# Admin roles

> Admin roles grant users a precise subset of administrative permissions, optionally scoped to a tenant or to specific resource technologies

---

Site [llms.txt](/llms.txt)

---

Combine admin roles with group, special, and global roles to give users exactly the administrative capabilities they need, such as a slice of what a Super Admin can do.

Example: to let a user manage resource handlers but nothing else an administrator can do, create an admin role with only the **Manage Resource Handlers** permission.

With [multi-tenancy](/docs/cmp/configure/access-and-security/multi-tenancy/), admin roles control the management permissions users have within their tenant. For users who are not part of a tenant, their admin roles apply everywhere: across all tenants and to global objects.

## Manage admin roles

Admin roles are listed on the **Admin Roles** tab of the **Admin** > **Roles** page, where you can add, edit, and delete them. The add and edit dialogs set the role's [admin permissions](#admin-role-permissions), assign it to users, and apply resource technology restrictions.

### Add an admin role

1. Go to **Admin** > **Roles** and select the **Admin Roles** tab.
1. On the tab, select **Add**.
1. Provide a **Label**, **Name**, and optional **Description**.
1. Select **Permissions** for this role.
1. Optionally assign users to the role.

Selecting any of the four resource handler-related permissions (**Manage Resource Handlers**, **Manage Environments**, **Manage Networks**, or **Manage OS Builds**) reveals the **Resource Technologies** field. Set one or more technologies to scope those permissions to them, or leave it empty to apply them across all technologies. The field affects only those four permissions, which is useful when, for example, different teams manage AWS versus VMware. For environments, networks, and OS builds, the technology is provided by the associated resource handler.

## Assign admin roles

You can assign admin roles in two places: when adding or editing a role on the Roles page, and when adding users to a tenant, where the roles then apply only in that tenant. When users are removed from a tenant, their admin roles are removed.

A user's profile shows their admin roles and tenant membership. To assign roles automatically, use [External User Sync/LDAP Mappings](/docs/cmp/configure/access-and-security/users/sso-saml/orchestration-actions/): when adding or editing an LDAP mapping (**Admin** > **LDAP Authentication Settings** > **your LDAP utility** > **Group Mappings**), select one or more admin roles to grant to matching LDAP users.

## Admin role permissions

The set of admin permissions is fixed: you can select from those provided but cannot add new ones. If you need a permission that does not exist, [contact CloudBolt Support](/docs/cmp/support/).

When a permission grants management of a type of object, it applies to all objects of that type, or, for a user in a tenant, only those in their tenant.

A tenant-specific admin role can view and manage only the groups allowed by its group role membership, so it can assign the environments it creates only to those groups. It cannot see or modify groups in other tenants.

### Available admin permissions

| Name | Label |
| --- | --- |
| application.manage | Manage Applications |
| configmanager.manage | Manage Configuration Managers |
| containerorchestrator.manage | Manage Container Orchestrators |
| environment.manage | Manage Environments |
| flowcontrol.operator | Manage Flow Control Operations |
| flowcontrol.manage_filters | Manage Flow Control Filters |
| ipam.manage | Manage IPAMs |
| network.manage | Manage Networks |
| osbuild.manage | Manage OS Builds |
| preconfiguration.manage | Manage Preconfigurations |
| resourcehandler.manage | Manage Resource Handlers |
| resourcepool.manage | Manage Resource Pools |
| sshkey.manage | Manage SSH Keys |
| user.manage | Manage Users |
| vaults.manage | Manage Password Vaults |

**Manage Resource Handlers**, **Manage Environments**, **Manage Networks**, and **Manage OS Builds** can be scoped to specific resource technologies. See [Manage admin roles](#manage-admin-roles).