Permissions
This article lists the permissions you can grant to your roles, which you then assign to your users, SAML groups, and API credentials.
Administration
| Permission | Description |
|---|---|
| Approve or deny action requests (Cloud workloads, SaaS applications) | Can approve or deny action requests. |
| Manage action approval rules | Can create, edit, and delete action approval rules. |
| Manage AI agent apps | Can create, edit, and delete OAuth apps for AI agent integrations. |
| Manage API credentials | Can create, edit, and delete API credentials, their role and the projects they can access. |
| Manage backup configuration | Can edit the backup configuration. |
| Manage backup exclusion | Can exclude or cancel exclusion of a resource from being scanned and backed up. |
| Manage backup policies | Can create, edit, or delete backup policies. |
| Manage backup policies | Can create, edit, or delete SaaS backup policies and backup filters. |
| Manage classification policies | Can create, edit, or delete classification policies. |
| Manage controls | Can create, edit, or delete backup posture controls. |
| Manage custom roles | Can create, edit, and delete custom roles. |
| Manage discovery configuration | Can edit the discovery configuration. |
| Manage notification policies | Can create, edit, or delete notification policies. |
| Manage restore connections (Cloud workloads, SaaS applications) | Can connect restore accounts to a project. |
| Manage restore templates | Can create, view, edit and delete restore templates, and attach or detach them from resources. |
| Manage SaaS backup scope | Can choose which SaaS users, groups, shared drives, and org units are protected. |
| Manage SAML group access | Can create and edit SAML configurations, and assign and remove roles to SAML groups, and grant group access to projects. |
| Manage source connections | Can connect Google Workspace, Microsoft 365, and Entra ID accounts to your project using the API. |
| Manage source connections | Can connect source accounts to your project using the API. |
| Manage threat detection item exclusion (Cloud workloads, SaaS applications) | Can exclude items from threat detection scanning, and remove those exclusions. |
| Manage threat detection plan (Cloud workloads, SaaS applications) | Can assign backed-up resources for threat monitoring. |
| Manage user access | Can invite and remove users, assign roles, and grant access to projects. |
| Manage vault accounts | Can connect vault accounts to your organization. |
| Manage vaults (Cloud workloads, SaaS applications) | Can add and edit vaults. |
| Mute and unmute violations | Can mute or unmute reporting of control violations. |
| Rotate API client secret | Can rotate API credential secrets. |
Viewing
| Permission | Description |
|---|---|
| Search and explore emails | Can search and explore backed-up emails of Google Workspace and Microsoft 365 users. |
| Search and explore files | Can search for files in file systems or storage resources. Can traverse the folder structure in a storage resource and see filenames. |
| Search and explore files | Can search and preview backed-up drive data owned by Google Workspace and Microsoft 365 users. |
| Search and explore groups | Can search and explore backed-up data of Google Workspace and Microsoft 365 groups. |
| Search and explore shared drives | Can search and explore backed-up data in SaaS shared drives. |
| Search and explore tables | Can search for tables by name, column name, or database name. Can view database schema details, including table and column metadata. |
| Search and explore Teams | Can search and explore backed-up Microsoft Teams channel data. |
| Search and explore users | Can search and explore backed-up SaaS directory users. |
| View action approval rules | Can view action approval rules. |
| View audit logs | Can view actions taken in a project and who performed each action. |
| View backup configuration | Can view cloud backup configuration. |
| View backup policies | Can view cloud backup policies. |
| View backup policies | Can view SaaS backup policies and backup filters. |
| View backup posture controls | Can view the backup compliance dashboard, including per-policy summaries, failing-resource lists, trend, and on-demand report exports. |
| View backup settings (Cloud workloads, SaaS applications) | Can view a project's backup settings, including connected restore accounts, policies, controls, and vaults. |
| View classification policies | Can view classification policies. |
| View cost explorer | Can view and analyze Eon account costs. |
| View dashboard panels | Can view general details in a project's dashboard, including storage statistics and number of control violations. |
| View dashboard panels | Can view general details in a project's dashboard, including storage statistics and number of control violations. |
| View discovery configuration | Can view the discovery configuration for connected cloud source accounts. |
| View global management | Can view the organization's settings, including projects, connected source accounts, roles and access, and threat detection. |
| View inventory | Can view resource details in the inventory. |
| View inventory | Can view SaaS resource details in the inventory. |
| View jobs | Can view details about backup and restore jobs. |
| View jobs | Can view details about SaaS backup and restore jobs. |
| View object filters | Can view object-store backup exclusion rules. |
| View restore connections (Cloud workloads, SaaS applications) | Can view restore accounts connected to a project and supported restore regions. |
| View restore templates | Can view restore templates. |
| View source connections | Can view connected Google Workspace, Microsoft 365, and Entra ID source accounts. |
| View source connections | Can view connected cloud source accounts and provider setup details. |
| View threat detection center (Cloud workloads, SaaS applications) | Can view the threat detection center, including the threat detection plan and the items excluded from scanning. |
| View vaults (Cloud workloads, SaaS applications) | Can view backup vaults and connected vault accounts. |
Operation
| Permission | Description |
|---|---|
| Manage dashboards (Cloud workloads, SaaS applications) | Can create, edit, delete, and share dashboards with everyone in the Eon account. |
| Override data classes | Can set a resource's data classes manually or set it to auto-classification. |
| Override detected apps | Can set a resource's apps manually or set it to auto-classification. |
| Override environments | Can set a resource's environment manually or set it to auto-classification. |
| Override network exposure | Can set a resource's network classification manually or set it to auto-classification. |
| Override sensitivity level | Can set a resource's sensitivity level manually or set it to auto-classification. |
| Query databases | Can run SQL queries against database snapshots, restoring query results to a restore account connected to a project. |
| Restore emails | Can restore backed-up emails of Google Workspace and Microsoft 365 users. |
| Restore files | Can restore individual files to a restore account connected to a project. |
| Restore files | Can restore backed-up drive data owned by Google Workspace and Microsoft 365 users. |
| Restore groups | Can restore backed-up data of Google Workspace and Microsoft 365 groups. |
| Restore resources | Can restore resources to a restore account connected to a project. |
| Restore shared drives | Can restore backed-up data into SaaS shared drives. |
| Restore Teams messages | Can restore backed-up Microsoft Teams channel messages into a new channel. |
| Restore users | Can restore backed-up Google Workspace, Microsoft 365, and Entra ID users. |
| Run data catalog queries | Can run SQL query executions against a project's data catalog in its remote catalog, and cancel running executions. |
| Take, convert, and hold snapshots | Can take on-demand SaaS backups and manage their holds. |
| Take, convert, and hold snapshots | Can take on-demand snapshots, convert non-Eon snapshots, and manage snapshot holds. |
| Trigger resources discovery | Can trigger an on-demand discovery of the resources in a connected source account. |
| Trigger resources discovery | Can trigger an on-demand directory sync for a connected SaaS source account. |
| Use AI assistant (Cloud workloads, SaaS applications) | Can hold a conversation with the AI assistant, which reads Eon data on the user's behalf and can act through it within the user's other permissions. |
| Validate required configuration | Can validate required configuration in the cloud account. |
| Validate required configuration | Can validate required configuration in the SaaS account, including delegation scope grants. |