Privileged Roles

  • Updated on Apr 22, 2026
  • Published on Apr 22, 2026
  • 2 minute(s) read
  • s
 Next

Privileged role types

LEA Administrator:

The first request for an LEA Administrator role in a PSU is vetted by NC DPI before the role is granted. Once granted, the LEA Administrator role allows the user to:

  • Approve future role requests from staff in their PSU (Including another “LEA Administrator”)

  • Access administrative and management functions within the NCEdCloud IAM Service for their employees and students

  • Submit webform requests to opt in to Target Applications and other opt-in features

  • Access to Submit support ticket with Identity Automation.

LEA Data Auditor: primarily for Data Coordinators and Managers. Allows the user to view user profiles and access data files for all students and employees in their LEA or Charter School.

LEA Help Desk: allows a user to look up any employee or student account across the district and reset their password.

LEA Student Help Desk: same as the LEA Help Desk role, but limited to student accounts only.

School Help Desk: allows a user to look up any employee or student account within a specific school and reset their password.

School Student Help Desk: same as the School Help Desk role, but limited to student accounts only.

School-only roles

School staff such as Instructional Technology Facilitators (ITFs) and guidance counselors can request a help desk role scoped to the school or schools they support.

School Help Desk and School Student Help Desk roles are limited to a single school. If a staff member supports more than one school, they can request a role for each school separately.

When requesting a school role, the requester must enter the 6-digit Campus Code for the school made up of the 3-digit LEA Code followed by the 3-digit School Code.

Requesting Privileged Roles

If your position requires one of the Privileged Roles for your PSU, you can request it under Requests. After logging into the IAM Service:

  1. Click the dropdown arrow to the right of Applications

  2. Select "Requests"

   

  1. In the Requests view, click on Entitlements/Catalog down the left side and

  2. Select the role you're requesting (e.g. LEA Administrator, School Help Desk, etc.)

  3. Then you can click on the "Request" button at the bottom of the screen (shows once you click on a role)

Once you click on the Request button, you will be asked to enter:

  • Your 3-digit LEA code (Charter School codes end with a Letter) for PSU-wide roles

    or

  • Your 6-digit Campus Code for School-level roles (e.g. School Student Help Desk)

* Any requested roles will need to be approved by your district's/school's NCEdCloud LEA Administrator.

Self Revoking Privileged Roles

If a user no longer “wants” a privileged role they have been GRANTED, they can execute a REVOKE themselves by un-requesting the role. This requires that they go to the Requests view (Application drop down), and the Entitlements/My Entitlements menu item on the left, and click on the Revoke box for the role they want to REVOKE from the displayed list (see screenshot).

*You may need to hover over the role with the check in front of it, to see the Revoke button to

the right. After you click on the Revoke button, the role will automatically be REVOKED.

NOTE: If the user has more than one role and needs to keep one or more, DO NOT UNCHECK the box of the role(s) they want to keep!