# Role Creation

Roles are created within Administration > Roles. Creating a Role requires minimal information, just a Name for the Role in VM Essentials. You can optionally add a Description and a Landing URL as well. The landing URL determines the starting page for the User on initial login (such as the Instances list page or perhaps the detail page for a primary HVM cluster). Following creation, click into the Role from the Roles list page and you will see the granular controls available to Roles. These controls include access permissions for UI feature sections, Groups, Cluster types, and configured Tasks. Changes are automatically saved for the Role, there is no need to click a button to save any updates. See the next section for a detailed breakdown of individual feature permissions.

Master tenant users are able to create a special type of user role called a multi-tenant user role. A multi-tenant user role is copied / duplicated down to all subtenants within VM Essentials. These can be viewed as canned role templates available to new tenants when their account is first created. Any changes made to the main role are propagated down to the subtenants version of the shared role so long as the subtenant users have not previously adjusted/changed that role. The moment a subtenant makes adjustments to the shared role within their account, it is unlinked from the parent role and treated entirely independently. In order to relink the Role in the Subtenant, a Master Tenant user would have to edit the Role, uncheck MULTITENANT USER ROLE, save the Role, check MULTITENANT USER ROLE once again, then save the Role once again.

Another note about user roles is that when a user role is copied down to a subtenant, the permission scopes cannot supersede the tenant’s assigned tenant role. If they do they are automatically downgraded when propagated to the specific tenant. Any changes made to the tenant role will automatically ensure roles within the tenant are downgraded appropriately.

Master Tenant administrators may edit permissions for Roles in other Tenants by viewing the Tenant detail page (Administration > Tenants > Selected Tenant) and accessing the Roles tab. From there, select the Role to edit and make changes on the resulting Role detail page.
