One admin with the app is a productivity story. Two admins with the app and a shared login is a mystery story — things happen to the fleet, and nobody can say who did them. The difference is decided by accounts and roles, not by trust.
Endpoint Central is built for teams: it has role-based access, per-user accounts and an audit trail of who did what. The mobile app inherits all of it — the same account, the same role limits, whether you sign in from a desk or a phone. This page sets up the pattern that keeps multi-admin phone control clean: nobody shares, nobody has more power than their job needs, and every action has a name on it.
Every admin signs in to the app with their own account — no shared credentials, no exceptions for convenience. This is not bureaucracy. It is what makes the audit trail meaningful, what makes the lost-phone kill routine precise (you disable one account, not the team's), and what makes honest mistakes discussable: when a wrong machine gets restarted, the record shows whose thumb it was, the conversation is about the mistake, and nobody else falls under suspicion. A shared login spreads blame across everyone and credit to no one, and the first time it matters, it matters a lot.
Endpoint Central's roles let you give each account the powers its job actually needs. The senior admin may hold the full role. A second admin whose work is user support may need remote control, quick actions and inventory — but not the power to edit deployment policies or manage other users. A junior or a trainee may start with view-heavy access and earn scope. Apply the same thinking to the phone specifically: ask, for each person, should this person be able to do this from a corridor, unsupervised, in five seconds? If the answer is no, the role is wrong — the app simply makes role mistakes faster.
The audit log is usually opened after something goes wrong, which wastes most of its value. In a healthy two-admin shop it is also a coordination tool: a glance at recent activity before starting work shows what your colleague already approved, restarted or deployed while you were away — no duplicate patch approvals, no two people fixing the same machine from two phones. Make one light habit of it: whoever acts on something significant from the phone mentions it in the team chat. Log plus message means the fleet has one shared memory, and shadow admin work — the kind nobody else knew about — has nowhere to grow.
The full video shows one phone controlling a whole fleet. Imagine two — then set the roles before the second phone signs in.
▶️ Watch Full VideoYes. The app signs in with your Endpoint Central account, and your role travels with the account. A technician who cannot change policies at the desk cannot change them from the phone either.
It works until the day something breaks, a phone is lost, or a question is asked that starts with who. Then the shared login makes every answer impossible. Named accounts cost ten minutes to create and pay back forever.
The fleet state you both see is the same server data — approvals done, tasks running, machines changed. For the detailed who-did-what record, the audit view in the console is the complete picture.