# Roles

HPE Morpheus Enterprise supports the following role types, each serving a distinct purpose in administering permissions across the multi-tenancy hierarchy:

## Tenant roles

Tenant roles define the maximum permission levels available to users within a tenant. User role permissions cannot exceed the permissions set by the tenant role.

- A tenant role sets the maximum permissions for a tenant.
- User roles within a tenant cannot exceed the permissions of the assigned tenant role.
- A tenant role can be assigned to one or more tenants.
- Tenant roles determine cloud access for the subtenant. All clouds in the parent tenant with visibility set to **Public** appear as options on the tenant role **Cloud Access** tab.
- Only parent tenant clouds granted access in the tenant role are accessible within the subtenant.

> **Important:** Tenant roles cap permissions on all subtenant user roles. User roles can be created within the subtenant with lesser permissions than the tenant role allows. Tenant roles are designed for a parent tenant administrator to set maximum permissions for the subtenant. A subtenant administrator can then configure user roles within those boundaries.

## User roles

User roles determine feature, group, and instance type access for users. In a multi-tenant environment, user roles are classified as either single-tenant or multi-tenant.

- **Single-tenant user roles** – Exist solely within the tenant in which they are created and cannot be shared across tenants.
- **Multi-tenant user roles** – Created by a parent tenant administrator and automatically seeded into child tenants. These roles can be assigned to users within each child tenant. Any changes made to a multi-tenant user role in the parent tenant are propagated to all child tenants. However, if a multi-tenant user role is edited within a child tenant, it is no longer linked to the parent definition and becomes a unique single-tenant role. It no longer receives propagated changes from the parent tenant.

> **Note:** Multi-tenant user roles simplify subtenant user role creation by eliminating the need for parent tenant administrators to re-create the same base roles for every subtenant. A multi-tenant user role is not a single shared role across tenants. It functions as a template that generates individual subtenant user roles, which can then be independently managed within each subtenant.

## Tenant Roles

Tenant roles define the maximum permission levels available to users within a tenant, governing how permissions flow from the primary tenant through parent tenants to subtenants, including the following:

- A tenant role sets the maximum permissions for a tenant.
- User roles within a tenant cannot exceed the permissions of the assigned tenant role.
- A tenant role can be assigned to one or more tenants.
- Tenant roles determine cloud access for the subtenant. All clouds in the parent tenant with visibility set to **Public** appear as options on the tenant role **Cloud Access** tab.
- Only parent tenant clouds granted access in the tenant role are accessible within the subtenant.

IMPORTANT

Tenant roles cap permissions on all subtenant user roles and user roles can be created within the subtenant with lesser permissions than the tenant role allows. Tenant roles are designed for a parent tenant administrator to set maximum permissions for the subtenant. A subtenant administrator can then configure user roles within those boundaries.

## User Roles

User roles determine feature, group, and instance type access for users. In a multi-tenant environment, user roles are classified as either single-tenant or multi-tenant.

- **Single-tenant user roles** – Exist solely within the tenant in which they are created and cannot be shared across tenants.
- **Multi-tenant user roles** – Created by a parent tenant administrator and automatically seeded into child tenants. These roles can be assigned to users within each child tenant and any changes made to a multi-tenant user role in the parent tenant are propagated to all the child tenants. However, if a multi-tenant user role is edited within a child tenant, it is no longer linked to the parent definition and becomes a unique single-tenant role. Additionally, it no longer receives propagated changes from the parent tenant.

NOTE

Multi-tenant user roles simplify subtenant user role creation by eliminating the need for parent tenant administrators to re-create the same base roles for every subtenant. A multi-tenant user role is not a single shared role across tenants. It functions as a template that generates individual subtenant user roles, which can then be independently managed within each subtenant.
