Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions content/en/account_management/rbac/permissions.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,18 +48,20 @@ Preview mode gives your organization's administrators the ability to opt into ce

By default, existing users are associated with one of the three managed roles:

- Datadog Admin
- Datadog Standard
- Datadog Read Only
- Datadog Admin Role
- Datadog Standard Role
- Datadog Read Only Role

All users with one of these roles can read all data types, except for [individually read-restricted][1] resources. Admin and Standard users have write permissions on assets. Admin users have additional read and write permissions for sensitive assets relating to user management, org management, billing, and usage.
All users with one of these roles can read data, except for [individually read-restricted][1] resources. Admin and Standard users have write permissions on assets. Admin users have additional read and write permissions for sensitive assets relating to user management, org management, billing, and usage.
Copy link
Member Author

@srosenthal-dd srosenthal-dd Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All users with one of these roles can read all data types

This seemed misleading to me. Read Only Role cannot read Audit Trail, for example. Read Only role grants only read access but does not grant ALL read data accesses.


Managed roles are created and maintained by Datadog. Their permissions may be automatically updated by Datadog as new features are added or permissions change. Users cannot modify managed roles directly, but they can clone them to create [custom roles](#custom-roles) with specific permissions. If necessary, users can delete managed roles from their account.

### Custom roles

Create a custom role to combine permissions into new roles. A custom role gives you the ability to define a persona, for example, a billing administrator, and then assign the appropriate permissions for that role. After creating a role, assign or remove permissions to this role directly by [updating the role in Datadog][2], or through the [Datadog Permission API][3].

Unlike Managed Roles, custom roles do not receive new permissions when Datadog releases new products and features. Custom roles only receive new permissions to maintain compatibility when Datadog releases a new permission gating existing functionality.

**Note**: When adding a new custom role to a user, make sure to remove the managed Datadog role associated with that user to enforce the new role permissions.

## Permissions list
Expand All @@ -79,4 +81,4 @@ Each managed role inherits all of the permissions from the less powerful roles.

[1]: /account_management/rbac/granular_access
[2]: /account_management/users/#edit-a-user-s-roles
[3]: /api/latest/roles/#list-permissions
[3]: /api/latest/roles/#list-permissions
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't mean to change this line. Might be the change of a newline at the end of the file?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, a change in the newline at the end of the file is the most likely reason GitHub highlights this line, since the text is the same.

Loading