Admin Roles

Overview

Your Material admins are responsible for maintaining your end-user experience and using Material to meet your organization's goals.

• All administrators can log in to the Admin Console, where they may perform different tasks based on their role.
• Team members working in Material each have one or more roles. Choose roles based on the tasks your team members needs to be able to complete.

We recommend you audit roles quarterly.

How to use this guide

First, learn how to assign roles to accounts or groups here.

Then, use the Admin Roles references to choose roles. Roles and their permissions are described in three ways:

Role Descriptions Describes each role and highlights key capabilities and use cases. Start here.

How to Assign Roles Steps to assign roles to account or groups

Permission Matrices These tables include every permission available in Material and indicate which role(s) have these permissions, broken down by detections, issues, settings, etc.

Admin Role FAQ Some commonly asked questions about role assignment and permissions

---

Material Accounts and Roles

In Material, the term "account" refers to any user identity that can exist in the system. Accounts are defined independently of their roles or tenant memberships. Specifically:

Admin Account

Any account that has been assigned an admin role (such as "Super Admin" or "Tenant Enroller") is considered an Admin Account. These roles grant elevated privileges and access to administrative functions in the Material application. Admin roles can be either Global or Tenant-scoped, and an account can have multiple roles.

Tenant Membership

Any account can be a member of one tenant, or none at all. Tenant membership is typically determined by synchronization from external systems like Google Workspace or Microsoft 365. These accounts represent users within those tenant organizations.

As a Material administrator (i.e., an account with an admin role), you log in to the Material application using your account, authenticated via Google or Microsoft SSO. That same account may also appear as a member of a tenant (due to email aliases or sync configurations), but tenant membership alone does not make an account an Admin Account. You must assign a role(s) to the account (or to a group it belongs to) to make it an admin account.

Tenant Roles vs. Global Roles

Tenant Role + Global Role = Global permissions

If an account has both a Global role and any Tenant role(s), tenant-level permissions are elevated to a global scope, effectively giving the user global access on that account.

Group roles supersede account roles. If an account is part of a group with a Global role, even if their account is only assigned tenant roles, the same logic applies and that account has global access for any permissions in the roles it is assigned.

Role Assignment Best Practices

Accounts can be assigned multiple roles. Group roles supersede account roles. (See warning above).

• If a user needs permissions on more than one tenant, assign a Global role.
• An account can only be assigned a tenant role for the tenant it belongs to. If it needs permissions on a different tenant, assign a Global role.

  • You cannot assign the same Tenant role to a user across multiple tenants.

Special Case: Super Admin

The Super Admin role has more permissions than Tenant Admins, including the ability to enroll new tenants and add users.

Tenant Admins do not have these capabilities.

See Role Descriptions and Use Cases and Admin Role Permissions Matrices for more detail.