# User Roles

User Roles can be single or multitenant. A Multitenant User Role is automatically copied into all existing subtenants as well as placed into a subtenant when created. Useful for providing a set of predefined roles a Customer can use. The Multitenant Locked option prevent subtenant from modifying FEATURE ACCESS settings in the Role. Note Group, Instance Type and Blueprint Access settings will still be editable as Groups are unique per Tenant, and Instance and Blueprints can be a mix of unique and shared items.

IMPORTANT

Multitenant Roles still need to be configured/managed be each subtenant, as Groups are unique per Tenant, and Instance and Blueprints can be a mix of unique and shared items.

NOTE

User Roles cannot exceed Tenant Role permissions. If a Multitenant User Role has higher permissions than the Tenant Role assigned to a subtenant, the Multitenant User Role permissions in that Tenant will automatically be reduced to match the Tenant Role permissions.

**Subtopics**  

- **[Create a Single Tenant User Role](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-4CFE73A0-DB2A-4CA2-8E06-EC8FBAC78C47.html)**
- **[Create a MultiTenant User Role](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-1B184F05-C570-446E-8C3A-FC24792DE213.html)**
