Permissions Matrices

Permissions in the matrices below are grouped into what product areas or functions they relate to. If a role type is not included in the table, it has no permissions related to that area.

🖱️View in full screen, or scroll right within the table to view all roles.

Global role permissions apply to all tenants. Tenant role permissions apply only to the tenant the user is assigned the role in. Users can't have more than one tenant role. If a user needs permissions on more than one tenant, assign a Global role.

Tenant roles are indicated with * . For example, Tenant Admin*

Learn more here.

Detections

All Roles can view detections

	Super Admin	Tenant Admin*	Global Analyst	Analyst*
Update Material detections Enable/disable Change severity Configure response Reset circuit breaker	✔️	✔️	✔️	✔️
Create, update, and archive custom detections	✔️	✔️	✔️	✔️

---

Issues

	Super Admin	Tenant Admin*	Global Analyst	Analyst*	Global Phishing Simulation Admin	Phishing Simulation Admin*	Global Settings Admin	Settings Admin*	Global Issue Responder	Issue Responder*
View all issues and evidence	✔️	✔️	✔️	✔️	✔️	✔️			✔️	✔️
Update issues: update status assign to a user manually respond	✔️	✔️	✔️	✔️					✔️	✔️
Share issue feedback	✔️	✔️	✔️	✔️					✔️	✔️
View message content (associated with an issue only)			✔️	✔️					✔️	✔️
Delete messages (associated with an issue only)			✔️	✔️					✔️	✔️
View file content (associated with an issue only)	✔️	✔️	✔️	✔️					✔️	✔️
Manually respond to an issue									✔️	✔️

Entity Specific Permissions

These permissions related to specific entity types within issues.

Messages

	Super Admin	Tenant Admin*	Content Admin*	Email Content Admin*	Global Analyst	Analyst*	eDiscovery Admin	Global Issue Responder	Issue Responder*
Search and view all messages, (including metadata and content)			✔️	✔️			✔️
Search and view all messages, (metadata only)	✔️	✔️			✔️	✔️
View all message content			✔️	✔️			✔️
View message content (associated with an issue only)	✔️	✔️			✔️	✔️		✔️	✔️
Delete any messages	✔️	✔️	✔️	✔️
Delete messages (associated with an issue only)					✔️	✔️		✔️	✔️
Create an Email Threat issue from a message manually	✔️	✔️	✔️	✔️	✔️	✔️
Force Unlock Messages	✔️	✔️					✔️
Share message content with Material	✔️	✔️			✔️	✔️		✔️	✔️
Mark messages as sensitive	✔️	✔️	✔️	✔️	✔️	✔️
View message header explanations	✔️	✔️	✔️	✔️	✔️	✔️	✔️

Sensitive Categories

All roles can view sensitive categories.

	Super Admin	Tenant Admin*	Content Admin*	Email Content Admin*	Global Analyst	Analyst*	Global Settings Admin	Settings Admin*
Create, edit, and archive Sensitive categories	✔️	✔️	✔️	✔️	✔️	✔️
Update default response	✔️	✔️			✔️	✔️	✔️	✔️

Files

	Super Admin	Tenant Admin*	Content Admin*	Drive Content Admin*	Global Analyst	Analyst*	eDiscovery Admin	Global Issue Responder	Issue Responder*
Export .csv in the Explorer for files	✔️	✔️	✔️	✔️	✔️	✔️	✔️
Search files (metadata and content)			✔️	✔️			✔️
Search files (metadata only)	✔️	✔️	​	​			​
Manually respond to an issue related to a file	✔️	✔️	​✔️	​✔️			✔️
View file metadata	✔️	✔️	✔️	✔️	✔️	✔️	✔️
View all file content			✔️	✔️			✔️	✔️	✔️
Update file sharing permissions	✔️	✔️	✔️	✔️	✔️	✔️		✔️	✔️
Update file labels	✔️	✔️			✔️	✔️

---

Stats and Reports

All roles except Tenant Enroller, Global Settings Admin, and Settings Admin can:

• Views stats on the counts of issues throughout the app
• View issue reports
• View message reports

All roles except Tenant Enroller, Global Issue Responder, and Issue Responder can:

• View the Usage page in Settings

---

Settings

All roles can:

• View account settings for the account they're logged in with
• View Email Threat settings
• View Google Drive Security settings
• View Account Takeover Resilience (ATO) settings
• View organizational profile settings
• View end-user support settings
• View admin console settings (excluding SSO SAML)
• View SAML SSO (all except Tenant Enroller can view)
• View outbound IP settings
• View Outlook add-in settings
• View Mailbox Mirroring settings
• View end-user verification settings (all except Tenant Enroller can view)

	Super Admin	Tenant Admin*	Global Analyst	Analyst*	Global Settings Admin	Settings Admin*
Update account settings	✔️	✔️			✔️	✔️
Update Email Threat settings	✔️	✔️	✔️	✔️	✔️	✔️
Update Google Drive Security settings	✔️	✔️			✔️	✔️
Update ATOR settings	✔️	✔️			✔️	✔️
Update Organizational Profile settings (excluding VIP Designation)	✔️	✔️			✔️	✔️
Update end-user support settings	✔️	✔️			✔️	✔️
View, add, and update Trusted Entities	✔️	✔️	✔️	✔️	✔️	✔️
Update admin console settings, including SAML SSO	✔️	✔️			✔️	✔️
Update end user verification settings (excluding challenge bypass)	✔️	✔️			✔️	✔️
Create/update/delete a challenge bypass	✔️	✔️
Update Outlook add-in settings	✔️	✔️			✔️	✔️
Update tenant, group, or account licenses	✔️	✔️
Update Global license setting	✔️	✔️	✔️	✔️	✔️	✔️

---

Accounts and Groups

All roles can:

• View account and group details
• Re-sync group members
• View tenants
• View detected apps
• Export a .csv in the Explorer for accounts and groups.

	Super Admin	Tenant Admin*	Global Analyst	Analyst*	Global Settings Admin	Settings Admin*
Enroll new tenants	✔️
Update account settings	✔️	✔️			✔️	✔️
Assign and revoke all role types for other users	✔️
Assign and revoke all roles to accounts excluding super admin and tenant enroller		✔️
Revoke session for account	✔️	✔️	✔️	✔️
Update group settings	✔️	✔️			✔️	✔️
Assign and revoke all role types for groups	✔️
Assign/revoke roles to groups excluding super admin and tenant enroller		✔️
Update Material delegates	✔️	✔️			✔️	✔️

---

Tenants

All roles can:

• View tenants
• Export a .csv in the Explorer for tenants.

	Super Admin	Tenant Enroller*
Enroll new tenants	✔️	✔️

---

Phishing Simulations

	Super Admin	Tenant Admin*	Global Phishing Simulation Admin	Phishing Simulation Admin*
View Phishing simulations in a dedicated or shared instance	✔️	✔️	✔️
Create and update simulations in a dedicated or shared instance	✔️	✔️	✔️
View Phishing simulations in a shared instance, assign to one tenant	✔️	✔️		✔️
Create and update simulations in a shared instance, assign to one tenant	✔️	✔️		✔️

---

OAuth Security

All roles can:

• View connected OAuth apps

	Super Admin	Tenant Admin*	Global Analyst	Analyst*	Global Phishing Simulation Admin	Phishing Simulation Admin*	Global Settings Admin	Settings Admin*
View OAuth issues	✔️	✔️	✔️	✔️	✔️	✔️
Classify apps and add responses	✔️	✔️	✔️	✔️
Configure OAuth settings (auto-remediation, responses)	✔️	✔️	✔️	✔️			✔️	✔️
Configure OAuth notifications	✔️	✔️	✔️	✔️

---

Audit Log

All roles can:

• View audit logs for the account they are logged in with

	Super Admin	Tenant Admin*	Content Admin*	Email Content Admin*	Global Analyst	Analyst*	eDiscovery Admin	Global Issue Responder	Issue Responder
View audit log entries	✔️	✔️					✔️
View message access log	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️
View force unlock requests	✔️	✔️					✔️

Integrations

	Super Admin	Tenant Admin*	Content Admin*	Global Analyst	Analyst*	Global Analytics Admin	Analytics Admin*	Global Settings Admin	Settings Admin*
View integrations	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️	✔️
Create and modify integrations	✔️	✔️						✔️	✔️

---

Event Subscriptions

All roles can:

• View event subscriptions

	Super Admin	Tenant Admin*
Create and modify event subscriptions	✔️	✔️

---

APIs and MCP

All roles can:

• View API tokens
• Create and modify API tokens for the account they are logged in with

	Super Admin	Tenant Admin*	Global Settings Admin	Settings Admin
Create and modify all API tokens	✔️	✔️
Modify settings to allow API token creation	✔️	✔️	✔️	✔️
Enable the Material MCP server	✔️	✔️	✔️	✔️

* : Tenant role