Read only users

Starting with BigFix Platform Version 11.0.7, Read-Only Users are available.

A Read-Only User is a restricted operator managed by a Master Operator (MO). This user can be granted visibility into assigned sites and computers, but cannot perform actions that affect endpoint state, such as sending refreshes, creating custom content, creating custom actions, or deploying actions. As with standard operators, sites can be assigned to this user, but only with Reader access.

Read-Only operators are a special type of BigFix operators designed for scenarios where users need to view data (computers, sites, Fixlet content) through the evaluation of relevance expressions without the overhead and security implications of a full operator account.

Read-Only operators can be either local operators or Identity Provider operators.

Read-Only operators can only log in to the BigFix Explorer REST APIs. They cannot log in to the BigFix Console, WebUI, or the BigFix Server REST APIs.

Prerequisites

  • BigFix Explorer must be installed and available in the deployment. The BigFix Console will disable the Read-only user check box in the Create Operator dialog if BigFix Explorer is not detected.
  • The Read-Only operator must be created by a Master Operator (MO).

Creating a Read-Only Operator using the Console

  1. Open the BigFix Console as a Master Operator.
  2. Navigate to All Content → Operators and right-click Create Local Operator.
  3. In the Create Operator dialog, select the Read-only user check box.
  4. Enter a username and password, then click OK.
Note:
When a Master Operator creates a Read-Only Operator, this Read-Only Operator cannot be modified later on into a non Read-Only Operator or vice versa.
Note:
If BigFix Explorer is not available, the Read-only user check box is greyed out.

Creating a Read-Only Operator using the Server REST API

Send a POST request to /api/operators:
<BESAPI>
 <Operator>
 <Name>readonly_user</Name>
 <ReadOnly>true</ReadOnly>
 <Password>securepassword</Password>
 <MasterOperator>false</MasterOperator>
 <InterfaceLogins>
 <Console>false</Console>
 <WebUI>false</WebUI>
 <Explorer>true</Explorer>
 <API>false</API>
 </InterfaceLogins>
 </Operator>
</BESAPI>
The server enforces that:
  • MasterOperator cannot be true for a Read-Only operator.
  • ComputerAssignments cannot be included directly.
  • Permission flags that are not valid for Read-Only operators (CanCreateActions, CustomContent, etc.) are rejected.

Assigning a Role

A Read-Only operator cannot have computers or sites assigned directly. All visibility is inherited exclusively through the role assignments.

To assign a role:
  1. Open the BigFix Console as a Master Operator.
  2. Navigate to All Content → Roles and open the desired role.
  3. In the Operator Assignments tab, add the Read-Only operator to the role.
Alternatively, use the REST API:
PUT /api/role/{roleID}

Include the Read-Only operator in the role operator list.

Managing Read-Only Operators

To view these operators, open the Read-Only operator in the Console. You will see:
  • Details tab: All permission controls are disabled (greyed out), except for "Show Other Operators' Actions", "Unmanaged Assets" and the interface login privilege "Can use Explorer".
  • Sites tab: Shows inherited site visibility. All modification buttons (Reader/Writer/Owner/Add/Remove) are disabled.
  • Visible Computers tab: Shows computers visible through role assignments. The tab is labeled "Visible Computers" (not "Administered Computers"). Computer assignments cannot be modified.
Changes to a Read-Only operator visibility are made by modifying their role assignments.
Read-Only operators can be deleted like any other operator as follows:
  • BigFix Console: Right-click → Delete.
  • BigFix Server REST API: DELETE /api/operator/{name}

Visibility Calculation (Explorer)

When a Read-Only operator logs in to the BigFix Explorer, their visibility is calculated as follows:

Site Visibility

  • Role site permissions: Sites explicitly listed in the operator assigned roles are visible.
  • MO role inheritance: If any assigned role has Master Operator privilege, all custom and external sites become visible.
  • Globally readable sites: Sites marked as globally readable are visible.
  • Permission cap: Regardless of the role grant level (Writer, Owner), the effective permission for a Read-Only operator is always capped at Reader.

Computer Visibility

  • Computers are visible through the computer assignments of the operator roles.
  • If any assigned role has Master Operator privilege, all computers are visible.
  • A Read-Only operator does not have an operator site, so there are no computers "subscribed to" their own site.

Summary

Effective Site Permission = min(Role-granted permission, SiteReader)
Visible Computers = Union of all role computer assignments

Use Case: Running Relevance Expressions in BigFix Explorer

Scenario

An organization needs a service account or analyst user that can:
  • Query computer properties across the deployment using relevance expressions.
  • Retrieve Fixlet applicability and site content for reporting or automation.
  • Not have the ability to create actions, modify content, or affect endpoints.

Solution

Create a Read-Only operator and assign it to a role with the appropriate computer and site visibility. The operator can then use the BigFix Explorer REST API to evaluate relevances:
POST /api/relevance
Content-Type: application/json
Authorization: Basic <credentials>
{
  "relevance": "names of bes computers whose (operating system of it 
contains \"Windows\")"
}
The response contains the evaluation result:
{
  "result": ["DESKTOP-001", "DESKTOP-002", "SERVER-003"],
  "count": 3,
  "plural": true,
  "type": "string",
  "evaltime_ms": 0.698
}

Advantages over Normal Operators

Aspect Normal Operator Read-Only Operator
Operator site Created and propagated to all clients via relays None - No operator site is created
Client overhead Every client gathers the operator site periodically Zero - Clients are unaware of the operator
Relay caching Relay caches operator site content None
Bandwidth Each client downloads the operator site data Zero additional bandwidth
Security Can potentially create actions if misconfigured Cannot create actions or modify content under any circumstance
Scalability Each operator adds load to the propagation system No propagation overhead - Ideal for service accounts, API integrations, and read-only analysts

Key Benefits

In large deployments with thousands of endpoints, every normal operator creates an operator site that is deployed to (and gathered by) all managed clients. This adds network traffic, relay load, and propagation overhead. Read Only operators avoid this entirely — they have no operator site and impose zero overhead on the client infrastructure. This makes them ideal for:
  • Automation service accounts that only need to read data via the BigFix Explorer REST API.
  • Reporting tools that periodically query deployment state.
  • Security auditors who need visibility without write access.
  • Dashboard integrations that evaluate relevance expressions for visualization.