Platform roles
Member, Tenant Admin and Billing contact, the Roles & permissions page, and the labels used for the admin role.
Who can do thisTenant Admin
Platform roles decide who may administer the workspace itself: users, groups, subscriptions, security and settings. They are separate from the roles inside each app. A platform role never opens an application on its own; for that a person needs a seat and an app role (see Giving app access: a seat and a role).
The three platform roles
| Role | What it allows |
|---|---|
| Member | The default for everyone you invite. Uses the Launch Pad and the apps they have access to, edits their own profile, asks for access to apps. |
| Tenant Admin | Everything in workspace administration: users and access, roles, groups, subscriptions and access requests, billing, authentication, identity sources, mail, settings, activity log, API keys and data residency. Also the role that may change connections in the Integration Hub. |
| Billing contact | Reads and edits the Billing page and the billing details. It cannot be given on a person's page today, only through a group (see below). |
For a page-by-page list, see Roles and access matrix.
Labels for the admin role
The Tenant Admin role is shown under different names on different screens. They are all the same role:
| Where | English portal | Danish portal |
|---|---|---|
| Roles & permissions table | Administrator | Administrator (English only) |
| Top bar and profile chip | Tenant Administrator | Tenant Administrator (English only) |
| Users & access list | Tenant Admin | Tenant-administrator |
| Platform role on a person's page | Tenant Admin | Arbejdsområde-administrator |
| Linked access on a group | Tenant Admin | Arbejdsområdeadministrator |
In this knowledge base we call it Tenant Admin. In the Integration Hub the same role is called Workspace Administrator.
Change a person's platform role
- Open Users & accessIda KjærAccess.
- In Platform role, choose Member or Tenant Admin.
- Click Save access.
The third option, Billing contact (coming soon), is greyed out on this page. To make someone a billing contact, create a group, set its Platform role under Linked access to Billing contact and add the person. See Groups. Groups can also link Tenant Admin; the portal then asks you to confirm with Link Admin, because every current and future member of that group becomes an administrator.
A role change can take up to about 5 minutes to reach the apps and the Integration Hub.
The Roles & permissions page
Open Roles & permissions in the left rail. The page lists the three platform roles with how many people hold each.
The column headers are Role, Scope, People and Can. The rows come from the server and are in English only:
| Role | Scope | Can |
|---|---|---|
| Administrator | Full account | Manage users, licenses, roles, settings, billing & subscriptions |
| Member | Standard | Access assigned apps; view own profile & licenses |
| Billing contact | Billing | View & edit billing details and invoices |
- The page is read-only. Create role is disabled and marked Coming soon: you cannot make your own platform roles yet.
- You give app roles in the portal, on each person's Access tab or through a group.
The last Tenant Admin is protected
A workspace must always have at least one Tenant Admin. The portal refuses anything that would leave it with none, and shows the reason in English:
- Demoting the last admin: "Cannot demote the last admin", with "Promote another member to Tenant Admin first."
- Deactivating the last admin: "Cannot deactivate the last admin".
- Removing the last admin: "Cannot remove the last admin".
- The last admin leaving the workspace: "Cannot leave as the last admin", with "Promote another member to Tenant Admin before leaving."
Keep at least two Tenant Admins. The Security posture check Admin coverage on the Overview warns you when there is only one ("Only one admin - add another to avoid lockout if they leave."). See Workspace administration at a glance.