Skip to content

Change a user's roles

Decide which built-in roles a member holds in your tenant. The roles you save replace the ones the member held here; their roles in other organizations are not touched.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant. The person's Roles tab appears only to someone who holds the permission to read a user's roles, and its checkboxes can be changed only by someone who also holds the permission to change them.

Two rules bound who you can change:

  • You can only confer what you hold yourself: a role that carries a permission you lack is refused.
  • You can only change someone whose current permissions in your tenant you cover. A tenant access administrator cannot change the roles of a tenant administrator, not even to give them a smaller role.

You cannot change your own roles. On a SaaS deployment, a platform operator working inside your tenant under a support-access session cannot change anyone's roles.

Before you start

  • Know which role the person needs. What each role lets a person do is shown on the roles screen.
  • Custom roles composed on the roles screen are not offered here; only the built-in tenant roles that can be assigned in your tenant are.

Steps

  1. Open Users in the sidebar.
  2. On the person's row, select the eye icon (View).
  3. Open the Roles tab.
  4. Tick the roles the person should hold, and clear the ones they should not hold.
  5. Select Save.
  6. When the change removes a role the person held, the console asks you to confirm it, and warns that if the change takes away a permission they currently hold, their active sessions in this tenant end immediately. Select Remove roles.

What you see when it worked

The Roles tab shows the new set, and the person's row lists it in Team Members. When the change takes effect depends on its direction:

  • A role added reaches a person who is signed in when their session token is next renewed, or at their next sign-in. Nobody is signed out.
  • A change that takes away a permission the person holds ends their active sessions in your tenant at once, and they sign in again. Their sessions in other organizations keep working. Removing a role whose permissions the roles they keep still carry signs nobody out.

A role assigned through the API that is not a built-in composite role appears as a legacy granular assignment. Save keeps it; Replace legacy with composite removes it and keeps only the roles you ticked.

If it fails

What you see Cause What to do
The tab shows a warning that you cannot modify your own permissions You opened your own account Ask another administrator to change your roles
A refusal naming the permissions you lack (scope-subset-violation) The roles would confer a permission you do not hold, or the person currently holds permissions you do not Ask an administrator who holds those permissions to make the change
A refusal that the operation is not available while acting on behalf of a tenant You are in a support-access session on a SaaS deployment An administrator of the tenant makes the change
"Could not load the role catalog. Cannot manage roles without it." The list of roles could not be read Select Retry
The change is recorded as a request awaiting approval Your tenant requires quorum approval for a role that makes someone an approver The role is assigned when the request is approved

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/users/{userId}/roles (operation assignUserRoles) with the full set of roles; the set replaces the current one

The key management CLI and the admin SDK have no command or method for this task.