Assigning security roles
Security roles provide a set of tenant-level permissions to users and administrators. As a tenant administrator, you can assign roles manually from the Management Console or set up automatic role assignment.
Security roles control actions and access rights for users and administrators in the tenant. In addition to the tenant-level roles, there are also space roles that control user actions on content within spaces. For more information about space roles, see Managing permissions in shared spaces, Managing permissions in managed spaces, and Data space roles and permissions.
You can assign roles to individual users or groups of users from the Management Console.
Assigning security roles to users
The Users section in the Management Console has two tabs. Tenant administrators can assign security roles from the All users tab or from the Permissions tab.
The All users tab shows a list of users who have been added or invited to the tenant. You can select one or more users to see all roles assigned to them.
Do the following:
-
In the Management Console, go to Users > All users.
-
Select one or more users and click Edit roles.
-
In the Edit roles dialog, select the roles you want to assign on the User tab or Admin tab.
-
Click Save.
On the Permissions tab, you see all available security roles. You can select a role to see all users assigned to this role.
Do the following:
-
In the Management Console, go to Users > Permissions.
-
Click the arrow
on the security role you want to assign. -
On the Users tab, click Assign.
-
Search for users by name or email and add them to the list.
-
Click Assign.
Assigning security roles to groups
Groups are defined through your identity provider and not created from the Management Console. Tenant administrators can assign security roles to groups from the Permissions tab in the Management Console. When you assign a role to a group, every member of that group is granted the permissions defined by the role.
Do the following:
-
In the Management Console, go to Users > Permissions.
-
Click the arrow
on the security role you want to assign. -
On the Groups tab, click Assign.
-
Search for groups by name and add them to the list.
-
Click Assign.
Assigning security roles to everyone in the tenant
Tenant administrators can assign security roles to all users in the tenant from the Auto assign column on the Permissions tab in the Management Console. A role assigned to a user this way is removed from the user if you set the value in the column to Off.
Do the following:
-
In the Management Console, go to Users > Permissions.
-
Find the security role you want to assign to everyone and select Anyone at <your_tenant_name> in the Auto assign column.
All users will now be assigned the role the next time they log in.
For new tenants, the following roles are automatically assigned to all users by default:
-
Automation Creator
-
Data Services Contributor
-
Steward
-
Private Analytics Content Creator
-
Shared Space Creator
What is a security role
A security role is a set of permissions that are granted to a user. Security roles are divided into administrator roles and user roles. Security roles are divided into administrator roles and user roles. Administrator roles enable management of tenant-wide functions that affect governance, performance, and security. User roles enable actions on resources, such as editing apps or opening data files. By assigning roles to users, you can better organize your users and what they can do in the tenant.
You can assign the following security roles. For more information about the permissions granted with each role, see Permissions granted by security roles.
| Role | Type | Permissions | Access granted with role |
|---|---|---|---|
| Tenant Admin | Administrator | An administrator with full permissions to manage and administer all aspects of the tenant. | Access to Management Console from the launcher menu |
| Analytics Admin | Administrator | An administrator with limited permissions to manage only some areas of governance and content. | Access to Management Console from the launcher menu |
| Audit Admin | Administrator | An administrator with limited permissions, including access to events and data from the Natural Language API (Developer role also needed). | Access to Management Console from the launcher menu |
| Data Admin | Administrator | Administrator with limited permissions to manage only data spaces. | Access to Management Console from the launcher menu |
| Developer | User | A user who can generate API keys. | API keys option on the user profile menu |
| Data Space Creator | User | A user who can create data spaces. | Create space option under the Add new button in hub |
| Managed Space Creator | User | A user who can create managed spaces. | Create space option under the Add new button in hub |
| Shared Space Creator | User | A user who can create shared spaces. | Create space option under the Add new button in hub |
| Data Services Contributor | User | A user who has access to Data Integration services | Access to Data Integration from the launcher menu |
| Private Analytics Content Creator | User | A user who can create private analytics content. | Personal space option in the Space list when adding new content |
| Automation Creator | User | A user who can create private automations. | New automation option under the Add new button in the hub. |
| Collaboration Platform User | User | A user who can communicate with Qlik Cloud through external collaboration platforms. | Can add external environments and use these environments to communicate with their Qlik Cloud apps. |
| Steward | User | A user who can create, update, and delete a glossary, and approve, edit, and delete terms. | Create glossary option under the Add new button in hub. |
| Embedded Analytics User | User |
A user who can only access Qlik Sense apps directly in embedded use cases, blocking access to the hub and other interfaces. |
This role restricts access to all other parts of Qlik Cloud. |
How security roles interact with the Data Integration subscription
The Data Integration subscription gives you access to the Data Integration home and to security roles specifically designed for data admins and data spaces.