# Global roles

> Global roles are set at the user level and grant a user additional permissions across the platform

---

Site [llms.txt](/llms.txt)

---

A user can be granted one or more of these roles:

- Super Admin
- Devops Admin
- Global Viewer

A fourth role, CloudBolt Admin, is available only when it is explicitly enabled. See [CloudBolt Admin](#cloudbolt-admin).

## Manage global roles

1. Select **Admin** > **Users**.
1. Select the user's email address to open their profile, where you can view their active global roles.
1. Select **Manage profile**.
1. Enable or disable global roles using the checkboxes.

<div class="alert alert-danger" role="alert">


Do not remove the Super Admin role from a user unless at least one other user is a Super Admin. Once a user is no longer a Super Admin, they cannot grant themselves or others that role.
</div>


## Global role permissions

The following table describes each global role.

| Role | Description |
| --- | --- |
| **Super Admin** | The Super Admin role grants all permissions in Cloud Management Platform (CMP), including the ability to administer the platform and full access to all groups, servers, and resources. |
| **Devops Admin** | The Devops Admin role grants a user access to all servers without requiring membership in each server's group. |
| **Global Viewer** | A Global Viewer can view most of the UI but, if this is their only role, has no edit capabilities. They may still see sensitive information, such as user details and portal settings.<br><br>A Global Viewer **cannot** see:<br>- Lists and details for all types of **Actions** (base Actions, Orchestration Actions, Server Actions, Resource Actions, Rules, and so on)<br>- Lists and details for Recurring Jobs<br>- Lists and details for Continuous Infrastructure Testing<br>- Lists and details for Configuration Managers<br>- Lists and details for External Orchestrators<br>- Lists and details for Security Information and Event Management<br>- Details for Parameters<br>- Details for Blueprints<br>- The **Version & Upgrade Info** details<br>- Lists and details for LDAP Utilities<br>- The **SSL Root Certificates** page<br>- The **Email Settings** page<br>- The **Miscellaneous Settings** page<br>- Other items under the Maintenance and Support Tools sections of the Admin page, including **Export & Download Database**, **View Application Log**, **Download All CloudBolt Logs**, and **Download Web Server Logs** |

## CloudBolt Admin

This role is only present when `CB_ADMIN_ENABLED` is set to `True` in `customer_settings.py`. It is off by default. For most deployments, the Super Admin global role provides sufficient administrator control, and CloudBolt Admin is not necessary.

The CloudBolt Admin role gives a user access to the Admin page, where they can create and edit all CMP objects, including:

- users
- resource handlers
- networks
- parameters
- preconfigurations
- actions

The Admin page also lets these users change email notifications and other global settings.

CloudBolt Admins are the only users allowed to create top-level groups in the group tree. They are not automatically granted any permissions on groups, servers, or resources; they only have the right to administer the platform itself.

For password policy settings and instructions on resetting the administrator password from the command line, see [Password policies and admin password reset](/docs/cmp/configure/access-and-security/groups-roles-permissions/password-policies/).