diff --git a/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseControllerService.java b/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseControllerService.java
index 43792b859..bbd8358a8 100644
--- a/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseControllerService.java
+++ b/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseControllerService.java
@@ -19,6 +19,7 @@
 package org.wso2.carbon.device.mgt.iot.androidsense.service.impl;
 
 import org.wso2.carbon.apimgt.annotations.api.API;
+import org.wso2.carbon.apimgt.annotations.api.Permission;
 import org.wso2.carbon.device.mgt.extensions.feature.mgt.annotations.DeviceType;
 import org.wso2.carbon.device.mgt.extensions.feature.mgt.annotations.Feature;
 import javax.ws.rs.Consumes;
@@ -44,6 +45,7 @@ public interface AndroidSenseControllerService {
     @Path("device/{deviceId}/words")
     @POST
     @Feature(code = "keywords", name = "Add Keywords", description = "Send keywords to the device", type = "operation")
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/operations"})
     Response sendKeyWords(@PathParam("deviceId") String deviceId, @QueryParam("keywords") String keywords);
 
     /**
@@ -56,12 +58,14 @@ public interface AndroidSenseControllerService {
     @POST
     @Feature(code = "threshold", name = "Add a Threshold", description = "Set a threshold for word in the device",
             type = "operation")
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/operations"})
     Response sendThreshold(@PathParam("deviceId") String deviceId, @QueryParam("threshold") String threshold);
 
     @Path("device/{deviceId}/words")
     @DELETE
     @Feature(code = "remove", name = "Remove Keywords", description = "Remove the keywords",
             type = "operation")
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/operations"})
     Response removeKeyWords(@PathParam("deviceId") String deviceId, @QueryParam("words") String words);
 
     /**
@@ -71,6 +75,7 @@ public interface AndroidSenseControllerService {
     @GET
     @Consumes("application/json")
     @Produces("application/json")
+    @Permission(scope = "android_sense_device", permissions = {"/permission/admin/device-mgt/user/stats"})
     Response getAndroidSenseDeviceStats(@PathParam("deviceId") String deviceId, @PathParam("sensorName") String sensor,
                                         @QueryParam("from") long from, @QueryParam("to") long to);
 
diff --git a/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseManagerService.java b/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseManagerService.java
index 68e48074a..1e03db16e 100644
--- a/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseManagerService.java
+++ b/components/iot-plugins/androidsense-plugin/org.wso2.carbon.device.mgt.iot.androidsense.api/src/main/java/org/wso2/carbon/device/mgt/iot/androidsense/service/impl/AndroidSenseManagerService.java
@@ -19,6 +19,7 @@
 package org.wso2.carbon.device.mgt.iot.androidsense.service.impl;
 
 import org.wso2.carbon.apimgt.annotations.api.API;
+import org.wso2.carbon.apimgt.annotations.api.Permission;
 import org.wso2.carbon.device.mgt.extensions.feature.mgt.annotations.DeviceType;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
@@ -36,20 +37,24 @@ public interface AndroidSenseManagerService {
 
     @Path("/devices/{device_id}")
     @POST
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/devices"})
     Response register(@PathParam("device_id") String deviceId, @QueryParam("deviceName") String deviceName);
 
     @Path("/devices/{device_id}")
     @DELETE
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/devices/remove"})
     Response removeDevice(@PathParam("device_id") String deviceId);
 
     @Path("/devices/{device_id}")
     @PUT
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/devices/update"})
     Response updateDevice(@PathParam("device_id") String deviceId, @QueryParam("name") String name);
 
     @Path("/devices/{device_id}")
     @GET
     @Consumes("application/json")
     @Produces("application/json")
+    @Permission(scope = "android_sense_user", permissions = {"/permission/admin/device-mgt/user/devices/list"})
     Response getDevice(@PathParam("device_id") String deviceId);
 
 }
diff --git a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmControllerService.java b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmControllerService.java
index 3bbbe3ad4..30523c444 100644
--- a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmControllerService.java
+++ b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmControllerService.java
@@ -49,7 +49,7 @@ public interface VirtualFireAlarmControllerService {
      */
     @POST
     @Path("device/{deviceId}/buzz")
-    @Permission(scope = "virtual_firealarm_user", permissions = {"device-mgt/virtual_firealarm/user"})
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user/operation"})
     @Feature(code = "buzz", name = "Buzzer On / Off", type = "operation",
             description = "Switch on/off Virtual Fire Alarm Buzzer. (On / Off)")
     Response switchBuzzer(@PathParam("deviceId") String deviceId, @QueryParam("protocol") String protocol,
@@ -61,7 +61,7 @@ public interface VirtualFireAlarmControllerService {
      */
     @Path("device/stats/{deviceId}")
     @GET
-    @Permission(scope = "virtual_firealarm_user", permissions = {"device-mgt/virtual_firealarm/user"})
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user/stats"})
     @Consumes("application/json")
     @Produces("application/json")
     Response getVirtualFirealarmStats(@PathParam("deviceId") String deviceId, @QueryParam("from") long from,
diff --git a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmManagerService.java b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmManagerService.java
index 7b5bdaf09..4b0f3c13f 100644
--- a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmManagerService.java
+++ b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/java/org/wso2/carbon/device/mgt/iot/virtualfirealarm/service/impl/VirtualFireAlarmManagerService.java
@@ -19,6 +19,7 @@
 package org.wso2.carbon.device.mgt.iot.virtualfirealarm.service.impl;
 
 import org.wso2.carbon.apimgt.annotations.api.API;
+import org.wso2.carbon.apimgt.annotations.api.Permission;
 import org.wso2.carbon.device.mgt.extensions.feature.mgt.annotations.DeviceType;
 
 import javax.ws.rs.Consumes;
@@ -38,28 +39,33 @@ public interface VirtualFireAlarmManagerService {
 
     @Path("/devices/{device_id}")
     @DELETE
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user/devices/remove"})
     Response removeDevice(@PathParam("device_id") String deviceId);
 
 
     @Path("/devices/{device_id}")
     @PUT
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user/devices/update"})
     Response updateDevice(@PathParam("device_id") String deviceId, @QueryParam("name") String name);
 
     @Path("/devices/{device_id}")
     @GET
     @Consumes(MediaType.APPLICATION_JSON)
     @Produces(MediaType.APPLICATION_JSON)
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user/devices/list"})
     Response getDevice(@PathParam("device_id") String deviceId);
 
     @Path("/devices")
     @GET
     @Consumes(MediaType.APPLICATION_JSON)
     @Produces(MediaType.APPLICATION_JSON)
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/device-mgt/user/devices/list"})
     Response getFirealarmDevices();
 
     @Path("/devices/download")
     @GET
     @Produces("application/zip")
+    @Permission(scope = "virtual_firealarm_user", permissions = {"/permission/admin/device-mgt/user"})
     Response downloadSketch(@QueryParam("deviceName") String deviceName, @QueryParam("sketchType") String sketchType);
 
 }
\ No newline at end of file
diff --git a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/webapp/META-INF/permissions.xml b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/webapp/META-INF/permissions.xml
index 8b8957385..072cd1e74 100644
--- a/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/webapp/META-INF/permissions.xml
+++ b/components/iot-plugins/virtual-fire-alarm-plugin/org.wso2.carbon.device.mgt.iot.virtualfirealarm.api/src/main/webapp/META-INF/permissions.xml
@@ -44,7 +44,7 @@
 	</Permission>
 	<Permission>
 		<name>Download device</name>
-		<path>/device-mgt/virtual_firealarm/user</path>
+		<path>/device-mgt/user</path>
         <url>/enrollment/devices/download</url>
 		<method>GET</method>
 		<scope>virtual_firealarm_user</scope>
@@ -63,32 +63,18 @@
         <method>GET</method>
         <scope>virtual_firealarm_user</scope>
     </Permission>
-    <Permission>
-        <name>Register Device</name>
-        <path>/device-mgt/user/operations</path>
-        <url>/device/register/*/*/*</url>
-        <method>POST</method>
-        <scope>virtual_firealarm_device</scope>
-    </Permission>
     <Permission>
         <name>Control Buzz</name>
-        <path>/device-mgt/user/operations</path>
+        <path>/device-mgt/user/operation</path>
         <url>/device/*/buzz</url>
         <method>POST</method>
         <scope>virtual_firealarm_user</scope>
     </Permission>
-    <Permission>
-        <name>Push Temperature</name>
-        <path>/device-mgt/user/stats</path>
-        <url>/device/temperature</url>
-        <method>POST</method>
-        <scope>virtual_firealarm_device</scope>
-    </Permission>
     <Permission>
         <name>Get Stats</name>
         <path>/device-mgt/user/stats</path>
         <url>/device/stats/*</url>
         <method>GET</method>
-        <scope>virtual_firealarm_device</scope>
+        <scope>virtual_firealarm_user</scope>
     </Permission>
 </PermissionConfiguration>
\ No newline at end of file