# Overview

Within HPE Morpheus Enterprise is a wide array of role based access control capabilities. These roles can be managed within the Admin > Roles section of the HPE Morpheus Enterprise UI as well as through the API or CLI. They are designed to be robust enough to fit within a wide array of enterprise and managed service provider scenarios so they can be a bit hard to grasp at first, but should make sense once a few simple concepts are explained. There are two types of roles within HPE Morpheus Enterprise called Tenant and User based roles. Both sets of roles allow restrictions to be imposed on a user at the feature access level. Entire sections within the appliance UI can be hidden based on the specified access levels for features within HPE Morpheus Enterprise. Features have different access scopes that can be selected from and can range depending on the specific feature. The most common scope set involves none, read, and full. Instance Type access is also common among both role types which allow the administrator to restrict which service catalog items they are allowed to provision within HPE Morpheus Enterprise .

There are several handy tricks for creating new roles within HPE Morpheus Enterprise and users can be assigned more than one role. When a user is assigned more than one role, permissions are granted by the role with the highest level of scope access. This allows roles to be built with small subsets of features and combined to grant different individuals relevant permission control. With resource permissions (that is, all types of permissions other than Feature permissions), a default access can be given as opposed to a specific (Full or None) permission for any resource. A specific permission will always supersede a default permission regardless of whether it’s more permissive or more restrictive. In other cases (default vs default OR specific vs specific) the more permissive access will be given.

It’s also important to note that built-in Roles, such as the System Admin “Superuser” Role carry no special prominence. For resource permissions, the System Admin user has defaults set to Full in each section. Thus, pairing the System Admin Role with another Role that may include specific line item permissions for various resource categories may cause your System Admin users to take on a reduced permission set.

NOTE

Feature access control not only applies to the HPE Morpheus Enterprise UI but also applies to the public developer API. It is sometimes necessary to logout and back in for changes to a users feature access level to be respected.
