Roles and Permissions

Overview

Access Control in Syncari restricts each user to the information, features, and functions their role requires. You configure roles that contain specific permissions, and then assign users to those roles. This supports the principle of least privilege, which limits each user's access to only the functions required for their work.

Roles and permissions are instance-specific. If your organization has multiple Syncari instances, such as sandbox, testing, and production, you configure and assign roles separately in each instance.

You can assign users to default roles defined for common user types in Syncari, such as Sync Manager, Instance Admin, or Dashboard Author. You can also create custom roles to meet the needs of your organization.

Default roles

Syncari provides six default roles for common user types. A lock icon next to the role name on the Role Based page identifies a default role.

Custom Roles

Custom roles provide more granular access than the default roles. A custom role can include any combination of permissions. When you plan custom roles, consider how each group of users works with Syncari. For example:

• Business intelligence users: Create a role with view access to Insights dashboards only.
• Data science team: Create a role that can access Data Studio only, so the team can review unified data without changing configuration.
• Production safeguards: Create a role that prevents users from adding synapses in your production instance, while a separate role in your test instance allows it.

Viewing Roles and Permissions

The Role Based page in Access Control section lists all the roles in the current instance. The Role Based page lists each role with its name, the number of permissions it includes, the number of users assigned to it, and its status (Active or Inactive). A lock icon next to the name identifies a default role.To open this page, you need the Can read roles permission at a minimum.

To view roles and permissions:

1. In the left navigation pane, click Settings.

2. Expand Access Control, and then select Role Based.

3. To see the permissions in a role, click the kebab menu (⋮) in the role's row, and then select View Details.

Creating a custom role

You can create custom roles if you need to provide more granular permissions than those available in the default roles. Custom roles can include as many specific permissions as necessary to provide the access you want.

Syncari permission names either include the CRUD operation for the permission (create, read, update, or delete) or the action you can perform in Syncari. Synonyms for the various CRUD operations:

• Create - Can create, Can add, and Can write.
• Read - Can read, Can list, and Can view.
• Update - Can update, Can edit, and Can write.
• Delete - Can delete and Can remove.

Syncari assigns Can read profile and Can write profile automatically because they’re required.

To create a role, you need the Can read role, Can add role, and Can add privileges to role permissions at a minimum. To assign users during creation, you also need the Can add role to user permission.

To create a custom role:

1. Go to Settings > Access Control > Role Based.

2. Click New Role.

3. On the Basic info step, complete the following fields:

• Role name (required): Enter a name for the role.
• Role description: Describe the purpose of the role so other administrators understand when to use it.
• Tags: Add tags to help organize and find roles.
• Status: Select Active or Inactive. The default is Active. You can assign only active roles to users.

4. Click Next.

5. On the Role configuration step, click the Permissions list, and then select each permission to include. Use the search box to find a permission by name. The counter above the list shows how many permissions you have selected.

6. Click the Users list, and then select the users to assign to the role. Use the search box to find a user by name. You can also assign users later.

7. Click Next.

8. On the Review and confirm step, review the role configuration, and then click Done.

Editing a custom role

You can change a custom role's basic information, permissions, and assigned users. To edit a role’s information or permissions, you need the Can read role, Can edit role, Can add privileges to role, and Can remove privileges from role permissions. To change the users assigned to the role, you also need the Can add role to user and Can remove role from user permissions.

To edit a custom role:

1. Go to Settings > Access Control > Role Based.

2. Click the kebab menu (⋮) in the role's row, and then select Edit role.

3. On the Basic info step, make any changes, and then click Next.

4. On the Role configuration step, add or remove permissions or users, and then click Next.

5. On the Review and confirm step, review your changes, and then click Done.

Deleting a custom role

To delete a custom role, you need the Can read role and Can delete role permissions. You cannot delete default roles.

To delete a custom role:

1. Go to Settings > Access Control > Role Based.

2. Click the kebab menu (⋮) in the role's row, and then select Delete role.

3. When prompted, type DELETE in all capital letters.

4. Click Delete.

Activating and deactivating roles

The Status column shows whether a role is Active or Inactive. You can assign only active roles to users. You cannot deactivate default roles.

To activate or deactivate a role:

1. Go to Settings > Access Control > Role Based.

2. Click the kebab menu (⋮) in the role's row, and then select Activate role or Deactivate role.

3. Review the list of affected users, and then click Activate or Deactivate.

Permission Details 

See the detailed permissions for each role in this sheet.