# Roles

There are two Role types in HPE Morpheus Enterprise, Tenant Roles and User Roles. Understanding these Role types is key to effectively administering Role permissions in HPE Morpheus Enterprise. These two Role types are discussed in greater detail in this section.

## Tenant Roles

Tenant Roles set the maximum permission levels for Users in the Tenant. User Role permissions will not exceed the permissions of the Tenant Role.

- Tenant Roles set the maximum permissions for a Tenant
- User Roles in a Tenant cannot exceed the permissions of the Tenant Role
- A Tenant Role can be assigned to one or multiple Tenants
- Tenant Roles determine Cloud access for the child Tenant such that all Clouds in the parent Tenant which have visibility set to Public will show as options in the Tenant Role Cloud Access tab
- Only parent Tenant Clouds given access in the Tenant Role will be accessible in the Subtenant

IMPORTANT

Tenant Roles cap permissions on all Subtenant User Roles. User Roles can be created in the Subtenant with lesser permissions than the Tenant Role allows. Tenant Roles are designed for a parent Tenant Admin to set max permissions for the Subtenant, and a child Tenant Admin to configure User Roles inside the Tenant.

## User Roles

User Roles determine feature, Group, and Instance Type access for all Users. In a multi-Tenant environment, there are two types of User Roles: Single-Tenant User Roles and Multi-Tenant User Roles.

- **Single-Tenant User Roles:** These exist solely in the Tenant they are created in
- **Multi-Tenant User Roles:** Parent Tenants can create Multi-Tenant User Roles. These Roles are automatically seeded into child Tenants and can be assigned to Users within that Tenant. Changes to Multi-Tenant User Roles made in the parent Tenant are propagated to all children. However, once a Multi-Tenant User Role is edited inside the child Tenant, it is no longer linked to the Multi-Tenant User Role and becomes its own unique single-Tenant Role. It will no longer receive propagated changes.

NOTE

Multi-Tenant User Roles are intended to make Subtenant User Role creation easier, so parent Tenant administrators do not have to re-create the same base Subtenant Users Roles for every Subtenant. Multi-Tenant User Roles are not a single Role across Tenants, but more like a template that creates new Subtenant User Roles that can then be managed in the Sub Tenant.
