> For the complete documentation index, see [llms.txt](https://docs.idlayr.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.idlayr.com/enterprise-portal/users-and-roles.md).

# Users and roles

The Enterprise Portal supports **role-based access control (RBAC)** so you can grant your team the access they need without over-privileging anyone. Roles are **fixed** — IDlayr defines the role set; customers don't create custom roles in the Portal.

## How users get access

Users sign in via your organisation's SAML SSO connection — see [Sign in](/enterprise-portal/sign-in.md). Anyone in your IdP whose account belongs to a domain linked to the SSO connection can reach the Portal sign-in. The Portal doesn't auto-grant elevated permissions on first sign-in — role assignment is a deliberate step.

## The role set

The exact role names and their permission boundaries are confirmed per workspace during onboarding. The shape of the role set, in general terms:

* **Owner:** Setup of the organization (Vonage), view of workspace and project details, and access to analytics
* **Administrator:** Full access except organization setup, including user-role management, credentials management, and requests to move projects to production
* **Operational Administrator:** Same access as Administrator, excluding credentials management
* **Manager:** Access to analytics, logs, and workspace/project view and edit
* **Analyst:** Access to logs only

## What the roles gate

In broad terms:

<table><thead><tr><th width="197.90625">Features</th><th width="96.8828125">Owner</th><th width="91.53515625">Admin</th><th width="131.3125">Operational Admin</th><th width="107.55078125">Manager</th><th>Analyst</th></tr></thead><tbody><tr><td>Setup organization</td><td>X</td><td></td><td></td><td></td><td></td></tr><tr><td>View workspace details</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Edit workspace details</td><td>x</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Edit workspace API credentials</td><td>x</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Project configuration - view</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Project - allowed networks</td><td>X</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Project configuration - create / edit</td><td>x</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Project client credentials - generate / revoke</td><td>x</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Project client credentials - view</td><td>x</td><td>X</td><td></td><td></td><td></td></tr><tr><td>Move project to production</td><td>x</td><td>X</td><td>X</td><td></td><td></td></tr><tr><td>Add and edit members, remove members</td><td>x</td><td>X</td><td>X</td><td>X (for non-enterprise sso)</td><td></td></tr><tr><td>Invite new members through the portal</td><td>x</td><td>X</td><td>X</td><td>X (for non-enterprise sso)</td><td></td></tr><tr><td>Change status of projects</td><td>x</td><td>X</td><td>X</td><td></td><td></td></tr><tr><td>Access to statistical data (overview; coverage; latency)</td><td>X</td><td>X</td><td>X</td><td>X</td><td></td></tr><tr><td>Access to event data list &#x26; filters</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>View / download activity report</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr><tr><td>Manage personal data (email and password)</td><td>X</td><td>X</td><td>X</td><td>X</td><td>X</td></tr></tbody></table>

## Why roles are fixed

The current fixed-role design covers the common admin/operator/read-only split that most enterprise customers need and keeps the access model predictable across customers. If your security policy requires permission granularity that the current roles don't satisfy, contact your IDlayr account team.

## Removing access

To revoke a user's access:

* **Inside the Portal** — please contact IDlayr.
* **From the IdP** — deprovisioning the user in your identity provider also revokes their Portal access. This is the recommended path when an employee leaves your organisation: your IdP lifecycle controls the IDlayr lifecycle automatically.

## What's next

* [**Sign in**](/enterprise-portal/sign-in.md) — SSO setup and the IdP connection.
* [**Projects**](/enterprise-portal/projects.md) — the unit of configuration that roles gate access to.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.idlayr.com/enterprise-portal/users-and-roles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.