User Roles

The User Roles section contains the list of all built-in roles and allows you to create Custom Roles. Each built-in role has a description which provides information about the purpose of the role and what type of permissions are associated to it. On the right of the corresponding role 3 buttons can be found.

1. View: displays in detail all the permissions given to a role.

   

2. Clone: clones the selected role and allows you to customize the permissions starting from the cloned role
3. Assign Roles: list of which User Role can be assigned from this Role

  New roles can be created by either cloning and customizing existing roles or by creating a new role from scratch under the "Custom roles" tab. Custom roles allow you to granularly change the sections and functionalities that users can view and access.   List of built-in roles:

• Super Administrator: has full access to the appliance configuration and the details of any message.
• Administrator: has access to the appliance configuration and the details of any message. He cannot change roles, system related configurations or licensing accounting.
• Appliance Administrator: has full read-only access to all appliance configuration and the details of any message. . He has write permissions for all system related configuration, including network configuration, storage and retention configuration and monitoring integrations.
• Licensing Administrator: has full read-only access to all appliance configuration and the details of any message. He has write permissions to all licensing related configurations, including license details, user management and valid recipients.
• Quarantine Administrator: has full read-only access to all appliance configuration and to any message information. He has full access to quarantined email, and is authorized to release any incoming or outgoing message.
• Read-Only Administrator: has full read-only access to all appliance configuration and to any message information. He cannot release any message for the Quarantine.
• Domain Administrator: has full access to all domain configurations and message details. He has full access to quarantined email, and is authorized to release any incoming or outgoing message.
• Account Domain Manager: has access to all domain Valid Recipients, User Management and message details. He can create new users for managed domains and is authorized to release any incoming or outgoing message.
• Digest Report Domain  Manager: has access to all domain message details. He can manage all quarantine digest related options, including report delivery times and change users roles (explicitly granted by the super-admin). He's authorized to release any incoming or outgoing message.
• Quarantine Domain Manager: has access to all domain message details, and read-only access to basic domain configurations. He can release any incoming or outgoing message.
• Read-Only Domain Manager: has read-only access to all domain message details, and read-only access to basic domain configurations. He cannot release any message for the quarantine.
• User: can only act on messages they own. He's authorized to create welcomelist and blocklist, managing personal searches and reports, as well as release stored uninfected messages.
• Basic User (Release): can only act on messages they own. He can only manage personal searches and reports. He can release stored uninfected messages.
• Basic User (Ask Release): can only act on messages they own. He can only manage personal searches and reports. He can ask a domain administrator to release messages.
• Basic User: can only act on messages they own. He can only manage personal searches and reports. He cannot release messages.
• Read-Only User: can only read messages they won. He can only manage personal searches and reports. He cannot release messages and cannot use email continuity.
• Null User: cannot log in and cannot perform any actions. This role is only useful for proper license accounting, especially when using third party integrations.
• Functional User: a special type of user created by automatic imports from integrations, meant to be used with shared mailbox accounts. Whenever a message is owned by a functional user, then any logged-in user is able to release or whitelist that message, given that he has a quarantine action link. A functional user cannot directly log in on the web portal.
• Basic Functional User (Release): a special type of user created by automatic imports from integrations, meant to be used with shared mailbox accounts. Whenever a message is owned by a functional user, then any logged-in user is able to release that message, given that he has a quarantine action link. A functional user cannot directly log in on the web portal.
• Basic Functional User (Ask Release): a special type of user created by automatic imports from integrations, meant to be used with shared mailbox accounts. Whenever a message is owned by a functional user, then any logged-in user is able to ask to release that message, given that he has a quarantine action link. A functional user cannot directly log in on the web portal.
• Null Functional User: cannot log in and cannot perform any actions. This role is only useful for proper license accounting, especially when using third party integrations.
• Network: is used when Anonymous access is granted via Safe-Learn Networks. He has permission to add any welcomelist, add any blocklist, and release any message, provided he's from an authorized IP and has a valid quarantine action link.
• API: no permissions by itself, but can impersonate any user (including super admins). Use this only for server side applications when a proper user API login isn't appropriate. More details provided here.