diff --git a/console/module/api/src/main/java/org/eclipse/kapua/app/console/module/api/shared/model/session/GwtSession.java b/console/module/api/src/main/java/org/eclipse/kapua/app/console/module/api/shared/model/session/GwtSession.java
index ed9bdf99305..78b840c6d4e 100644
--- a/console/module/api/src/main/java/org/eclipse/kapua/app/console/module/api/shared/model/session/GwtSession.java
+++ b/console/module/api/src/main/java/org/eclipse/kapua/app/console/module/api/shared/model/session/GwtSession.java
@@ -201,6 +201,42 @@ public void setSelectedAccountPath(String selectedAccountPath) {
         this.selectedAccountPath = selectedAccountPath;
     }
 
+    /**
+     * Checks if the selected Account is at root level (it means it is kapua-sys)
+     *
+     * @return {@code true} if it is, {@code false} otherwise
+     * @since 2.0.0
+     */
+    public boolean isSelectedAccountRootLevel() {
+        return isSelectedAccountAtLevel(0);
+    }
+
+    /**
+     * Checks if the selected Account is a first level (it means it is a direct son of kapua-sys)
+     *
+     * @return {@code true} if it is, {@code false} otherwise
+     * @since 2.0.0
+     */
+    public boolean isSelectedAccountFirstLevel() {
+        return isSelectedAccountAtLevel(1);
+    }
+
+    /**
+     * Checks if the selected Account is the given level.
+     *
+     * <ul>
+     *     <li>/1 = level 0</li>
+     *     <li>/1/1234 = level 1</li>
+     * </ul>
+     *
+     * @param level The level to check against
+     * @return {@code true} if it is, {@code false} otherwise
+     * @since 2.0.0
+     */
+    public boolean isSelectedAccountAtLevel(int level) {
+        return getSelectedAccountPath().split("/").length == (level + 2);
+    }
+
     // User info
     public String getUserId() {
         return userId;
diff --git a/console/module/endpoint/src/main/java/org/eclipse/kapua/app/console/module/endpoint/client/EndpointViewDescriptor.java b/console/module/endpoint/src/main/java/org/eclipse/kapua/app/console/module/endpoint/client/EndpointViewDescriptor.java
index 5d82af06773..4c259411ecb 100644
--- a/console/module/endpoint/src/main/java/org/eclipse/kapua/app/console/module/endpoint/client/EndpointViewDescriptor.java
+++ b/console/module/endpoint/src/main/java/org/eclipse/kapua/app/console/module/endpoint/client/EndpointViewDescriptor.java
@@ -17,6 +17,7 @@
 import org.eclipse.kapua.app.console.module.api.client.ui.view.descriptor.AbstractEntityViewDescriptor;
 import org.eclipse.kapua.app.console.module.api.shared.model.session.GwtSession;
 import org.eclipse.kapua.app.console.module.endpoint.shared.model.GwtEndpoint;
+import org.eclipse.kapua.app.console.module.endpoint.shared.model.permission.EndpointSessionPermission;
 
 public class EndpointViewDescriptor extends AbstractEntityViewDescriptor<GwtEndpoint> {
 
@@ -47,6 +48,11 @@ public EntityView<GwtEndpoint> getViewInstance(GwtSession currentSession) {
 
     @Override
     public Boolean isEnabled(GwtSession currentSession) {
-        return currentSession.getAccountId().equals(currentSession.getSelectedAccountId());
+        return currentSession.hasPermission(EndpointSessionPermission.readAll()) &&
+                (
+                        currentSession.isSelectedAccountRootLevel()
+                                ||
+                                currentSession.isSelectedAccountFirstLevel()
+                );
     }
 }