# Groups, roles, and permissions
> Learn how groups, roles, and permissions work together in Cloud Management Platform (CMP) and how to use them
---
Site [llms.txt](/llms.txt)
---
## Groups
**Groups** associate [users](/docs/cmp/configure/access-and-security/users/) with [environments](/docs/cmp/configure/infrastructure/environments/) and help you manage permissions, approval processes, and quotas. A group can represent a business unit, department, team, project, or any other set of users.
In the navigation menu, select **Groups** to open the Groups page, where you can view your groups along with their quotas, members, and resources across up to three levels of subgroups.
Each group has the same set of roles that users can belong to, which grant permissions within that group. For example, a user could be a requester in one group and an approver in another.
Groups are stored hierarchically, allowing you to model organizational structures and delegate each group's administration to the appropriate person.
You can define any group type, but you must explicitly allow new group types to order resources. Go to **Admin** > **Miscellaneous Settings**, select the UI tab, and edit the settings to specify **Group Types shown on Order form**.
## Quotas
Use quotas to limit the cost and quantity of resources that a group provisions. A quota applies to all users in the group and specifies the maximum they can collectively use. You can also configure notifications when quota limits are exceeded. The quotas dashboard displays the configured limits, the used quantity, the delegated quantity (if any), and the remaining quantity available.
You can set quotas for the following:
- **Servers**: The total number of servers the members can provision.
- **Rate in USD/month**: The maximum amount the group can spend each month to provision resources.
- **CPU Count**: The maximum number of CPUs the group can provision.
- **Memory Size**: The maximum amount of memory the members can collectively provision.
- **Disk Size**: The maximum amount of disk storage the members can collectively use.
## Group roles
Roles grant specific privileges to group members. Those privileges apply only to the resources and environments associated with the group. There are six built-in roles on groups, and you can configure your own.
**Example:** a user with the default Requestor role on a group can request resources in the group's environments, while a Resource Admin on that same group can manage any of the group's servers.
### Built-in roles
Select **Admin** > **Roles** and open the Group Roles tab. Each user in a group can be assigned any combination of these roles, and the roles they hold determine which individual and group actions they can perform. Administrators can customize the permissions for each role, or delete roles that are not needed.
| Role | Description | Default permissions |
| --- | --- | --- |
| Approver | Approves orders submitted by other users. You can grant the approver role to a user, or create a group with approval permissions and add users to it. | order.approve
order.view
order.change_attributes |
| Group Admin | Manages the group's organizational aspects: membership and permissions, subgroup creation and management, and delegation of responsibilities to other group members. | group.view
group.change_attributes
group.delete
group.create_subgroup
group.manage_members
group.manage_subgroup_quotas |
| Requestor | Submits orders to create, modify, or delete servers, individually or within a group they belong to. | order.submit |
| Resource Admin | Manages technical configurations for the group, such as parameters and networks. Can also manage blueprints and servers. | order.submit
server.view
server.control_power
server.manage_snapshots
server.manage_nics
server.change_resources
server.console
server.remote_terminal
server.manage_applications
server.change_attributes
server.manage_labels
server.manage_parameters
server.delete
server.manage_credentials
server.view_handler_specific_details
resource.view
resource.change_attributes
resource.manage_parameters
group.view
group.change_attributes
group.manage_networks
group.manage_parameters
blueprint.manage
blueprint.any_group_can_deploy
server.view_power_schedule
server.manage_power_schedule
server.add_disks
server.remove_disks
server.resize_disks
resource.view_power_schedule
resource.manage_power_schedule |
| Delegate Server Owner | Can be assigned to users in a server's management groups to give them permissions comparable to the server's owner. | server.view
server.control_power
server.manage_snapshots
server.manage_nics
server.change_resources
server.console
server.remote_terminal
server.manage_applications
server.change_attributes
server.manage_labels
server.manage_parameters
server.delete
server.manage_credentials
server.view_handler_specific_details
server.view_power_schedule
server.manage_power_schedule
server.add_disks
server.remove_disks
server.resize_disks |
| Viewer | Has basic permissions to view group servers, members, and activity. | order.view
server.view
resource.view
group.view
server.view_power_schedule
resource.view_power_schedule |
### OneFuse roles
| Role | Description | Default permissions (when OneFuse is licensed) |
| --- | --- | --- |
| Workspace Admin | Manages workspace users and content for OneFuse. | group.create_subgroup
group.manage_members
module.view
policy.list
policy.manage
policy.execute |
| Workspace Member | Manages workspace content, such as endpoints and policies, for OneFuse. | module.view
policy.list
policy.manage
policy.execute |
| Workspace Executor | Runs workspace policies but cannot create, edit, or delete them. | module.view
policy.list
policy.execute |
| Workspace Viewer
*(The label may appear as "Viewer" if CMP was licensed first.)* | Views workspace content, such as endpoints and policies, for OneFuse. | module.view |
### Restore defaults
- Select **Restore defaults** to return all built-in roles to their default configuration. This also reinstates deleted built-in roles.
- In the **Actions** column, select the curved arrow icon to restore an individual built-in role to its default configuration.
Neither action affects user-defined roles.
### Duplicate roles
Duplicate an existing role and copy its permissions.
1. Select **Admin** > **Roles**.
1. In the **Actions** column, select the copy icon.
1. Add a label, unique name, and optional description for the duplicate role.
1. Select **Duplicate**.
Duplicated roles do not copy server actions, resource actions, or groups.
## Special roles
The Roles page has a separate tab for special roles. Special roles are not assignable; they are determined by context. For example, the Resource Owner role applies whenever determining permissions for a resource that the user owns.
By default, special roles inherit all permissions for their object type. For example, a Server Owner can do anything to a server they own.
| Role | Description | Default permissions |
| --- | --- | --- |
| Job Owner | Permissions granted to owners of jobs. | job.view
job.view_logs
job.cancel
job.rerun |
| Resource Owner | Permissions granted to owners of resources. | resource.view
resource.change_attributes
resource.manage_parameters
resource.all_actions
resource.view_power_schedule
resource.manage_power_schedule |
| Server Owner | Permissions granted to owners of servers. | server.view
server.control_power
server.manage_snapshots
server.manage_nics
server.change_resources
server.console
server.remote_terminal
server.manage_applications
server.change_attributes
server.manage_labels
server.manage_parameters
server.delete
server.manage_credentials
server.view_handler_specific_details
server.all_actions
server.view_power_schedule
server.manage_power_schedule
server.add_disks
server.remove_disks |
### Delegated group administration
Delegated group administration lets organizations decentralize CMP administration at the group level by giving select users the ability to administer entire groups. Because group admins can, by default, make changes only within their group, not across the entire instance, this is a safe way to delegate administrative responsibilities to match your organizational structure.
**Example:** Barbara is the technical head of a company's investment banking division. Giving her the Group Admin role for the group named Investment Banking lets her administer it. Because groups can be nested, she can create subgroups for their subdivisions and grant the Group Admin role to other users on them (unless that role has been customized to remove those permissions). For finer-grained delegation, associate permissions such as group.create_subgroup and group.manage_members with roles, then assign users to those roles in a group.
The Group Admin role does not imply any other roles. A group admin cannot request or approve orders unless they or another group admin grants them the appropriate roles and privileges.
## Change a user's role
You can configure the roles granted to a user for a particular group in the group's details view or on the user's profile page.
### Inheritance of group permissions
On the Groups list page, you can enable inheritance of group permissions from parent groups to subgroups. This applies to both internal and external users, but only to group roles.
When inheritance is first enabled, all currently configured users and their roles on a parent group are inherited by all its subgroups. Inherited permissions are marked as such in the UI and cannot be removed from the subgroups.
From then on, while inheritance is enabled, any change to permissions on a parent group propagates to its subgroups. This applies when a user is assigned a new group role (including through an External User Sync action) or when a role is removed from a user in that group. A new subgroup also automatically gets its parent group's permissions on creation.
You can disable inheritance from the Groups list page when it is no longer needed. Existing permissions are then no longer considered inherited and can be removed, but they are not removed automatically.
## Customize roles
The Roles page shows all group, admin, and special roles and lets you edit, create, and delete them.
The set of permissions a user has in a particular context is the sum of all the permissions across the group roles they have in the applicable group, any admin permissions across their admin roles (potentially in the applicable tenant), and any special roles that apply.
A group role and a special role differ in effect. With a group role, the permission applies to all objects in the group. With a special role, it applies only to objects that match that role's criteria. For example, the server.view permission in the default Viewer role lets a user view all servers in the group, while the same permission in the default Server Owner role lets a user see only the servers they own.
When editing a group or special role, you can configure both permissions for CMP functionality (such as server.manage_snapshots) and permission to run server actions and resource actions. For actions, you have two options: grant server.all_actions and resource.all_actions to run all server and resource actions, or use the Server Actions and Resource Actions fields to allow only specific actions.
Special roles cannot be deleted or renamed. When editing one, the permissions and actions fields are adjusted to the role to improve clarity. For example, giving non-server permissions to, or associating resource actions with, the Server Owner role does not make sense, so those options are not available.
---
Section pages:
- [Permissions](/docs/cmp/configure/access-and-security/groups-roles-permissions/permissions/): Learn about Cloud Management Platform (CMP) permissions, the roles they are attached to by default, and what they do
- [Global roles](/docs/cmp/configure/access-and-security/groups-roles-permissions/global-roles/): Global roles are set at the user level and grant a user additional permissions across the platform
- [User permission and attribute synchronization](/docs/cmp/configure/access-and-security/groups-roles-permissions/permission-sync/): Synchronize user permissions, group membership, and attributes from Active Directory into Cloud Management Platform (CMP), so you can manage them in your directory instead of the UI
- [Admin roles](/docs/cmp/configure/access-and-security/groups-roles-permissions/admin-roles/): Admin roles grant users a precise subset of administrative permissions, optionally scoped to a tenant or to specific resource technologies
- [Password policies and admin password reset](/docs/cmp/configure/access-and-security/groups-roles-permissions/password-policies/): Configure password policy settings and reset the administrator password from the command line