Roles and access matrix
Which portal pages and actions a Member, a Tenant Admin and a Billing contact can use.
This table shows which portal pages and actions each platform role can use. The server checks every action, so the table is the real rule, not just what the menus show. App access (what a person can do inside Helpdesk, Asset Management and so on) is separate and comes from a seat and an app role; see Giving app access: a seat and a role.
How to read it
- Member is everyone's default role.
- Tenant Admin administers the workspace. See Platform roles for the role's other names.
- Billing contact has everything a member has, plus the Billing page. It is given through a group, not on the person's page.
Everyday pages
| Page or action | Member | Tenant Admin | Billing contact |
|---|---|---|---|
| Launch Pad: open the apps you hold a seat in, and included apps | Yes | Yes | Yes |
| Request access to an app (Request access) | Yes | Uses Get a seat instead | Yes |
| Tile Workspace administration and the Admin button | No | Yes | No |
| My profile: own name and phone (when not managed elsewhere) | Yes | Yes | Yes |
| Language, date and time, notification cards | Yes | Yes | Yes |
| Account & security: password, two-factor, sessions | Yes | Yes | Yes |
| Download own data | Yes | Yes | Yes |
| Leave the workspace | Yes | Yes, unless the last admin | Yes |
| Leave a group (when the group allows it) | Yes | Yes | Yes |
| Report a problem | Yes | Yes | Yes |
Workspace administration
| Page or action | Member | Tenant Admin | Billing contact |
|---|---|---|---|
| Overview: figures, Needs attention, Recent activity, Security posture | No | Yes | No |
| Overview: Workspace and Your access cards | Yes | Yes | Yes |
| Bell with Needs attention count | No | Yes | No |
| Users & access: list, invite, resend invite, reset password | No | Yes | No |
| Give app access (seats and roles), change platform role | No | Yes | No |
| Deactivate, reactivate, remove, export a user's data | No | Yes | No |
| Roles & permissions | No | Yes | No |
| Groups: create, members, linked access, archive | No | Yes | No |
| Subscriptions: add, cancel, approve or deny access requests | No | Yes | No |
| Billing: read and edit billing details | No | Yes | Yes |
| Authentication and single sign-on | No | Yes | No |
| Identity sources: directory sync, identity governance, write-back | No | Yes | No |
| API keys | No | Yes | No |
| Data residency | No | Yes | No |
| Mail: read the settings | Yes | Yes | Yes |
| Mail: change the settings | No | Yes | No |
| Settings: read branding | Yes | Yes | Yes |
| Settings: change branding, remove demo data | No | Yes | No |
| Customization | No | Yes | No |
| Activity log and CSV export | No | Yes | No |
| Integration Hub: add, change, run or delete connections | No | Yes | No |
What a non-admin sees on an admin page
Members have no Admin button and no bell. If they open an administration address directly, the left rail still appears, but the server refuses the data, shown as an English message such as "403 - …". A few pages explain it in plain words instead:
- Customization: Admins only, "Customization is configured by workspace administrators."
- Mail: "Mail settings are managed by an admin."
- Settings: "Branding is managed by an admin."
A billing contact is not an administrator, so they get no Admin button either. They open the Billing page directly by its address in the portal (ending in /billing).
In the Integration Hub, members get a read-only view. See What members see in the Hub.