> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/administration/admin-roles.md). # Admin Roles ## Overview Your Material admins are responsible for maintaining your end-user experience and using Material to meet your organization's goals. * All administrators can log in to the Admin Console, where they may perform different tasks based on their role. * Team members working in Material each have one or more roles. Choose roles based on the tasks your team members needs to be able to complete. {% hint style="success" %} We recommend you audit roles quarterly. {% endhint %} ### How to use this guide First, [learn how to assign roles to accounts or groups here](/administration/admin-roles/how-to-assign-roles.md). Then, use the Admin Roles references to choose roles. Roles and their permissions are described in three ways:


Role Descriptions Describes each role and highlights key capabilities and use cases. Start here.	Role Descriptions
How to Assign Roles Steps to assign roles to account or groups	How to Assign Roles
Permission Matrices These tables include every permission available in Material and indicate which role(s) have these permissions, broken down by detections, issues, settings, etc.	Permissions Matrices
Admin Role FAQ Some commonly asked questions about role assignment and permissions	Admin Role FAQ

*** ## Material Accounts and Roles In Material, the term "**account**" refers to any user identity that can exist in the system. Accounts are defined independently of their roles or tenant memberships. Specifically:

Admin Account

Any account that has been assigned an *admin role* (such as "Super Admin" or "Tenant Enroller") is considered an Admin Account. These roles grant elevated privileges and access to administrative functions in the Material application. Admin roles can be either Global or Tenant-scoped, and an account can have multiple roles.

Tenant Membership

Any account can be a member of one tenant, or none at all. Tenant membership is typically determined by synchronization from external systems like Google Workspace or Microsoft 365. These accounts represent users within those tenant organizations.

As a Material administrator (i.e., an account with an admin role), you log in to the Material application using your account, authenticated via Google or Microsoft SSO. That same account may also appear as a member of a tenant (due to email aliases or sync configurations), but **tenant membership alone does not make an account an Admin Account**. You [must assign a role(s) to the account](/administration/admin-roles/how-to-assign-roles.md) (or to a group it belongs to) to make it an admin account. ### Tenant Roles vs. Global Roles {% hint style="warning" %} **Tenant Role + Global Role = Global permissions** If an account has *both* a Global role and any Tenant role(s), tenant-level permissions are elevated to a global scope, effectively giving the user global access on that account. Group roles supersede account roles. If an account is part of a group with a Global role, even if their account is only assigned tenant roles, the same logic applies and that account has global access for any permissions in the roles it is assigned. {% endhint %} ### Role Assignment Best Practices Accounts can be assigned multiple roles. Group roles supersede account roles. (See warning above). * If a user needs permissions on **more than one tenant**, assign a **Global** role. * An account can **only** be assigned a **tenant role for the tenant it belongs to**. If it needs permissions on a different tenant, assign a **Global** role. * You **cannot** assign the same Tenant role to a user across multiple tenants. **Special Case: Super Admin** The **Super Admin** role has more permissions than Tenant Admins, including the ability to enroll new tenants and add users. Tenant Admins do **not** have these capabilities. See [Role Descriptions and Use Cases](/administration/admin-roles/role-descriptions.md) and [Admin Role Permissions Matrices](/administration/admin-roles/permissions-matrices.md) for more detail. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.material.security/administration/admin-roles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.