Profile Permission Change in SOTI MobiControl 2026.1.3 Can Affect Upgrades

After upgrading to SOTI MobiControl 2026.1.3, or any release from SOTI MobiControl 2026.0 onward, users with custom or granular roles may lose the ability to revoke or reinstall profiles from Device Details, even though their role configuration has not changed. This is a working-as-designed security change introduced in SOTI MobiControl 2026.0. A workaround is available, and a longer-term permission enhancement is under review.

Affected versions: SOTI MobiControl 2026.1.3, and any release from 2026.0 onward.

Who is affected:

• Customers using granular or custom roles, especially with delegated site level administration.
• Users who could revoke and reinstall profiles at the device level before the upgrade and lose that ability afterward.
• Customers for whom the workaround grants more profile management access than intended.

A user whose role could previously revoke or reinstall a profile from Device Details loses that ability after the upgrade, even though nothing in the role itself has changed.

Before SOTI MobiControl 2026.0, managing a profile and assigning it were one combined permission, Manage Profiles. Anyone who could assign a profile could also edit its configuration. After customer feedback, SOTI separated the two, so that some roles could set up profiles without assigning them, and others could assign profiles without touching configuration.

In SOTI MobiControl 2026.0, SOTI split the permission. Manage Profile setup continues to protect profile configuration, and a new Manage Profile Assignment permission controls who can assign profiles.

During this work, a user with only the View Profile permission and Read access to a profile could revoke that profile from devices without holding any assignment or management rights. Since revoking removes configuration from devices, revoke and assign are now treated as the same security-level action. 

From SOTI MobiControl 2026.0, revoking a profile requires the same rights as assigning it, the Manage Profile Assignment permission plus Read/Write access to the profile.

A user who can revoke profiles can now also assign them, but only within the device groups they already have access to. Device group access still applies, so this does not open up assignment across all device groups.

As of SOTI MobiControl 2026.0, revoke and reinstall from Device Details require the Manage Profile Assignment permission and Read/Write access to the profile.

SOTI is currently reviewing a further breakdown of these permissions so that a role could revoke and reinstall profiles at the device level without full Manage Profile Assignment and Write access. A fix version has not yet been decided; one will be communicated once the review is complete.

Grant the affected roles the Manage Profile Assignment permission and Read/Write access to the relevant profiles. This restores the ability to revoke and reinstall profiles from Device Details.

Note: This requires manual effort in large environments, and it grants broader access from the Profiles tab, including bulk assign and unassign and the ability to assign Draft profiles.