As a tenant administrator, you can assign roles to your colleagues that grant them limited access to the . This allows tenant members to complete their jobs without putting production applications at risk, while also complying with the principle of least privilege.
Every role receives access to Support Center.

​
Dashboard roles

You can assign the following roles for Auth0 Dashboard access:
RolePermissions
AdminRead and write access to all resources in the Auth0 Dashboard, including extensions.
Editor - ConnectionsRead, write, and create access to all types of connections.
Editor - Key ManagementCreate and manage cryptographic keys.
Editor - OrganizationsRead, write, and create access to Organization configuration. Read-only access to Users, Roles, and Connections.
Editor - Specific AppsRead and write access to specific applications only.
Editor - UsersUser management operations (create, delete, block, unblock, reset MFA, reset password, update metadata, assign roles, etc.) and access to logs.
Viewer - UsersRead-only access to users and logs.
Viewer - Config SettingsRead-only access to all configuration settings (applications, APIs, rules, security settings, etc.) except for sensitive information such as secrets, billing, users, and logs.
Support Access - DeprecatedAccess to tickets (submit, view, and update) and aggregated metrics.
Elevated Support AccessRead, write, and create access to all support tickets created by all users on a tenant (Subscripton Tickets in Auth0 Support Center). Access to aggregated metrics.

​
Availability varies by Auth0 plan

Your Auth0 plan or custom agreement affects the availability of this feature. To learn more, read Auth0’s Pricing Page. Limited-access roles restrict a tenant member’s Dashboard experience to only the sections and actions necessary for their job. The feature permissions associated with each role are outlined below. If a specific permission is not listed for a role, tenant members given that role will not have access to that area of the Auth0 Dashboard.

​
Log events available to user roles

Logs can contain sensitive data, such as secrets, PII, etc. It is important not to disclose sensitive data to users whose role does not require that information. However, the Editor - Users or Viewer - Users roles need to have some access to logs to identity user issues. For example, finding out if the user signed up correctly, if the user was blocked, etc. We allow the Editor - Users and Viewer - Users with access to a limited set of log types, that are connected to user events. The log events in the list provide the necessary information about user actions but do not disclose sensitive information about other parts of the tenant configuration. To learn more, read Log Event Type Codes. 
cls
cs
f
fce
fcoa
fcp
fcpn
fcpr
fcu
fdeac
fdeaz
fdecc
fdu
feacft
feccft
fede
fens
feoobft
feotpft
fepft
fepotpft
fercft
fi
flo
fn
fp
fs
fsa
fu
fui
fv
fvr
gd_auth_failed
gd_auth_rejected
gd_auth_succeed
gd_enrollment_complete
gd_otp_rate_limit_exceed
gd_recovery_failed
gd_recovery_rate_limit_exceed
gd_recovery_succeed
gd_send_email
gd_send_email_failure
gd_send_pn
gd_send_pn_failure
gd_send_sms
gd_send_sms_failure
gd_send_voice
gd_send_voice_failure
gd_start_auth
gd_start_enroll
gd_tenant_update
gd_unenroll
gd_update_device_account
limit_mu
limit_wc
mfar
pwd_leak
s
sce
scoa
scp
scpn
scpr
scu
sdu
seacft
sede
sens
seoobft
seotpft
sepft
sercft
si
slo
ss
ssa
sv
svr
ublkdu
w

​
Limitations

  • Users with Admin role can invite Editor - Specific Apps users to one application at a time. To work around this, the Admin user can edit their role to assign multiple applications after the user accepts the invitation.
  • The Viewer - Users and Editor - Users roles don’t have access to the Users’ Devices and Authorized Apps sections.
  • The New Activity Page is visible to Admins and Elevated Support Access users only. Editor - Users and Viewer - Users can access daily activity (such as logins or signups) through the Auth0 Management API.

​
Private Cloud requirements

The Editor - Users and the Viewer - Users roles require that User Search v3 and Logs Search v3 are enabled in your environment. If your environments don’t support these versions, these two roles are unavailable.

​
Learn more