Understanding user roles for organizations
Estimated 3 minute read
You will learn
Learn the difference between organization-level static roles and custom user roles, and how to combine permission sets into a custom organization role.
Static roles
Static roles are fixed personas with a predefined set of access. They cannot be edited or mixed with permission sets.
Role | Description |
|---|---|
Super Admin | Full access to organization settings, linking/unlinking accounts, requesting accounts for data sharing, user management, and analytics, plus read-only billing views. This role has access to all accounts in the organization. This is the highest level of permission available, so only grant it to people who need this level of access. |
Analyst | Read-only access to reporting for the accounts the user can access. Built for centralized analytics teams and individuals who need visibility into the business without needing to execute. Includes view-only analytics access. Excludes all edit permissions, billing views, and org-level settings. |
When assigning an Analyst or custom role, choose All accounts, By group, or Specific under Account access. Super Admin always has access to all accounts in the organization.
Custom user role
Custom roles are built by combining permission sets, and the access levels within them, to fit a specific need. Choose the permission sets and access levels that match the user's responsibilities:
Permission set | Access level | Description |
|---|---|---|
User Management | View or Edit | View organization users, roles, and activity logs. With Edit, add/remove organization users, update their roles, and create or manage custom roles. |
Account Management | Edit | Manage data-sharing consent requests, link/unlink accounts to the organization, and organize accounts into groups. |
Billing | Read | View all billing pages. |
Analytics | Read | View reporting for the accounts the user can access. |
Data Warehouse Sync | View or Edit | View data warehouse import syncs for the organization’s accounts. With Edit, create and manage these syncs. Requires your organization to have access to data warehouse imports. Assign the role with All accounts access. |
Only grant User Management > Edit and Account Management > Edit to people who should manage organization users or linked accounts. These permissions do not grant access to all organization settings.
Create a custom organization role
You need Super Admin or a custom role with User Management > Edit for the organization to create roles.
- In your organization, go to Settings > General > Users & Permissions.
- In the Roles section, click Add.
- Enter a Name and Description for the role.
- Under Permissions, turn on each permission set you need and select its access level. Where both View and Edit are offered, selecting Edit also includes View.
- Click Create. The role appears in Roles and is available when you invite or edit an organization user.