Role Descriptions

Role Descriptions and Use Cases

Accounts can have multiple roles, however if they're assigned any Global roles then all their access will be Global and none restricted to just one tenant.

If accounts have a tenant role and no Global roles, they'll only have permissions on the tenant they're assigned to.

Learn more here.

There are 15 roles available, described in the tables below.

Global Roles

Global roles have permissions in all tenants.

Role	Description	Use Case
Super Admin	Full administrative control over the system Add tenants and designate other admins View the content of messages that are considered suspicious. Can't search for or view the full body of messages without also having the Content Admin role	Typically used by members of an IT or Security team.
Global Analyst	Incident response View suspicious message content	Typically used by members of an Incident Response or Security team These admins can investigate suspicious or potentially malicious emails.
eDiscovery Admin	Force unlock messages View and search message content Can't modify system settings	Typically used by members of a legal team as part of discovery to unlock mail
Global Analytics Admin	View high-level reports and metrics for any tenant enrolled Can't view fine-grained email data or configure system settings	Typically used by members of a Data Loss Prevention or Data Analysis team. These admins periodically review any Material reports and decide if further analysis is necessary.
Global Settings Admin	Set up and configure Material across all tenants	Typically used by members of IT to help with the initial configuration of Material. These admins can configure settings across all domains.
Global Phishing Simulation Admin	Ability to create, modify, and delete phishing simulations Access reports Manage simulation participation and settings	Global Phishing Simulation Admins can manage all phishing simulations, and create new simulations from scratch across tenants.
Global Issue Responder	Review issue details and apply remediations	Issue responders have read-only access to the detections and settings that generated the issue and cannot perform message or file searches.

Tenant Roles

Tenant roles have permissions in the tenant their account is linked to, but can only be assigned to one tenant. If the user needs these permissions in multiple tenants, assign a Global role.

Role	Description	Use Case
Tenant Admin	Full administrative control View suspicious message content via Message Search, however no access to Email Threat issues. See Content Admin. Report view access Configure tenant settings	This is meant for the person who's responsible for Material's usage within a specific tenant. They have broad privileges so it's typically someone who's organizational role matches that breadth.
Content Admin	View, search, and administer message and file content for the tenants their account is linked to. Can't configure system settings.	This role is used by the few people with a need to examine all content and perform searches. Frequently used by legal, HR, insider threat analysts, or other similar roles.
Drive Content Admin	View, search, and administer file content Can't configure system settings	Typically granted temporarily, but must be revoked by super admins. Frequently used by an organization's legal team.
Email Content Admin	View, search, and administer message Can't configure system settings	Typically granted temporarily and most frequently used by an organization's legal team
Phishing Simulation Admin	Create simulations from scratch Modify all simulations	Phishing Simulation Admins can manage all phishing simulations, and create new simulations from scratch. Note: This role is intended for dedicated instances. For most instances, assign the Global Phishing Simulation Admin role as phishing simulations can span across tenants.
Tenant Enroller	Add new tenants to be protected by Material Can't administer or view other tenants	Typically used by an Microsoft 365 Global Administrator or Google Workspace Super Admin account. These admins have the ability to authorize Material's connection to the email tenant.
Analytics Admin	View high-level reports and metrics for the tenants their account is linked to. Can't view fine-grained email data or configure system settings.	Typically used by members of a Data Loss Prevention or Data Analysis team. These admins periodically review Material reports on the tenants their account is linked to and decide if further analysis is necessary.
Settings Admin	Set up and configure Material for the tenants their account is linked to	Typically used by members of IT to help with the initial configuration of Material. These admins can only configure settings of domains their account is enrolled in.
Issue Responder	Review issue details and apply remediations	Issue responders have read-only access to the detections and settings that generated the issue and cannot perform message or file searches.