---
title: Roles & Permissions
slug: roles-and-permissions
docTags: 
createdAt: 2024-06-10T21:21:30.773Z
---

This document describes what each team member role can and cannot do within the Flare platform to ensure clarity for operational workflows and onboarding.

# Organization-Level Roles

:::hint{type="info"}
Flare uses **organization-level roles** to manage access and responsibilities across your entire account
:::

- **Organization Admin**: This role has **full administrative control** across all tenants in your organization. Org Admins can create and manage tenants, assign tenant-level admin and other roles, configure tenant & organization-wide integrations (including SSO), and oversee user management at the organization level.
- **Regular Member**: This role allows users to participate within tenants of the organization, with access and actions determined by the specific tenant-level roles **(Tenant Admin, Tenant Editor, Tenant Viewer)** assigned to users within each tenant. You can have more information in the Tenant-Level Roles Section below.

|                         | Org Admin | Regular Members        |
| ----------------------- | --------- | ---------------------- |
| Create & Manage Tenants | ✅         | ❌                      |
| Assign Tenant Admin(s)  | ✅         | ❌                      |
| Manage Integrations     | ✅         | ✅ (Only Tenant Admins) |



# Tenant-Level Roles

:::hint{type="info"}
Flare uses **tenant-level roles** to control what users can do within each tenant under a specific organization. 
:::

These roles determine access for **Regular Members** to features, data, and actions within a **specific tenant**. Tenant-level roles ensure your team members have **the right level of access based on their responsibilities**, while maintaining security and operational clarity across your Flare environment. 



✅ Can Edit
- 🔍 Read-Only Access -
❌ No Access

|                                           | Tenant<br />**Admin&#x20;** | Tenant<br />**Editor** | Tenant<br />**Viewer** |
| ----------------------------------------- | --------------------------- | ---------------------- | ---------------------- |
| Manage Users within Tenant                | ✅                           | ❌                      | ❌                      |
| Manage Email Alert Channels               | ✅                           | ✅                      | ❌                      |
| Manage Identifier(s)                      | ✅                           | ✅                      | 🔍                     |
| Manage Report(s)                          | ✅                           | ✅                      | 🔍                     |
| Remediate/Ignore Event(s) & Credential(s) | ✅                           | ✅                      | ✅                      |
| View Passwords for Credentials            | 🔍                          | 🔍                     | 🔍                     |
| Validate Credentials (EntraID)            | ✅                           | ✅                      | 🔍                     |
| Use Global Search (scoped by tenant)      | **✅**                       | **✅**                  | **✅&#x20;**            |
| Use Threat Flow                           | ✅                           | ✅                      | ✅                      |
| API Access (Create API Keys)              | ✅                           | ✅                      | ✅                      |
| Takedown Requests                         | ✅                           | ✅                      | ❌                      |

When adding a member to a new tenant, you’ll now see an overview of the key permissions they can access. For the complete list of available permissions, refer to the table above.

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/e55qT86pEiPz3M70hu0n2_image.png)

If you want more information on how to add a member and assign a specific role, you can go to the dedicated section [Team](docId:4XEiipG1BveF7A2bUan9_)&#x20;

# FAQ

**Can a Tenant Admin assign another Tenant Admin?**

- No. Only an Organization Administrator (Org Admin) can grant or revoke the **Tenant Admin** role. Tenant Admins cannot promote other users to Tenant Admin within their tenant—this prevents privilege escalation and maintains separation of duties.

**Can a Tenant Admin create a new tenant?**

- No. Only an **Org Admin** can create tenants within the organization. Tenant Admins can manage settings and users for the tenants they’re assigned to, but they cannot create additional tenants.

**Can a Tenant Admin add a user not already added to the Org?&#x20;**

- Yes

**What if a Tenant Admin is adding member that already exists in the Org?**

- If the email is already registered in the organization, the existing account will be added to the Tenant. The First and Last Name entered will not update their existing details within the Organization.

For more details on the Tenant Admin role capabilities, check out this [Storylane](https://app.storylane.io/share/aaqdccnkkwmd) walkthrough.

# Related Articles

:::CtaButton{label="Team" docId="4XEiipG1BveF7A2bUan9_" openInNewTab="true"}

:::

:::CtaButton{label="Tenants" docId="4jnD2N4qP8zbuc7ti7REF" openInNewTab="true"}

:::

:::CtaButton{label="SSO and Authentication" docId="38ubpe5wKfAJ6GQSiH1hc" openInNewTab="true"}

:::