Administrative roles · BreezeAuth Docs

An administrative role defines what a user can do in the BreezeAuth admin console: manage users, configure applications, read the audit logs and so on. Each user has at most one role.

Most people in your organization need no role at all. Without a role, a person can still sign in to BreezeAuth and open their applications from My Applications: roles are only for the people who help run BreezeAuth.

Note: an administrative role is about the admin console, not about applications. Which applications someone can open, and with which roles inside those applications, is defined by application access.

The roles

Role	What it allows	Typical holder
Owner	Everything, including the actions reserved to Owners: giving the Owner role, and changing or deleting users who are Owners.	The founders or the person accountable for BreezeAuth
Administrator	Everything except the actions reserved to Owners: users, service users, groups, applications, domains, network zones, security settings, webhooks and audit logs.	The IT team
Helpdesk	View users, groups and applications, and handle the security of managed users: remove their MFA, end their sessions and use the organization’s incident-response actions.	Support staff
Auditor	Read-only access to the whole organization, including the audit logs.	Security, compliance or internal audit
Billing	Billing, plus a read-only view of the organization and its users.	Finance
SCIM Provisioner	Create, update and remove users and groups, and manage group members, through SCIM. Only for service users.	An HR platform or directory

To see the full permissions of each role in the admin console, select View role definitions in the user form or on a user’s Overview tab.

Role changes take effect immediately, on the user’s next action in the admin console.

Choose a role

Open the user and select Edit. When adding a new user, the field is in the New user form.
In Administrative role, choose the role, or None to remove it.
Select Save changes.

Give each person the narrowest role that covers what they do. A support agent who helps colleagues with MFA needs Helpdesk, not Administrator. An auditor needs Auditor. Few people should be Owner or Administrator.

Owner role rules

The Owner role grants full control over the organization, so BreezeAuth protects it with extra rules:

The organization’s creator is its first Owner. Whoever creates the organization in BreezeAuth becomes Owner.
Only Owners manage Owners. Only an Owner can give someone the Owner role, change a user who is an Owner, or delete one. Administrators can’t.
Your password is required. Giving the Owner role, changing an Owner (including removing their role) and deleting an Owner all ask for your Current password.
There is always an active Owner. The last active Owner can’t lose the role, be deactivated or be deleted. Give the role to someone else first.

When you choose Owner, the Confirm Owner role dialog reminds you what the role allows. Select Continue with this role to go on, or Choose another. When you save, enter your current password to confirm.

Tip: keep two Owners, for example two founders or a founder and the head of IT. If one of them is unavailable, or leaves the company, the other can still manage the organization.

Changes are audited

Every role change is recorded in your organization’s Audit Logs, as part of the user’s update, with who made the change and when.