited Fabric people-management model. Endpoint services also need their own configuration; an identity record alone does not describe the required service access.

DSE recommendation

DSE recommends separate approval columns for management functions, door access, and site scope. Review every role assigned to the person and any applicable group membership before changing one role. Use purpose-specific role names that make management authority and physical access understandable to the approver. Include an owner for manual assignments as well as synchronized access. During offboarding or transfer, compare the intended remaining access with the full role combination rather than relying on the removed role’s name.

Verification

With an approved test identity, check the intended management screens and door permissions independently. Test removal and reassignment, recording effective access after each change. Retain the role and site matrix with the access approval.

Official reference

Ubiquiti — Managing UniFi Fabric People, Roles, and Permissions. Reviewed October 14, 2026.