Creating Technician Profiles: A Step-by-Step Guide

What is a Technician Profile

A Technician Profile is a reusable template that pre-configures essential sign-in & security settings, roles, operational scope, and password policies for technicians. By assigning a Technician Profile during technician creation, IT admins can instantly deploy defined permissions and security settings to new technicians.

When to use Technician Profiles

You can use a Technician Profile to manage the Sign-in & Security settings, Technician Role, Scope, and Password Policy of technicians who share the same responsibilities. Reusing one Technician Profile across every technician keeps their settings consistent, and updating the profile updates all of them at once.

Here are a few scenarios where you can use Technician Profiles to good effect:

Scenario 1: A helpdesk team

• Situation: You are onboarding eight Tier 1 support technicians who all do the same job.
• Profile setup: Create a Technician Profile named “Helpdesk – Tier 1” with:
  • Technician Role: a custom role with limited device actions
  • Scope: the devices the team supports
  • Sign-in & Security: Hexnode-managed 2FA enabled, and Allowed IP ranges set to the office network
  • Password Policy: a minimum length of 12 characters
• Outcome: Assign the profile to each technician during technician creation. All eight get the same access and security settings, and one edit to the profile updates all of them.

Scenario 2: Short-term contractors

• Situation: You regularly bring in contractors who need tighter access than employees.
• Profile setup: Create a Technician Profile named “Contractor” with:
  • Scope: a single device group
  • Sign-in & Security: Hexnode-managed 2FA enabled, and Logout after a period of inactivity set to 30 minutes
• Outcome: Assign the profile each time you add a contractor, so every contractor starts with the same restrictions.

How to Create a Technician Profile

1. On your Hexnode UEM console, navigate to Admin > Technicians and Roles.
2. Select the Profile tab and click on Create New Profile.
   [Image Alt text: Screenshot of Hexnode UEM dashboard displaying the Profile tab under Technicians and Profiles in the Admin tab.]
3. Provide a name for the Technician Profile.
4. You can configure the following sections:
   • Sign-in & Security
   • Role
   • Scope
   • Password Policy

Sign-in & Security

The Sign-in & Security section defines the authentication methods and access restrictions for all technicians assigned to the Technician Profile. Use these settings to enforce identity verification (2FA and CAPTCHA), restrict portal access by trusted IP addresses or browsers, and manage automated session timeouts.

Why it matters: Technicians can run powerful remote actions such as wiping or deleting devices, so a compromised technician account puts every device in its scope at risk. Enforcing 2FA, CAPTCHA, IP and browser restrictions, and session expiry in the Technician Profile means every technician who receives it starts with the same protections.

Login Settings

• Allowed Logins: Specify whether technicians can sign in using Google, Microsoft, Okta, or local account credentials. Note that SSO login via Google, Microsoft, or Okta can only be enabled if the corresponding option is enabled in the Global SSO login settings under Admin > Logon Restrictions.

CAPTCHA

• Verify with CAPTCHA after ___ failed login attempts: Choose the maximum failed login attempts for a technician, after which CAPTCHA will be enabled. It can take values between 1 and 10. By default, the set value is three.

Alternatively, CAPTCHA settings can also be applied globally to all the technicians within the portal in the Global CAPTCHA settings.

1. Navigate to Admin > Logon Restrictions.
2. Under Global CAPTCHA, provide the maximum failed login attempts after which CAPTCHA will be enabled. It can take values between 1 and 10.
3. Click on Save.

If CAPTCHA is configured both globally and individually (while creating the technician profile), the CAPTCHA trigger limit will be the least value among the global and individual CAPTCHA limits.

Two Factor Authentication

• Enable Hexnode-managed 2FA: Check this option to enforce native two-factor authentication, ensuring secure access to the Hexnode portal.

The second authentication factor for technician login into Hexnode can be a time-based email/SMS OTP or a verification code generated by a third-party authenticator app. For example, the technician can employ Microsoft Authenticator or Google Authenticator as the third-party app that provides a verification code for safe login. You can configure the two-factor authentication settings for a technician from the portal.

• Send Verification Code via: Select Email or Text message as the method. The technician will receive the verification code for signing in based on it. Ensure to configure SMS Settings on your portal to enable technician login using OTP via SMS.
• Ask this user to set up Third Party Authenticator: If enabled, the technician can only sign in to their portal by verifying the time-based code shown in the Microsoft Authenticator or Google Authenticator app. You can even log in via the recovery codes if you do not have access to the third-party app on the device. Recovery codes are obtained while setting up the third-party authenticator app. Note that a recovery code can only be used once to log in.
• Bypass OTP verification for subsequent logins from trusted IPs: Enable this option to allow technicians to skip 2FA prompts when signing in from trusted IPs. Use the Require OTP after ___ Days setting to define the period after which technicians must re-verify their identity using OTP.
• Bypass OTP verification for subsequent logins from trusted browsers: Enable this option to allow technicians to skip 2FA prompts on trusted browsers after their initial login. Use the Require OTP after ___ Days setting to define how long a browser remains trusted before re-authentication is required.
• Skip 2FA for actions: Enabling this option will skip 2FA while executing remote actions.

IP Restrictions

IP restrictions can be used to specify the IP addresses from which a technician can login to the Hexnode portal.

• Allowed IPs: Specify the IPs individually from which technicians can access the portal.
• Allowed IP ranges: Specify the IP ranges from which technicians can access the portal.

Browser Settings

• Allowed Browsers: Select the browsers from which the technicians can sign in to the Hexnode portal. You can choose from the following options:
  • Microsoft Edge
  • Google Chrome
  • Safari
  • Mozilla Firefox
  • Allow all browsers

Session Expiry

• Logout after a period of inactivity: If enabled, the technician will get logged out after the specified period of inactivity.
• Logout after: Set the time for the period of inactivity, after which the technicians will get logged out automatically. The available options are 30 min, 45 min, 60 min, 90 min, 2 hours, 4 hours, and 8 hours.

Role

A Technician Role is a set of permissions that determines what functionalities a technician can access in the Hexnode UEM console. Select a Technician Role to apply specific permissions to all technicians assigned to this Technician Profile.

Why it matters: Because the Technician Role is part of the Technician Profile, every technician assigned to the profile receives the same permissions. This supports least-privilege access, where each technician can do only what their job requires.

To assign a Technician Role to the Technician Profile:

1. Click on Assign Role.
2. Select the required role and click Assign.

Scope

Scope defines the specific devices, device groups, users, user groups, or domains that a technician can access and manage.

Why it matters: Scope limits where a technician’s permissions apply. A technician can act only on the devices, users, and domains inside their Scope, so a regional team can be restricted to its own devices even when its Technician Role allows powerful actions.

Password Policy

A Password Policy defines the length, complexity, age, and history requirements for technician passwords.

Why it matters: A consistent Password Policy ensures that all technician passwords meet the same strength, rotation, and reuse rules, which reduces the risk of weak or recycled credentials on accounts with administrative access.

You can configure the following settings:

• Minimum Password Length: Specify the minimum password length.
• Password Complexity: Select the password complexity. The available options are Alphanumeric, Complex, and Allow any ASCII characters. You can configure the following sub-options:

• Password age: Set the number of days a password remains valid before the technician is required to change it.
• Password history: Password history is set to block the users from reusing the password for a specified number of times. You can set any value in the range 1 and 10.

On configuring these settings, click Save to save the Technician Profile.

Next Steps: Profile deployment

Upon saving, the Technician Profile is stored as a reusable template. To apply its settings, assign the Technician Profile to a technician during technician creation. The technician inherits the settings configured in the assigned Technician Profile.

For detailed instructions on adding new technicians, refer to Configuring Technicians and Roles in Hexnode.

Important Note:

• Profile changes after assignment: Updating a Technician Profile applies the changes to all technicians who are assigned that Technician Profile. Technicians can also be edited directly, but only their account information is editable there. To change any other setting (Sign-in & Security, Technician Role, Scope, or Password Policy), edit the Technician Profile.
• Profile deletion behavior: A Technician Profile that is assigned to one or more technicians cannot be deleted.