Dashboard Access by Role
As a tenant administrator, you can assign your colleagues roles to allow them to have limited access to Auth0 Dashboard features so they can complete their jobs without putting production applications at risk and complying with the least privilege principle.
You can assign the following roles for the Auth0 Dashboard:
|Admin||Read and write access to all resources in the Auth0 Dashboard.|
|Editor - Specific Apps||Read and write access to specific applications only.|
|Editor - Connections||Read, write, and create access to all types of connections.|
|Editor - Users||User management operations (create, delete, block, unblock, reset MFA, reset password, update metadata, assign roles, etc.) and access to logs.|
|Viewer - Users||Read-only access to users and logs.|
|Viewer - Config Settings||Read-only access to all configuration settings (applications, APIs, rules, security settings, etc.) except for sensitive information such as secrets, billing, users, and logs.|
|Support Access||Access to tickets (submit, view, and update) and aggregated metrics|
Availability varies by Auth0 plan
Your Auth0 plan or custom agreement affects the availability of this feature. To learn more, read Auth0's Pricing Page.
Tenant members with less privileged roles will have a restricted Dashboard experience and they will have access only to the sections and actions they can perform. The following table shows the specific feature permissions for each role.
|Dashboard Section||Subsection||Admin||Editor - Specific Apps||Editor - Connections||Editor - Users||Viewer - Users||Viewer - Config||Support Access|
|Applications||Applications||✍||✍ *¶||❌||❌||❌||👁 ‡||❌|
|SSO integrations||✍||✍ *¶||❌||❌||❌||👁 ‡||❌|
|Authentication||Database||✍||❌ †||✍||❌||❌||👁 ‡||❌|
|Social||✍||❌ †||✍||❌||❌||👁 ‡||❌|
|Email Providers||✍||❌||❌||❌||❌||👁 ‡||❌|
|Multi-factor Auth||✍||❌||❌||❌||❌||👁 ‡||❌|
|Auth Pipeline||Rules||✍||❌||❌||❌||❌||👁 ‡||❌|
|Monitoring||Logs||✅||❌||❌||👁 §||👁 §||❌||❌|
|Get Support||Support Tickets - Create||✅||✅||✅||✅||✅||✅||✅|
|Support Tickets - View All||✅||❌||❌||❌||❌||❌||✅|
|†||Previously available for Application Admin role but removed from Editor Specific Apps role|
Log events available to user roles
Logs can contain sensitive data, such as secrets, PII, etc. It is important not to disclose sensitive data to users whose role does not require that information. However, the Editor - Users or Viewer - Users roles need to have some access to logs to identity user issues. For example, finding out if the user signed up correctly, if the user was blocked, etc.
We allow the Editor - Users and Viewer - Users with access to a limited set of log types, that are connected to user events. The log events in the list provide the necessary information about user actions but do not disclose sensitive information about other parts of the tenant configuration. To learn more, read Log Event Type Codes.
cls cs f fce fcoa fcp fcpn fcpr fcu fdeac fdeaz fdecc fdu feacft feccft fede fens feoobft feotpft fepft fepotpft fercft fi flo fn fp fs fsa fu fui fv fvr gd_auth_failed gd_auth_rejected gd_auth_succeed gd_enrollment_complete gd_otp_rate_limit_exceed gd_recovery_failed gd_recovery_rate_limit_exceed gd_recovery_succeed gd_send_email gd_send_email_failure gd_send_pn gd_send_pn_failure gd_send_sms gd_send_sms_failure gd_send_voice gd_send_voice_failure gd_start_auth gd_start_enroll gd_tenant_update gd_unenroll gd_update_device_account limit_mu limit_wc mfar pwd_leak s sce scoa scp scpn scpr scu sdu seacft sede sens seoobft seotpft sepft sercft si slo ss ssa sv svr ublkdu w
Was this helpful?
Users with Admin role can invite Editor - Specific Apps users to one application at a time. To work around this, the Admin user can edit their role to assign multiple applications after the user accepts the invitation.
The Viewer - Users and Editor - Users roles don't have access to the Users' Devices and Authorized Apps sections.
The New Activity Page is visible to Admins and Support Access users only. Editor - Users and Viewer - Users can access daily activity (such as logins or signups) through the Auth0 Management API.
Private Cloud requirements
The Editor - Users and the Viewer - Users roles require that User Search v3 and Logs Search v3 are enabled in your environment. If your environments don’t support these versions, these two roles are unavailable.