Permissions

Learn about Cloud Management Platform (CMP) permissions, the roles they are attached to by default, and what they do

  5 minute read  

Permissions are assigned to group and special roles. Each role is assigned default permissions, which you can add to or remove from group and special roles. This is a separate set of permissions from those associated with admin roles.

View permissions

  1. Select Admin > Permissions.
  2. Use the search box or page arrows to find specific permissions.

Use permissions

See Groups, roles, and permissions for details on how permissions are used.

Permissions

Orders

Name Label Description
order.approve Approve Orders Allows the user to approve and deny orders.
order.view View Orders Grants the user view-only permission for orders.
order.submit Submit Orders Allows the user to order servers and blueprints.
order.change_attributes Change Order Attributes Change the order name.
order.choose_recipient Choose Recipient for Orders Allows the user to choose a recipient other than themselves to own the servers or resources created by an order.

Servers

Name Label Description
server.view View Servers Grants the user view-only permission for servers.
server.manage_snapshots Manage Snapshots Create, delete, and restore from server snapshots.
server.manage_nics Manage NICs Add and remove NICs on servers.
server.console Console Open a console session to a server.
server.remote_terminal Remote Terminal SSH/RDP access to servers from the CMP UI.
server.manage_applications Manage Apps Install and uninstall configuration manager applications on servers.
server.change_attributes Change Attributes Change the environment, group, OS Family, and OS Build associations for servers.
server.manage_labels Manage Labels Add and remove labels on servers.
server.manage_parameters Manage Server Parameters Add, remove, and modify parameters (Custom Fields) on servers.
server.delete Delete Server Allows the user to delete servers.
server.manage_credentials Manage Server Credentials Allows the user to view and manage the credentials used to run remote actions on servers.
server.view_handler_specific_details View Handler-Specific Details Allows the user to see resource handler-specific details for servers, such as the VMware cluster or AWS region.
server.all_actions Run All Server Actions Allows the user to run any server action available on the server.
server.view_power_schedule View Server’s Power Schedule Allows the user to view the schedule for recurring power control on the server.
server.manage_power_schedule Manage Server’s Power Schedule Allows the user to edit the schedule for recurring power control on the server.
server.add_disks Add Disks Allows the user to add disks to a server.
server.remove_disks Remove Disks Allows the user to remove disks from a server.
server.resize_disks Resize Disks Allows the user to resize disks on a server.
server.resize Resize VM Change the type (size) of a virtual machine.
server.define_remote_script Define Remote Script Allows the user to choose servers when creating a remote script action.

Resources

Name Label Description
resource.view View Resources Allows the user to view resources.
resource.change_attributes Change Resource Attributes Change attributes for resources.
resource.manage_parameters Manage Resource Parameters Add, remove, and modify parameters (Custom Fields) on resources.
resource.all_actions Run All Resource Actions Allows the user to run any resource action available on the resource.
resource.view_power_schedule View Resource’s Power Schedule Allows the user to view the schedule for recurring power control on the resource.
resource.manage_power_schedule Manage Resource’s Power Schedule Allows the user to edit the schedule for recurring power control on the resource.
resource.manage_labels Manage Labels Add and remove labels on resources.

Groups

Name Label Description
group.view View Group Details Allows the user to view a group’s details.
group.change_attributes Change Group Attributes Allows the user to change a group’s attributes.
group.delete Delete Group Allows the user to delete groups.
group.create_subgroup Create Subgroup Allows the user to create a subgroup within an existing group.
group.manage_members Manage Group Memberships Allows the user to manage group memberships.
group.manage_networks Manage Group Networks Allows the user to manage group networks.
group.manage_parameters Manage Group Parameters Allows the user to manage group parameters.
group.manage_subgroup_quotas Manage Subgroup Quotas Allows the user to manage quotas for subgroups of a group.
group.manage_members_view_unassigned_users Manage Group Memberships - View Unassigned Users Allows the user to view and add users to groups they manage that do not currently have a group assigned (such as new users). Requires the group.manage_members permission.
group.edit_parameter_values Change Value Of Parameters Allows the user to change the values of existing parameters.

Blueprints

Name Label Description
blueprint.manage Manage Blueprints Allows the user to perform most management actions on blueprints the group can manage, such as setting the resource type, allowing additional groups to manage or deploy it, and adding build items. Exceptions handled by other permissions include configuring the blueprint so any group can deploy (blueprint.any_group_can_deploy) and creating a new parameter from the blueprint (blueprint.create_parameters).
blueprint.any_group_can_deploy Configure Blueprints So Any Group Can Deploy Allows the user to modify a blueprint’s settings so it is available for deployment by all groups on the instance, current and future. This permission can have a broad impact; we recommend limiting it to Resource Admin or a similar role.
blueprint.create_parameters Create Blueprint Parameters Allows the user to create blueprint parameters only.
user.create_parameters Create User Parameters Allows the user to create user parameters only.
environment.create_parameters Create Environment Parameters Allows the user to create environment parameters only.

Jobs

Name Label Description
job.view View Jobs Allows the user to view jobs.
job.view_logs View Job Logs Allows the user to view and download job logs.
job.cancel Cancel Jobs Allows the user to cancel in-progress jobs.
job.rerun Re-run Jobs Allows the user to re-run failed jobs.

Data protection

Name Label Description
dataprotection.manage_parameter_dataprotection_plan Manage Data Protection Plan Allows the user to manage servers’ data protection plans.
dataprotection.restore_from_snapshot Restore Data Protection Snapshots Allows the user to restore a host from a data protection snapshot.

OneFuse

Name Label Description
module.view View Modules Allows the user to view modules.
policy.list List Policies Allows the user to list OneFuse policies.
policy.manage Manage Policies Allows the user to create, edit, and delete OneFuse policies.
policy.execute Execute Policies Allows the user to run OneFuse policies.