Managing custom roles
Last updated: 10/2/2026Create custom roles in Qlik Cloud with specific permissions for individuals or groups. Custom roles can be assigned in the same way as built-in security roles and extend default permissions.
This topic is applicable to Qlik Sense Enterprise SaaS, Qlik Sense Business, and Qlik Cloud Government. If you have a subscription for the Standard, Premium, or Enterprise edition of Qlik Cloud Analytics or Qlik Talend Data Integration, see Managing users - Capacity-based subscriptions.
Custom roles extend default permissions. When assigning a custom role to users, permissions can only be added, not removed. A custom role cannot restrict a permission that is allowed by default. The permission remains allowed for everyone.
For each permission, the custom role shows the default setting, for example, (Default) Not allowed. This indicates the permission level that applies when the custom role does not override the default setting.
For more information about how default permissions interact with custom roles, see Roles and permissions for users and administrators.
Creating custom roles
Tenant administrators can create new roles and configure permissions using the options described in Default permissions and custom roles.
Do the following:
-
In the Administration activity center, go to Manage users.
-
On the Permissions tab, click Create new.
-
In the Create new role dialog, enter a name and description for the role.
-
Use the search to find specific permissions.
Tip noteYou can use the List all and Selected buttons to show all available permissions or only the selected ones. -
Each permission shows its default setting, such as (Default) Allowed or (Default) Not allowed. Choose the desired access level for the permissions you want to add.
-
Click Create.
You can now assign your role to users or groups in the system. For more information, see Assigning security roles and custom roles.
Editing custom roles
Tenant administrators can edit custom roles.
Do the following:
-
In the Administration activity center, go to Manage users.
-
On the Permissions tab, find the role you want to edit.
-
Click
, then select Edit. -
In the Edit role dialog, update the name or description and add or remove permissions as needed.
-
Click Save changes.
Deleting custom roles
Tenant administrators can delete custom roles. Before deletion, make sure to unassign any users or groups associated with the role.
Do the following:
-
In the Administration activity center, go to Manage users.
-
On the Permissions tab, find the role that you want to delete.
-
Click
, then select Delete. -
Select the checkbox to confirm the deletion, and then click Delete role.
Replacing deprecated built-in roles
Some built-in roles are being deprecated and will be removed in a future release. To avoid losing access to features, you must replace these roles with custom roles that include the same permissions. In some cases, you can use the default permissions to make specific permissions available to all users.
Permissions required for replacements roles
Use the following table to identify which permissions to include in the custom role.
| Deprecated built-in role | Required permissions | Available in default permissions |
|---|---|---|
| Automation Creator |
Private Automations (set to Allowed) |
Yes |
Creating a replacement role
To create and assign a replacement custom role:
-
In the Administration activity center, go to Manage users.
-
On the Permissions tab, select Create new.
-
Name the role using your organization's naming convention.
-
Add the permissions listed in the table above.
-
Assign the role to users or groups who previously had the deprecated role.
-
Remove the deprecated role from those user or groups.
Finding users and groups with deprecated roles
To identify users or groups assigned to deprecated roles, see Auditing user roles and access.
Best practices for role replacement
-
Migrate all users and groups before the deprecated role is removed to avoid disruptions in access.
-
Review custom roles regularly to ensure they follow your organization’s security and access policies.