Roles & Permissions

The Roles and Permissions page controls what each role can see and do. Open it from Settings > Roles & Permissions. Viewing the page requires the ReadRolesAndPermissions permission. Creating, changing and deleting roles requires WriteRolesAndPermissions.

A role is assigned to:

• local users on the Users page,

• LDAP users and groups in the Access Control Settings of an LDAP configuration (Privilege field),

• SSO users through the Default Role and Role Mapping of an SSO provider.

View roles and permissions

The left side lists the roles with the number of permissions each one holds, for example User (20/79). Select a role to see its permissions on the right. Permissions are grouped (for example Scan (3/3)). Click a group name to expand or collapse it and see each permission with its description.

Roles and Permissions control page

Default roles

Two roles are created by the product. They cannot be edited or deleted: their checkboxes, the Save button and the trash icon are disabled.

• Admin: holds every permission.

• User: a read-only role with the 20 permissions marked in the permission reference below.

To give someone a different set of permissions, create a new role.

Create new role

Click New Role, enter a Name in the modal and save it. The new role starts with no permissions.

Create role modal

Assign permissions to a role

Select the role, tick the permissions you want it to have and click Save at the bottom of the page.

• Select All / Deselect All (x/79): ticks or clears every permission at once.

• Undo button (top right of the permission list): discards all unsaved changes and reloads the role's saved permissions.

Permissions of the UserAdmin role, Scan group expanded

Policy Based Scan Access

Policy Based Scan Access restricts which scans a role can see. Users with the role can only view scan records that were run with the scan policies assigned to the role. This keeps each team to the data it is responsible for.

Select the role and click + Policy Based Scan Access above the permission list. In the modal:

1. Turn on Policy Based Exclusion Enabled. The policy pickers are disabled until this switch is on. Turning it off clears every selection.

2. Choose the allowed scan policies for each platform in AD Policies, Azure Policies, GCP Policies, AWS Policies and GitHub Policies (Select policies). The pickers list your scan policies, not attack categories.

3. Click Update.

Policy Based Scan Access

Delete a role

Click the trash icon next to the role in the roles list and confirm in the Confirm Delete Operation window. The default Admin and User roles cannot be deleted.

After a role is created, assign it to the users who need it: a local user on the Users page, an LDAP account or group in the LDAP Access Control Settings, or an SSO role mapping.

Assigning the role to an LDAP access control entry

The image below shows the interface as seen by a user signed in with the LDAP account from the example. Menus the role has no permission for are marked with a lock icon.

Forestall UI an Auditor sees

Permission reference

The table lists all 79 permissions in the order and groups used on the page. Yes marks the permissions of the default User role. The Admin role holds all of them.

Group	Permission	Description	Default User role
Dashboard	ReadDashboard	Can access the dashboard page.	Yes
Scan	ReadScan	Can access scan page.	Yes
Scan	WriteScan	Can create new scans or edit existing ones.
Scan	DeleteScan	Can delete scans.
Policy	ReadScanPolicy	Can access the scan policy page.	Yes
Policy	WriteScanPolicy	Can create new scan policies or edit existing ones.
Policy	DeleteScanPolicy	Can delete scan policies.
Issue	ReadIssue	Can access the issues page.	Yes
Issue	ReadIssueComments	Can access issue comments.	Yes
Issue	WriteIssueComments	Can create new issue comments or edit existing ones.
Issue	ManageIssueTags	Can manage issue tags.
Issue	ManageIssueStatus	Can manage issue status.
Impact	ReadImpact	Can access the impacts page.	Yes
Baseline Comparison	ReadBaselineComparison	Can access the baseline comparison page.	Yes
RSoP Comparison	ReadRSOPComparison	Can access the RSoP comparison page.	Yes
Baseline Wizard	ReadCustomBaselines	Can access the baselines page.
Baseline Wizard	WriteCustomBaselines	Can create new custom baseline or edit existing ones.
Credential Discovery	ReadCredentialDiscovery	Can access credential discovery page.	Yes
Credential Discovery	WriteCredentialDiscovery	Can configure credential discovery settings.
Visualize	ReadVisualize	Can access the visualize page.	Yes
Advanced Search	ReadAdvancedSearch	Can access the advanced search page.	Yes
Advanced Search	WriteAdvancedSearch	Can create new saved queries or edit existing ones.
Mail Integration	ReadMailIntegration	Can access the mail integration page.
Mail Integration	WriteMailIntegration	Can configure mail integration settings.
Mail Integration	DeleteMailIntegration	Can delete mail integration configurations.
Jira Integration	ReadJiraIntegration	Can access the Jira integration page.
Jira Integration	WriteJiraIntegration	Can configure the Jira integration settings.
Jira Integration	CreateJiraTicket	Can create Jira tickets.
CyberArk Integration	ReadCyberArkIntegration	Can access the CyberArk integration page.
CyberArk Integration	WriteCyberArkIntegration	Can configure CyberArk integration settings.
User	ReadUser	Can access user page.
User	WriteUser	Can update any user.
User	DeleteUser	Can delete any user.
Roles and Permissions	ReadRolesAndPermissions	Can access roles and permissions settings.
Roles and Permissions	WriteRolesAndPermissions	Can configure roles and permissions settings.
LDAP Configurations	ReadLdapConfig	Can access LDAP settings.
LDAP Configurations	WriteLdapConfig	Can configure LDAP settings.
LDAP Configurations	DeleteLdapConfig	Can delete LDAP settings.
Merge Rule Configurations	WriteMergeRuleConfig	Can configure Unified Identity Merge Rules settings.
Merge Rule Configurations	ReadMergeRuleConfig	Can access Unified Identity Merge Rules settings.
Unified Identity	ReadUnifiedIdentity	Can access Unified Identities.	Yes
Log Configuration	ReadLogConfig	Can access log settings.
Log Configuration	WriteLogConfig	Can configure log settings.
License	ReadLicense	Can access license page.	Yes
License	WriteLicense	Can upload new license or delete existing one.
Scan Report	ReadScanReport	Can access scan reports.	Yes
Scan Report	DownloadReportPackage	Can download the offline report package.
Report Settings	ReadReportSettings	Can access report settings.
Report Settings	WriteReportSettings	Can configure report settings.
Auth Settings	ReadAuthSettings	Can access auth settings.
Auth Settings	WriteAuthSettings	Can configure auth settings.
SSO Settings	ReadSsoConfig	Can access SSO settings.
SSO Settings	WriteSsoConfig	Can configure SSO settings.
SSO Settings	DeleteSsoConfig	Can delete SSO settings.
AD Identities	ReadADIdentities	Can access the AD Identities page.	Yes
Azure Identities	ReadAZIdentities	Can access the Azure Identities page.	Yes
Azure Integration	ReadAZIntegration	Can access the Azure integration page.
Azure Integration	WriteAZIntegration	Can configure Azure integration settings.
Azure Integration	DeleteAZIntegration	Can delete Azure integration settings.
AD Integration	ReadADIntegration	Can access the AD integration page.
AD Integration	WriteADIntegration	Can configure AD integration settings.
AD Integration	DeleteADIntegration	Can delete AD integration settings.
GCP Identities	ReadGCPIdentities	Can access the GCP Identities page.	Yes
GCP Integration	ReadGCPIntegration	Can access the GCP integration page.
GCP Integration	WriteGCPIntegration	Can configure GCP integration settings.
GCP Integration	DeleteGCPIntegration	Can delete GCP integration settings.
AWS Identities	ReadAWSIdentities	Can access the AWS Identities page.	Yes
AWS Integration	ReadAWSIntegration	Can access the AWS integration page.
AWS Integration	WriteAWSIntegration	Can configure AWS integration settings.
AWS Integration	DeleteAWSIntegration	Can delete AWS integration settings.
GitHub Identities	ReadGitHubIdentities	Can access the GitHub Identities page.	Yes
GitHub Integration	ReadGitHubIntegration	Can access the GitHub integration page.
GitHub Integration	WriteGitHubIntegration	Can configure GitHub integration settings.
GitHub Integration	DeleteGitHubIntegration	Can delete GitHub integration settings.
Splunk Integration	ReadSplunkIntegration	Can access the Splunk integration page.
Splunk Integration	WriteSplunkIntegration	Can configure Splunk integration settings.
Splunk Integration	DeleteSplunkIntegration	Can delete Splunk integration settings.
AI Configuration	ReadAIConfiguration	Can access the AI configuration page.	Yes
API Tokens	ManageApiTokens	Can create and revoke API tokens.

Some menus depend on a permission whose name does not match the menu:

• Trend Insights requires ReadDashboard.

• Compliance requires ReadIssue.

• CAP Audit requires ReadAZIdentities.

• About requires ReadLicense.

• Each Configuration Center card requires the matching read permission (ReadADIntegration, ReadAZIntegration, ReadAWSIntegration, ReadGCPIntegration, ReadGitHubIntegration, ReadCyberArkIntegration, ReadMailIntegration, ReadJiraIntegration, ReadSplunkIntegration, ReadAIConfiguration, ReadLdapConfig, ReadSsoConfig). Cards the role cannot open are shown locked.

• API Tokens in the profile menu requires ManageApiTokens.