2024-08-16 20:30:31 +00:00
# Role-based access
2021-06-09 23:12:45 +00:00
Users have different abilities depending on the access level they have.
2023-04-12 19:11:04 +00:00
## Roles
### Admin
Users with the admin role receive all permissions.
### Maintainer
2023-07-31 23:06:07 +00:00
Maintainers can manage most entities in Fleet, like queries, policies, and labels.
2023-04-12 19:11:04 +00:00
Unlike admins, maintainers cannot edit higher level settings like application configuration, teams or users.
### Observer
2023-07-31 23:06:07 +00:00
The observer role is a read-only role. It can access most entities in Fleet, like queries, policies, labels, application configuration, teams, etc.
2023-04-12 19:11:04 +00:00
They can also run queries configured with the `observer_can_run` flag set to `true` .
### Observer+
2023-04-21 19:48:57 +00:00
`Applies only to Fleet Premium`
2023-07-31 23:06:07 +00:00
Observer+ is an observer with the added ability to run *any* query.
2023-04-12 19:11:04 +00:00
### GitOps
2023-04-21 19:48:57 +00:00
`Applies only to Fleet Premium`
2023-04-12 19:11:04 +00:00
GitOps is a modern approach to Continuous Deployment (CD) that uses Git as the single source of truth for declarative infrastructure and application configurations.
GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
2021-06-09 23:12:45 +00:00
## User permissions
2023-05-30 17:24:53 +00:00
| **Action** | Observer | Observer+* | Maintainer | Admin | GitOps* |
2025-01-06 17:56:23 +00:00
| ------------------------------------------------------------------------------------------------------------------------------------------ | :------: | :--------: | :--------: | :---: | :-----: |
2023-05-16 17:18:29 +00:00
| View all [activity ](https://fleetdm.com/docs/using-fleet/rest-api#activities ) | ✅ | ✅ | ✅ | ✅ | |
2025-04-24 21:10:41 +00:00
| Cancel [hosts' upcoming activity ](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity ) | | | ✅ | ✅ | |
2024-06-26 20:48:58 +00:00
| Manage [activity automations ](https://fleetdm.com/docs/using-fleet/audit-logs ) | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| View all hosts | ✅ | ✅ | ✅ | ✅ | |
2024-03-21 18:38:06 +00:00
| View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Filter hosts using [labels ](https://fleetdm.com/docs/using-fleet/rest-api#labels ) | ✅ | ✅ | ✅ | ✅ | |
| Target hosts using labels | ✅ | ✅ | ✅ | ✅ | |
2024-04-16 09:37:58 +00:00
| Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Add and delete hosts | | | ✅ | ✅ | |
| Transfer hosts between teams\* | | | ✅ | ✅ | ✅ |
2025-04-24 21:10:41 +00:00
| Add user information from IdP to hosts\* | | | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| Create, edit, and delete labels | | | ✅ | ✅ | ✅ |
| View all software | ✅ | ✅ | ✅ | ✅ | |
2024-09-26 18:47:14 +00:00
| Add, edit, and delete software | | | ✅ | ✅ | ✅ |
2024-06-06 15:12:12 +00:00
| Download added software | | | ✅ | ✅ | |
2024-09-26 19:10:40 +00:00
| Install/uninstall software on hosts | | | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| Filter software by [vulnerabilities ](https://fleetdm.com/docs/using-fleet/vulnerability-processing#vulnerability-processing ) | ✅ | ✅ | ✅ | ✅ | |
| Filter hosts by software | ✅ | ✅ | ✅ | ✅ | |
| Filter software by team\* | ✅ | ✅ | ✅ | ✅ | |
| Manage [vulnerability automations ](https://fleetdm.com/docs/using-fleet/automations#vulnerability-automations ) | | | | ✅ | ✅ |
| Run queries designated "**observer can run**" as live queries against all hosts | ✅ | ✅ | ✅ | ✅ | |
| Run any query as [live query ](https://fleetdm.com/docs/using-fleet/fleet-ui#run-a-query ) against all hosts | | ✅ | ✅ | ✅ | |
| Create, edit, and delete queries | | | ✅ | ✅ | ✅ |
2024-02-12 22:44:35 +00:00
| View all queries and their reports | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-11-03 11:42:11 +00:00
| Manage [query automations ](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query ) | | | ✅ | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Create, edit, view, and delete packs | | | ✅ | ✅ | ✅ |
2024-02-12 22:44:35 +00:00
| View all policies | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-11-03 11:42:11 +00:00
| Run all policies | | ✅ | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| Filter hosts using policies | ✅ | ✅ | ✅ | ✅ | |
| Create, edit, and delete policies for all hosts | | | ✅ | ✅ | ✅ |
| Create, edit, and delete policies for all hosts assigned to team\* | | | ✅ | ✅ | ✅ |
2024-11-04 18:35:49 +00:00
| Edit global ("All teams") policy automations | | | | ✅ | ✅ |
| Edit team policy automations: calendar events, install software, and run script\* | | | ✅ | ✅ | ✅ |
| Edit team policy automations: other workflows (tickets and webhooks)\* | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Create, edit, view, and delete users | | | | ✅ | |
2024-03-07 22:47:54 +00:00
| Add and remove team users\* | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Create, edit, and delete teams\* | | | | ✅ | ✅ |
| Create, edit, and delete [enroll secrets ](https://fleetdm.com/docs/deploying/faq#when-do-i-need-to-deploy-a-new-enroll-secret-to-my-hosts ) | | | ✅ | ✅ | ✅ |
| Create, edit, and delete [enroll secrets for teams ](https://fleetdm.com/docs/using-fleet/rest-api#get-enroll-secrets-for-a-team )\* | | | ✅ | ✅ | |
2024-03-07 19:21:14 +00:00
| Read organization settings\** | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-12-14 18:45:02 +00:00
| Read Single Sign-On settings\** | | | | ✅ | |
| Read SMTP settings\** | | | | ✅ | |
| Read osquery agent options\** | | | | ✅ | |
2024-07-02 15:11:43 +00:00
| Edit organization settings | | | | ✅ | ✅ |
| Edit agent options | | | | ✅ | ✅ |
| Edit agent options for hosts assigned to teams\* | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Initiate [file carving ](https://fleetdm.com/docs/using-fleet/rest-api#file-carving ) | | | ✅ | ✅ | |
| Retrieve contents from file carving | | | | ✅ | |
2024-09-24 13:49:22 +00:00
| Create Apple Push Certificates service (APNs) certificate signing request (CSR) | | | | ✅ | |
| View, edit, and delete APNs certificate | | | | ✅ | |
| View, edit, and delete Apple Business Manager (ABM) connections | | | | ✅ | |
| View, edit, and delete Volume Purchasing Program (VPP) connections | | | | ✅ | |
2025-03-19 15:03:02 +00:00
| Connect Android Enterprise | | | | ✅ | |
2023-11-03 11:42:11 +00:00
| View disk encryption key for macOS and Windows hosts | ✅ | ✅ | ✅ | ✅ | |
2025-06-14 19:26:45 +00:00
| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts | | | | ✅ | ✅ |
2024-05-02 22:06:36 +00:00
| Create, edit, resend and delete configuration profiles for macOS and Windows hosts | | | ✅ | ✅ | ✅ |
2024-10-31 21:10:50 +00:00
| Execute MDM commands on macOS and Windows hosts\** | | | ✅ | ✅ | ✅ |
2024-03-07 22:47:54 +00:00
| View results of MDM commands executed on macOS and Windows hosts\** | ✅ | ✅ | ✅ | ✅ | |
2025-06-14 19:26:45 +00:00
| Edit [OS settings ](https://fleetdm.com/docs/rest-api/rest-api#os-settings ) | | | ✅ | ✅ | ✅ |
| View all [OS settings ](https://fleetdm.com/docs/rest-api/rest-api#os-settings ) | | | ✅ | ✅ | ✅ |
2025-07-21 17:41:10 +00:00
| Edit [macOS setup experience ](https://fleetdm.com/guides/macos-setup-experience )\* | | | ✅ | ✅ | ✅ |
2024-12-27 15:33:00 +00:00
| Add and edit identity provider for end user authentication, end user license agreement (EULA), and end user migration workflow\* | | | | ✅ | |
2025-04-04 19:28:09 +00:00
| Add and edit certificate authorities (CA)\* | | | | ✅ | ✅ |
2024-07-22 16:41:16 +00:00
| Run scripts on hosts | | | ✅ | ✅ | |
| View saved scripts\* | ✅ | ✅ | ✅ | ✅ | |
| Edit/upload saved scripts\* | | | ✅ | ✅ | ✅ |
2024-02-16 18:26:33 +00:00
| Lock, unlock, and wipe hosts\* | | | ✅ | ✅ | |
2025-06-30 22:34:11 +00:00
| Configure Microsoft Entra conditional access integration | | | | ✅ | |
2021-06-09 23:12:45 +00:00
2023-04-26 14:38:20 +00:00
\* Applies only to Fleet Premium
2021-06-09 23:12:45 +00:00
2023-12-14 18:45:02 +00:00
\** Applies only to [Fleet REST API ](https://fleetdm.com/docs/using-fleet/rest-api )
2023-03-13 19:26:06 +00:00
2024-02-29 21:07:59 +00:00
## Team user permissions
2021-06-09 23:12:45 +00:00
2021-08-19 17:50:21 +00:00
`Applies only to Fleet Premium`
2021-06-09 23:12:45 +00:00
2022-12-05 16:35:45 +00:00
Users in Fleet either have team access or global access.
2021-06-09 23:12:45 +00:00
2023-07-31 23:06:07 +00:00
Users with team access only have access to the [hosts ](https://fleetdm.com/docs/using-fleet/rest-api#hosts ), [software ](https://fleetdm.com/docs/using-fleet/rest-api#software ), and [policies ](https://fleetdm.com/docs/using-fleet/rest-api#policies ) assigned to
2022-04-18 16:10:33 +00:00
their team.
2021-10-28 18:27:03 +00:00
2022-04-18 16:10:33 +00:00
Users with global access have access to all
2023-07-31 23:06:07 +00:00
[hosts ](https://fleetdm.com/docs/using-fleet/rest-api#hosts ), [software ](https://fleetdm.com/docs/using-fleet/rest-api#software ), [queries ](https://fleetdm.com/docs/using-fleet/rest-api#queries ), and [policies ](https://fleetdm.com/docs/using-fleet/rest-api#policies ). Check out [the user permissions
2022-04-18 16:10:33 +00:00
table](#user-permissions) above for global user permissions.
2021-06-09 23:12:45 +00:00
2024-02-29 21:07:59 +00:00
Users can be assigned to multiple teams in Fleet.
2021-06-09 23:12:45 +00:00
2024-02-29 21:07:59 +00:00
Users with access to multiple teams can be assigned different roles for each team. For example, a user can be given access to the "Workstations" team and assigned the "Observer" role. This same user can be given access to the "Servers" team and assigned the "Maintainer" role.
2021-06-09 23:12:45 +00:00
2023-04-12 19:11:04 +00:00
| **Action** | Team observer | Team observer+ | Team maintainer | Team admin | Team GitOps |
2025-01-06 17:56:23 +00:00
| -------------------------------------------------------------------------------------------------------------------------------- | :-----------: | :------------: | :-------------: | :--------: | :---------: |
2023-05-16 17:18:29 +00:00
| View hosts | ✅ | ✅ | ✅ | ✅ | |
2024-03-21 18:38:06 +00:00
| View a host by identifier | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Filter hosts using [labels ](https://fleetdm.com/docs/using-fleet/rest-api#labels ) | ✅ | ✅ | ✅ | ✅ | |
| Target hosts using labels | ✅ | ✅ | ✅ | ✅ | |
2025-04-24 21:10:41 +00:00
| View hosts' [past ](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity ) and [upcoming ](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity ) activity | ✅ | ✅ | ✅ | ✅ | |
| Cancel hosts' [upcoming ](https://fleetdm.com/docs/rest-api/rest-api#get-hosts-upcoming-activity ) activity | | | ✅ | ✅ | |
2024-04-16 09:37:58 +00:00
| Add/remove manual labels to/from hosts | | | ✅ | ✅ | ✅ |
2025-04-04 19:28:09 +00:00
| Create and edit self-authored labels | | | | | ✅ |
2023-05-16 17:18:29 +00:00
| Add and delete hosts | | | ✅ | ✅ | |
2024-06-06 15:12:12 +00:00
| View software | ✅ | ✅ | ✅ | ✅ | |
| Add and delete software | | | ✅ | ✅ | ✅ |
| Download added software | | | ✅ | ✅ | |
2024-09-26 19:10:40 +00:00
| Install/uninstall software on hosts | | | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| Filter software by [vulnerabilities ](https://fleetdm.com/docs/using-fleet/vulnerability-processing#vulnerability-processing ) | ✅ | ✅ | ✅ | ✅ | |
| Filter hosts by software | ✅ | ✅ | ✅ | ✅ | |
| Filter software | ✅ | ✅ | ✅ | ✅ | |
| Run queries designated "**observer can run**" as live queries against hosts | ✅ | ✅ | ✅ | ✅ | |
| Run any query as [live query ](https://fleetdm.com/docs/using-fleet/fleet-ui#run-a-query ) | | ✅ | ✅ | ✅ | |
2025-04-04 19:28:09 +00:00
| Create, edit, and delete self-authored queries | | | ✅ | ✅ | ✅ |
2023-12-14 18:45:02 +00:00
| View team queries and their reports | ✅ | ✅ | ✅ | ✅ | |
| View global (inherited) queries and their reports\** | ✅ | ✅ | ✅ | ✅ | |
2023-11-03 11:42:11 +00:00
| Manage [query automations ](https://fleetdm.com/docs/using-fleet/fleet-ui#schedule-a-query ) | | | ✅ | ✅ | ✅ |
| View team policies | ✅ | ✅ | ✅ | ✅ | |
| Run team policies as a live policy | | ✅ | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| View global (inherited) policies | ✅ | ✅ | ✅ | ✅ | |
2023-11-03 11:42:11 +00:00
| Run global (inherited) policies as a live policy | | ✅ | ✅ | ✅ | |
2023-05-16 17:18:29 +00:00
| Filter hosts using policies | ✅ | ✅ | ✅ | ✅ | |
| Create, edit, and delete team policies | | | ✅ | ✅ | ✅ |
2024-11-04 18:35:49 +00:00
| Edit team policy automations: calendar events, install software, and run script | | | ✅ | ✅ | ✅ |
| Edit team policy automations: other workflows (tickets and webhooks) | | | | ✅ | ✅ |
2024-03-07 22:47:54 +00:00
| Add and remove team users | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Edit team name | | | | ✅ | ✅ |
| Create, edit, and delete [team enroll secrets ](https://fleetdm.com/docs/using-fleet/rest-api#get-enroll-secrets-for-a-team ) | | | ✅ | ✅ | |
2025-04-04 19:28:09 +00:00
| Read organization settings\* | ✅ | ✅ | ✅ | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Read agent options\* | ✅ | ✅ | ✅ | ✅ | |
2024-07-02 15:11:43 +00:00
| Edit agent options | | | | ✅ | ✅ |
2023-05-16 17:18:29 +00:00
| Initiate [file carving ](https://fleetdm.com/docs/using-fleet/rest-api#file-carving ) | | | ✅ | ✅ | |
| View disk encryption key for macOS hosts | ✅ | ✅ | ✅ | ✅ | |
2025-06-14 19:26:45 +00:00
| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts | | | | ✅ | ✅ |
2024-05-02 22:06:36 +00:00
| Create, edit, resend and delete configuration profiles for macOS and Windows hosts | | | ✅ | ✅ | ✅ |
2023-08-22 10:55:14 +00:00
| Execute MDM commands on macOS and Windows hosts* | | | ✅ | ✅ | |
| View results of MDM commands executed on macOS and Windows hosts* | ✅ | ✅ | ✅ | ✅ | |
2025-06-14 19:26:45 +00:00
| Edit [team OS settings ](https://fleetdm.com/docs/rest-api/rest-api#os-settings ) | | | ✅ | ✅ | ✅ |
Fix a few broken references (#31640)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked table schema to confirm autoupdate
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com>
2025-08-21 17:13:45 +00:00
| Edit [macOS setup experience ](https://fleetdm.com/guides/macos-setup-experience#macos-setup-assistant )\* | | | ✅ | ✅ | ✅ |
2024-07-22 16:41:16 +00:00
| Run scripts on hosts | | | ✅ | ✅ | |
2023-10-10 22:00:45 +00:00
| View saved scripts | ✅ | ✅ | ✅ | ✅ | |
| Edit/upload saved scripts | | | ✅ | ✅ | |
| View script details by host | ✅ | ✅ | ✅ | ✅ | |
2024-02-16 18:26:33 +00:00
| Lock, unlock, and wipe hosts | | | ✅ | ✅ | |
2023-10-10 22:00:45 +00:00
2022-02-23 18:17:55 +00:00
2023-03-13 19:26:06 +00:00
\* Applies only to [Fleet REST API ](https://fleetdm.com/docs/using-fleet/rest-api )
2023-12-14 18:45:02 +00:00
\** Team-level users only see global query results for hosts on teams where they have access.
2023-04-26 14:38:20 +00:00
2024-08-16 20:30:31 +00:00
< meta name = "category" value = "guides" >
< meta name = "authorGitHubUsername" value = "noahtalerman" >
< meta name = "authorFullName" value = "Noah Talerman" >
2024-11-04 18:35:49 +00:00
< meta name = "publishedOn" value = "2024-10-31" >
2024-08-16 20:30:31 +00:00
< meta name = "articleTitle" value = "Role-based access" >
2023-07-13 16:57:17 +00:00
< meta name = "description" value = "Learn about the different roles and permissions in Fleet." >
