Before you begin
- An Atlas AVD Admin or Super Admin (User Administration is available to administrators only)
How RBAC works
Access is decided in three layers: permission (does your role grant it), tier (does your license unlock the feature), and tenant membership. RBAC is allow-only (there are no deny overrides) and platform-wide rather than per resource: you cannot make someone an Operator on one host pool but not another. Each user has a single role. The server always makes the final decision; hiding a button in the browser is only a convenience.
The available roles
The built-in roles, as the role selector names them, are Super Admin, Admin, Operator, Security Admin, Auditor, Help Desk, Billing Viewer, Reports Viewer, Read Only, and Portal User. Super Admin can do everything an Admin can, plus platform-wide settings. Portal User is for the self-service portal only and cannot sign in to the admin console. Reports Viewer and Read Only are for your customers' own staff and must be limited to specific tenants.
Administrators can also create custom roles on the Roles tab. A user's custom role replaces the permissions of their base role; the Users table shows it under the role as "Custom role: <name>".
Where to assign roles
Go to Administration → Tenants → User Administration. The User Management tab lists every user with an inline Role selector, their status, their tenant access, and when they joined; the Roles tab holds custom role definitions. The selector marks Super Admin and Admin as High risk and Operator and Security Admin as Medium risk.
Change an existing user's role
- Go to Administration → Tenants → User Administration → User Management.
- On the user's row, open the Role selector and choose the new role.
- If either the old or the new role is High or Medium risk (Super Admin, Admin, Operator, or Security Admin), Atlas asks you to confirm the change first.
- Click Confirm change. A Role updated message confirms it.
You cannot change your own role: the selector on your own row is locked ("Ask another admin to change your role"), so you can never lock yourself out.
Add users and limit them to tenants
Click Add User to find someone in your directory (or type their email), pick a role, and choose their tenant access: All Tenants, or Specific Tenants. Use Bulk Add to paste several email addresses at once. To change what a user can reach later, open the row's actions menu and choose Edit tenant access. Reports Viewer and Read Only cannot have all-tenants access; if you switch someone to one of those roles, Atlas first asks you to pick their tenants.
RBAC is audited
Role changes and user additions or removals appear in the audit trail, and every denied permission check is recorded as RBAC Denied. Five or more denials from the same user within ten minutes raise a critical "Privilege probing detected" alert. See Audit Logging to review them.