Roles and permissions¶
Every person has one role. Roles are fixed: custom roles are not available yet.
The roles¶
| Role (as shown in the console) | What it is | How it is assigned |
|---|---|---|
| Administrator (tenant administrator) | Administers a tenant: users, security, SSO, history and API keys. | Assigned by an administrator, when inviting or changing the role under Settings › Organisation › Team, or by SSO. |
| Viewer (read-only) | Looks at the tenant without changing it. It is the role of an invitation that names none, and the SSO default role. | Same as above. |
| Organization administrator | Administers the tenant with the scope of its organization; it is the customer role with access to Plan & Usage. | Not assigned from Team or by SSO. |
| Compliance Officer | Compliance profile: besides reading, uploads evidence and assesses ENS controls. | Not assigned from Team or by SSO. |
| Analyst | Exists only in MSSP organizations, for the MSSP's staff; has no write permissions. | Managed by the MSSP; see the MSSP guide. |
An administrator can only grant Administrator or Viewer. An SSO has the same limit (see SSO). If you name a role the screen cannot grant, the invitation is rejected with an error: it is not silently turned into a Viewer.
The Team screen does not offer changing the role of organization administrators.
What each role can do¶
Only actions that the console checks when they run are listed. An empty cell means the action is denied to that role.
| Action | Administrator | Viewer | Organization administrator | Compliance Officer |
|---|---|---|---|---|
| Open Security, SSO and History (audit) under Settings | Yes | Yes | ||
| Invite users, change their role or remove them from the tenant | Yes | Yes | ||
| Create the tenant's API key | Yes | Yes | ||
| Open Plan & Usage | Yes | |||
| Add vendors (write operations of that kind require a role with write permission) | Yes | Yes | ||
| Upload evidence and assess ENS controls | Yes | Yes | Yes |
Custom roles¶
Custom roles are not available yet. Today you cannot create new roles or adjust the permissions of an existing one.
Where next¶
- SSO: which roles your identity provider can grant.
- Audit log: role changes made from Team are recorded.
- Administrator guide: users and security policies.