Manage Custom Roles

Who can use this feature

Anyone with these permissions: Manage custom roles

In addition to the default roles, you can create custom roles to meet your organization’s specific needs. You can create as many roles as you need, tailoring each one to exactly the permissions you want to grant to specific users, SAML groups, or API credentials.

When creating your custom roles, use these points to help you decide what roles you need to create and the permissions to give them:

Users can each have multiple roles and can switch between them in any given project or the global management console.
A set of API credentials is limited to one role because it can’t switch roles.

Create a custom role

To start, in the Roles page in global management, click Create Role. The create role wizard opens.

Name the role

Give a name that describes the role’s purpose or the permissions it’s granting so you can always be sure you’re working with the right role. For example, you might name a role Project Manager or Dashboard Only.

When you’re done, click Continue.

Choose permissions

For each permission, choose an access level:

Allowed: Allow the action.
Denied: Block the action.
Conditional: Allow, but restrict the action using data access control. When you choose this option, you’ll create or choose a set of access conditions.

For a full list of all permissions and the actions they allow, see Permissions.

Create an access condition with data access control

When you select Conditional access, you’re prompted to choose an access condition. To create the access condition, you’ll configure these options:

Select whether to Block or Allow the action based on the conditions:
- Block: The action is blocked for resources that meet the conditions. For all other resources, the action is allowed.
- Allow: The action is allowed for resources that meet the conditions. For all other resources, the action is blocked.
Set the conditions that determine whether the action is allowed or blocked.

For each condition, set the property, operator, and value. You can set a simple AND or OR list of conditions, or you can group conditions for fine-tuned targeting of resources.
- To add a condition: Click (Add condition), then select the property, operator, and value for the condition.
- To add a condition within a group: Click the large (Add condition) button in the group, or select (Add condition) > Add condition > Above or Below. Then select the property, operator, and value for the condition.
- To delete a condition: Click the condition’s (Actions) menu, then click Delete condition.
To work with groups:
- To nest an existing condition or group in a group: In an existing condition or group, click (Actions) > Create group. Select the group’s logical AND or OR operator.
- To delete a group and all the conditions it contains: Click the group’s (Actions) menu, then click Delete group.
Give the access condition a Name that describes what the access condition is allowing or blocking. For example, names like Block PII or Allow production only help you understand, at a glance, what effect the access condition has on the permission.
Click Create Access Condition to save.

The access condition can now be applied to permissions in the role.

Review and save

Review the access you set up for each permission, and make sure the role allows only the actions the role needs. When you’re done, click Create Role.

Your new role is now displayed in the Role list, and you can assign it to your users, SAML groups, and API credentials.