[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > Administrator roles

# Administrator roles

These are the built-in administrator roles defined by Qlik for a Qlik Cloud tenant. Source: [Understanding administrator roles and responsibilities](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Introduction/qlik-sense-admin-roles.htm).

| Role | Scope of responsibility |
| --- | --- |
| **Service Account Owner (SAO)** | The first user to access the tenant. Specifically:<br>• Sole role that can manage the **subscription** in My Qlik.<br>• Critical for **identity-provider recovery**—the recovery URL is bound to the mailbox that originally created the tenant.<br>• Changing the SAO requires a Qlik Support case.<br>([SAO and Tenant Admin FAQ](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Services-Service-Account-Owner-and-Tenant-Admin-FAQ/ta-p/1799811)) |
| **Tenant Admin** | Full administrative capabilities—users, system settings, security, customization, and full access to the admin console. Qlik requires at least one Tenant Admin at all times; you can't remove the role from yourself. |
| **Analytics Admin** | Manages user resources for analytics services in **shared and managed spaces**—apps, load scripts (the Qlik Sense data-load language inside each app), data files, data connections, reload schedules, automations, and reports. Can't manage users; can't access content in other users' personal spaces. |
| **Data Admin** | Manages **data spaces** and data-integration resources from the admin console and Data Integration Home. Can't manage users; can't access personal spaces. |
| **Audit Admin** | Role for governance and compliance reviewers who need to inspect what users asked AI assistants and how those assistants performed; it does **not** grant administrative control over anything else. Specifically: reviews **Qlik Answers conversations** and **Natural Language API** events. Insight Advisor and Insight Advisor Chat usage metrics (end-user feedback plus logged interaction events—questions asked, feedback given, how analyses were created) are read through the **Natural Language API**; because that API requires an API key, the **Manage API keys** permission is what unlocks these metrics for an Audit Admin. A space role on the relevant space (for example, Owner, Can manage, Can edit, Can view, Has restricted view) is also required to see application-scoped data. Can't read personal spaces. ([Permissions for audit administrators](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions.htm)) |

> Permissions per administrator role differ slightly between subscription models. See:
>
> * [Permissions granted by security roles (user-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions.htm)
> * [Permissions granted by security roles (capacity-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions-capacity-model.htm)
> * [Permissions granted by security roles (Qlik Anonymous Access)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions-anonymous.htm)

## Role abbreviations used in this playbook

In each topic table, the columns indicate the role(s) that can perform the action **without needing additional space-level permissions or custom roles**. Many actions also require an appropriate **space role** (Owner, Can manage, Can edit, Can operate, Can publish, etc.) when content lives in a shared, managed, or data space—those requirements are detailed in the official linked references and not duplicated here.

| Abbreviation | Role |
| --- | --- |
| **TA** | Tenant Admin |
| **AA** | Analytics Admin |
| **DA** | Data Admin |
| **AuA** | Audit Admin |
| **SAO** | Service Account Owner |

## References

* [Understanding administrator roles and responsibilities](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Introduction/qlik-sense-admin-roles.htm)
* [Roles and permissions for users and administrators](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-admins-users.htm)
* [Permissions in User Default and custom roles](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-scopes.htm)
* [Managing custom roles](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-custom-roles.htm)
* [Auditing user roles and access](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-auditing.htm)
* [Service Account Owner and Tenant Admin FAQ](https://community.qlik.com/t5/Official-Support-Articles/Qlik-Cloud-Services-Service-Account-Owner-and-Tenant-Admin-FAQ/ta-p/1799811)
* [Account Owner should not be removed as tenant admin (known limitation)](https://community.qlik.com/t5/Knowledge-Base/Known-limitation-in-Qlik-Cloud-Services-Account-Owner-should-not/ta-p/1717890)