Home > Administrator roles
Administrator roles
Last updated: 2026-11-03These are the built-in administrator roles defined by Qlik for a Qlik Cloud tenant. Source: Understanding administrator roles and responsibilities.
| Role | Scope of responsibility |
|---|---|
| Service Account Owner (SAO) | The first user to access the tenant. Specifically: • Sole role that can manage the subscription in My Qlik. • Critical for identity-provider recovery—the recovery URL is bound to the mailbox that originally created the tenant. • Changing the SAO requires a Qlik Support case. (SAO and Tenant Admin FAQ) |
| Tenant Admin | Full administrative capabilities—users, system settings, security, customization, and full access to the admin console. Qlik requires at least one Tenant Admin at all times; you can't remove the role from yourself. |
| Analytics Admin | Manages user resources for analytics services in shared and managed spaces—apps, load scripts (the Qlik Sense data-load language inside each app), data files, data connections, reload schedules, automations, and reports. Can't manage users; can't access content in other users' personal spaces. |
| Data Admin | Manages data spaces and data-integration resources from the admin console and Data Integration Home. Can't manage users; can't access personal spaces. |
| Audit Admin | Role for governance and compliance reviewers who need to inspect what users asked AI assistants and how those assistants performed; it does not grant administrative control over anything else. Specifically: reviews Qlik Answers conversations and Natural Language API events. Insight Advisor and Insight Advisor Chat usage metrics (end-user feedback plus logged interaction events—questions asked, feedback given, how analyses were created) are read through the Natural Language API; because that API requires an API key, the Manage API keys permission is what unlocks these metrics for an Audit Admin. A space role on the relevant space (for example, Owner, Can manage, Can edit, Can view, Has restricted view) is also required to see application-scoped data. Can't read personal spaces. (Permissions for audit administrators) |
Permissions per administrator role differ slightly between subscription models. See:
Role abbreviations used in this playbook
In each topic table, the columns indicate the role(s) that can perform the action without needing additional space-level permissions or custom roles. Many actions also require an appropriate space role (Owner, Can manage, Can edit, Can operate, Can publish, etc.) when content lives in a shared, managed, or data space—those requirements are detailed in the official linked references and not duplicated here.
| Abbreviation | Role |
|---|---|
| TA | Tenant Admin |
| AA | Analytics Admin |
| DA | Data Admin |
| AuA | Audit Admin |
| SAO | Service Account Owner |
References
- Understanding administrator roles and responsibilities
- Roles and permissions for users and administrators
- Permissions in User Default and custom roles
- Managing custom roles
- Auditing user roles and access
- Service Account Owner and Tenant Admin FAQ
- Account Owner should not be removed as tenant admin (known limitation)