Critical account management roles and permissions

Use Account Manager to assign account management and product roles to standard users and service users. Evaluate Account Manager access and product access separately.

User needs to	Recommended Account Manager role or permission		Security implication
Configure sign-in methods or other account-wide settings	User role	Account admin	User can affect access for the entire account. Restrict this permission to authorized administrators.
Configure sign-in methods or other account-wide settings	Permission	`Manage accounts`
Create, update, or delete users and manage their Account Manager and product role assignments	User role	User manager	User can create, change, or remove access across Account Manager and products.
	Permission	`Manage users`
Configure account settings and manage users and roles	User role	Account admin and User manager	User has extensive control over enterprise access.
Configure account settings and manage users and roles	Permission	`Manage accounts` and `Manage users`	User has extensive control over enterprise access.
Review platform account, user, role, authentication, and sign-in activity	User role	View only	This provides read-only access to account and user information. Review the complete role definition, including any baseline self-service credential capabilities, before assigning it.
	Permission	`View accounts` `View organizations` `View users` `View logs`
Perform only product work	User role	None	Unnecessary Account Manager permissions increase the impact of a compromised account.
Perform only product work	Permission	None

The Account admin role can configure sign-in methods because it includes the Manage accounts permission. It cannot create, manage, or update users or their roles because the role does not include the Manage users permission. For a master administrator who must perform both functions, also assign User manager or create a custom user role and include Manage account and Manage users permission.

Review every default role and its permissions before assigning it. If one role does not meet the business requirement, assign multiple roles or create a custom role containing the required permissions. When you assign multiple roles, the user receives their combined permissions. Review the resulting access before saving the change.

In this section: