# Roles and Permissions Reference Select a role in the right-hand navigation to view its permissions. ## Access Management[​](#access-management "Direct link to Access Management") ### Equinix Company Admin[​](#equinix-company-admin "Direct link to Equinix Company Admin") | Role Permission Values | Permission Description | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | billing.billing\_account.create | Create a billing account for the organization | | billing.billing\_account.deactivate | Deactivate a billing account | | billing.billing\_account.edit | Edit a billing account | | billing.billingaccount.move | Move billing accounts between organizations in the resource hierarchy | | ems.mpb\_tenant.admin | Administrative access to Commvault tenant (company), including users, clients, backup policies, and configurations. | | ems.mpb\_tenant.move | Allows moving MPB tenant assets within the resource hierarchy | | ems.mpb\_tenant.read | Allows viewing (reading) MPB tenant assets in the resource hierarchy | | ems.mpc\_tenant.admin | Full administrative access to the tenant organization in vCloud Director, including users, org VDCs, networks, and policies. | | ems.mpc\_tenant.move | Allows moving MPC tenant assets within the resource hierarchy | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.fabriccloudrouter.create | Create Fabric Cloud Router | | fabric.fabriccloudrouter.delete | Delete Fabric Cloud Router | | fabric.fabriccloudrouter.read | Get Fabric Cloud Router | | fabric.fabriccloudrouter.update | Update Fabric Cloud Router | | fabric.internetexchangeservice.create | Create Equinix Internet Exchange service instances | | fabric.internetexchangeservice.delete | Delete Equinix Internet Exchange service instances | | fabric.internetexchangeservice.read | View Equinix Internet Exchange service instances | | fabric.internetexchangeservice.update | Update Equinix Internet Exchange service instances | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.approve | Approve or reject connection | | fabric.l2connection.create | Create connection | | fabric.l2connection.delete | Delete connection | | fabric.l2connection.read | Get connection | | fabric.l2connection.update | Update connection | | fabric.l3connection.approve | Approve or reject L3 connection | | fabric.l3connection.create | Create L3 connection | | fabric.l3connection.delete | Delete L3 connection | | fabric.l3connection.read | Get L3 connection | | fabric.l3connection.update | Update L3 connection | | fabric.l3serviceprofile.create | Create L3 Service profile | | fabric.l3serviceprofile.delete | Delete L3 Service profile | | fabric.l3serviceprofile.read | Get L3 Service profile | | fabric.l3serviceprofile.update | Update L3 Service profile | | fabric.network.create | Create Network | | fabric.network.delete | Delete Network | | fabric.network.read | Get Network | | fabric.network.update | Update Network | | fabric.port.assign | Assign a Port | | fabric.port.delete | Delete a Port | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.port.unassign | Unassign a Port | | fabric.port.update | Update a Port | | fabric.routefilter.create | Create Route Filter | | fabric.routefilter.delete | Delete Route Filter | | fabric.routefilter.read | Get Route Filter | | fabric.routefilter.update | Update Route Filter | | fabric.serviceprofile.create | Create Service profile | | fabric.serviceprofile.delete | Delete Service profile | | fabric.serviceprofile.read | Get Service profile | | fabric.serviceprofile.update | Update Service profile | | fabric.servicetoken.create | Create Service Token | | fabric.servicetoken.delete | Delete Service Token | | fabric.servicetoken.read | Get Service Token | | fabric.servicetoken.update | Update Service Token | | fabric.subscriptionkey.view | View a subscription key | | iam.assignmentauditreport.delete | Delete an assignment audit report | | iam.assignmentauditreport.download | Download an assignment audit report | | iam.assignmentauditreport.generate | Generate an assignment audit report | | iam.assignmentauditreport.view | View an assignment audit report | | iam.customrole.assign | Assign custom roles in the resource hierarchy | | iam.customrole.create | Create custom roles in the resource hierarchy | | iam.customrole.delete | Delete custom roles in the resource hierarchy | | iam.customrole.read | View the custom roles in the resource hierarchy | | iam.customrole.unassign | Unassign custom roles in the resource hierarchy | | iam.customrole.update | Update custom roles in the resource hierarchy | | iam.invitation.create | For admin user to invite users | | iam.invitation.read | For view invitations only, no update | | iam.role.administrate | Permission meant strictly for Primary Admin so that he can perform special operations related with roles | | iam.role.assignment.create | Assign a role to a principal in a resource hierarchy | | iam.role.assignment.delete | Unassign a role from a principal in a resource hierarchy | | iam.role.assignment.read | Read role assignments | | iam.role.create | Create custom roles in the resource hierarchy | | iam.role.delete | Delete custom roles in the resource hierarchy | | iam.role.read | Read roles in the resource hierarchy | | iam.role.update | Update custom roles in the resource hierarchy | | iam.systemrole.assign | Assign Roles in the resource hierarchy | | iam.systemrole.unassign | Reassign and Unassign Roles in the resource hierarchy | | iam.user.create | Create a new user in an organization | | identity.orgbreakglass.read | View organization BREAKGLASS configuration | | identity.orgbreakglass.update | Manage organization BREAKGLASS configuration | | identity.orgidentityprovider.read | View organization identity provider configuration | | identity.orgidentityprovider.update | Manage organization identity provider configuration | | identity.orgscim.read | View organization SCIM configuration | | identity.orgscim.update | Manage organization SCIM configuration | | identity.orgsecuritypolicy.read | Read organization security policies | | identity.orgsecuritypolicy.update | Update organization security policies | | internetAccess.service.create | Create Internet Access Service | | internetAccess.service.delete | Delete Internet Access Service | | internetAccess.service.modify | Modify Internet Access Service | | internetAccess.service.read | Read Internet Access Service | | networkedge.acl.create | Create Network Edge ACL Templates | | networkedge.acl.modify | Modify Network Edge ACL Templates | | networkedge.acl.view | View Network Edge ACL Templates | | networkedge.acltemplate.create | Create Network Edge ACL Templates | | networkedge.acltemplate.delete | Delete Network Edge ACL Templates | | networkedge.acltemplate.modify | Modify Network Edge ACL Templates | | networkedge.acltemplate.view | View Network Edge ACL Templates | | networkedge.bgp.create | Create BGP Sessions | | networkedge.bgp.delete | Delete BGP Sessions | | networkedge.bgp.modify | Modify BGP Sessions | | networkedge.bgp.view | View BGP Sessions | | networkedge.devicelinking.create | Create a Device Linking Group | | networkedge.devicelinking.delete | Delete a Device Linking Group | | networkedge.devicelinking.modify | Modify a Device Linking Group | | networkedge.devicelinking.view | View a Device Linking Group | | networkedge.internetbandwidth.modify | Modify Internet Bandwidth ACL Templates | | networkedge.internetbandwidth.view | View Internet Bandwidth ACL Templates | | networkedge.l2connection.create | Create Level 2 (L2) connections | | networkedge.l2connection.delete | Delete Level 2 (L2) connections | | networkedge.l2connection.modify | Modify Level 2 (L2) connections | | networkedge.l2connection.view | View Level 2 (L2) connections | | networkedge.publickey.create | Create Network Edge Public Key | | networkedge.publickey.delete | Delete Network Edge Public Key | | networkedge.publickey.modify | Modify Network Edge Public Key | | networkedge.publickey.view | View Network Edge Public Key | | networkedge.solutionbuilder.create | Create a Solution Builder | | networkedge.solutionbuilder.delete | Delete a Solution Builder | | networkedge.solutionbuilder.modify | Modify a Solution Builder | | networkedge.solutionbuilder.view | View a Solution Builder | | networkedge.sshuser.create | Create Network Edge SSH Services | | networkedge.sshuser.modify | Modify Network Edge SSH Services | | networkedge.sshuser.view | View Network Edge SSH Services | | networkedge.virtualdevice.create | Create Network Edge Virtual Devices | | networkedge.virtualdevice.delete | Delete Network Edge Virtual Devices | | networkedge.virtualdevice.modify | Modify Network Edge Virtual Devices | | networkedge.virtualdevice.view | View Network Edge Virtual Devices | | networkedge.vpn.create | Create Network Edge VPN Connections | | networkedge.vpn.delete | Delete Network Edge VPN Connections | | networkedge.vpn.modify | Modify Network Edge VPN Connections | | networkedge.vpn.view | View Network Edge VPN Connections | | resourcemanager.org.associate | Associate Orgs with entities like Billing Accounts in the resource hierarchy | | resourcemanager.org.create | Create Orgs in the resource hierarchy | | resourcemanager.org.delete | Delete Orgs in the resource hierarchy | | resourcemanager.org.disassociate | Disassociate Orgs with entities like Billing Accounts in the resource hierarchy | | resourcemanager.org.endcust.create | Create end customer organizations | | resourcemanager.org.endcust.delete | Delete end customer organizations | | resourcemanager.org.endcust.list | List end customer organizations | | resourcemanager.org.endcust.move | Move end customer organizations | | resourcemanager.org.endcust.read | View end customer organizations | | resourcemanager.org.endcust.update | Update end customer organizations | | resourcemanager.org.merge | Merge organizations in the resource hierarchy | | resourcemanager.org.org.add | Add existing org to an organization | | resourcemanager.org.org.remove | Remove existing org from an organization | | resourcemanager.org.partner.create | Create Partner Orgs | | resourcemanager.org.partner.delete | Delete Partner Orgs | | resourcemanager.org.partner.read | View Partner Orgs | | resourcemanager.org.partner.update | Update Partner Orgs | | resourcemanager.org.project.add | Add existing project to an organization | | resourcemanager.org.project.remove | Remove existing project from an organization | | resourcemanager.org.read | View Orgs in the resource hierarchy | | resourcemanager.org.update | Update Orgs in the resource hierarchy | | resourcemanager.project.associate | Associate Projects with Billing Accounts in the resource hierarchy | | resourcemanager.project.create | Create Projects in the resource hierarchy | | resourcemanager.project.delete | Delete Projects in the resource hierarchy | | resourcemanager.project.disassociate | Disassociate Projects from Billing Accounts in the resource hierarchy | | resourcemanager.project.read | View Projects in the resource hierarchy | | resourcemanager.project.resource.add | Add existing resource to a project | | resourcemanager.project.resource.remove | Remove existing resource from a project | | resourcemanager.project.update | Update Projects in the resource hierarchy | | sts.oidcprovider.create | Create a trust relationship with an OIDC Provider | | sts.oidcprovider.delete | Permanently delete a previously suspended trust relationship with an OIDC Provider | | sts.oidcprovider.list | List trust relationships with OIDC Providers. | | sts.oidcprovider.resume | Re-enable a suspended trust relationship with an OIDC Provider | | sts.oidcprovider.suspend | Suspend a trust relationship with an OIDC Provider. While suspended, token exchange for tokens issued by the provider will be disabled. | | sts.oidcprovider.update | Update properties of a trust relationship with an OIDC Provider | ### IAM Admin[​](#iam-admin "Direct link to IAM Admin") | Role Permission Values | Permission Description | | ----------------------------------- | --------------------------------------------------------------------------------------------- | | access.accesspolicy.create | Create an access policy in a project | | access.accesspolicy.delete | Delete an access policy. Access policy must already be disabled with all grants removed | | access.accesspolicy.disable | Disable an access policy, removing the access it provides, before final deletion | | access.accesspolicy.enable | Enable a disabled access policy, reversing the effect and re-enabling access | | access.accesspolicy.list | List access policies for a project | | access.accesspolicy.read | Retrieve contents of an access policy | | access.accesspolicy.update | Update an access policy | | access.action.list | List available actions for a given service for building access policies | | access.actionset.list | List available action sets for a given service for building access policies | | access.grant.add | Add an external grant to an access policy including a managed policy | | access.grant.list | List external grants of an access policy including a managed policy | | access.grant.remove | Remove an external grant to an access policy including a managed policy | | access.permissionset.create | Create a permission set to be reused when defining access policies | | access.permissionset.delete | Delete a permission set. Permission set must not be referenced by other permission objects | | access.permissionset.list | List permission sets in a given project | | access.permissionset.read | Retrieve the contents of a permission set | | access.permissionset.update | Update the contents of a permission set | | access.principalpolicy.create | Create a principal policy | | access.principalpolicy.list | List principal policies in a project | | access.principalpolicy.read | Retrieve the contents of a principal policy | | access.principalpolicy.update | Update a principal policy's permissions | | access.resourcetypeaction.list | List actions that can be invoked for a given service and resource type | | access.resourcetype.list | List available resource types for a given service for building access policies | | access.servicepolicyschema.read | Retrieve the Cedar schema for the given service, in JSON representation | | ems.mpb\_tenant.read | Allows viewing (reading) MPB tenant assets in the resource hierarchy | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | fabric.port.read | Read Port | | fabric.subscriptionkey.view | View a subscription key | | iam.assignmentauditreport.delete | Delete an assignment audit report | | iam.assignmentauditreport.download | Download an assignment audit report | | iam.assignmentauditreport.generate | Generate an assignment audit report | | iam.assignmentauditreport.view | View an assignment audit report | | iam.customrole.assign | Assign custom roles in the resource hierarchy | | iam.customrole.create | Create custom roles in the resource hierarchy | | iam.customrole.delete | Delete custom roles in the resource hierarchy | | iam.customrole.read | View the custom roles in the resource hierarchy | | iam.customrole.unassign | Unassign custom roles in the resource hierarchy | | iam.customrole.update | Update custom roles in the resource hierarchy | | iam.invitation.create | For admin user to invite users | | iam.invitation.read | For view invitations only, no update | | iam.role.assign | Assign Roles in the resource hierarchy (DEPRECATED: Use iam.role.assignment.create instead) | | iam.role.assignment.create | Assign a role to a principal in a resource hierarchy | | iam.role.assignment.delete | Unassign a role from a principal in a resource hierarchy | | iam.role.assignment.read | Read role assignments | | iam.role.create | Create custom roles in the resource hierarchy | | iam.role.delete | Delete custom roles in the resource hierarchy | | iam.role.read | Read roles in the resource hierarchy | | iam.role.unassign | Unassign roles in the resource hierarchy (DEPRECATED: Use iam.role.assignment.delete instead) | | iam.role.update | Update roles in the resource hierarchy | | iam.systemrole.assign | Assign system roles in the resource hierarchy | | iam.systemrole.unassign | Reassign and unassign system roles in the resource hierarchy | | iam.user.create | Create a new user in an organization | | identity.orgbreakglass.read | View organization BREAKGLASS configuration | | identity.orgbreakglass.update | Manage organization BREAKGLASS configuration | | identity.orgidentityprovider.read | View organization identity provider configuration | | identity.orgidentityprovider.update | Manage organization identity provider configuration | | identity.orgscim.read | View organization SCIM configuration | | identity.orgscim.update | Manage organization SCIM configuration | | identity.orgsecuritypolicy.read | Read organization security policies | | identity.orgsecuritypolicy.update | Update organization security policies | | registry.endpoint.list | Page through information about the endpoints for a given service | | registry.namespace.list | Page through the service namespaces that are visible to a given project | | registry.service.get | Return information about a specific service, if visible to the given project | | registry.service.list | Page through services visible to the target project | ### IBX Admin[​](#ibx-admin "Direct link to IBX Admin") | Role Permission Values | Permission Description | | -------------------------------- | --------------------------------------- | | iam.invitation.create | For admin user to invite users | | iam.invitation.read | For view invitations only, no update | | iam.role.assignment.read | Read role assignments | | iam.role.read | Read roles in the resource hierarchy | | resourcemanager.org.endcust.read | View End-customer organizations | | resourcemanager.org.partner.read | View Partner Orgs | | resourcemanager.org.read | View Orgs in the resource hierarchy | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Support Case Manager[​](#support-case-manager "Direct link to Support Case Manager") | Role Permission Values | Permission Description | | ---------------------------- | --------------------------------------- | | resourcemanager.project.read | View Projects in the resource hierarchy | | ucm.supportticket.read | View organization support ticket | | ucm.supportticket.update | Update organization support ticket | ## Billing[​](#billing "Direct link to Billing") ### Billing Account Administrator[​](#billing-account-administrator "Direct link to Billing Account Administrator") | Role Permission Values | Permission Description | | ----------------------------------- | --------------------------------------------- | | billing.billing\_account.create | Create a billing account for the organization | | billing.billing\_account.deactivate | Deactivate a billing account | | billing.billing\_account.edit | Edit a billing account | ### Billing Account Manager[​](#billing-account-manager "Direct link to Billing Account Manager") | Role Permission Values | Permission Description | | ----------------------------------- | ---------------------------- | | billing.billing\_account.deactivate | Deactivate a billing account | | billing.billing\_account.edit | Edit a billing account | ## Customer Resource Hierarchy[​](#customer-resource-hierarchy "Direct link to Customer Resource Hierarchy") ### End Customer Admin[​](#end-customer-admin "Direct link to End Customer Admin") Manages sub-customer Organizations. | Role Permission Value | Permission Description | | ---------------------------------- | --------------------------------- | | resourcemanager.org.endcust.create | Create end customer organizations | | resourcemanager.org.endcust.delete | Delete end customer organizations | | resourcemanager.org.endcust.list | List end customer organizations | | resourcemanager.org.endcust.move | Move end customer organizations | | resourcemanager.org.endcust.read | View end customer organizations | | resourcemanager.org.endcust.update | Update end customer organizations | ### End Customer Viewer[​](#end-customer-viewer "Direct link to End Customer Viewer") View Sub-customer Organizations. | Role Permission Value | Permission Description | | -------------------------------- | ------------------------------- | | resourcemanager.org.endcust.read | View end customer organizations | ### Org Admin[​](#org-admin "Direct link to Org Admin") Creates and manages Organizations in the Resource Hierarchy. | Role Permission Value | Permission Description | | ---------------------------------- | ---------------------------------------------------------------------------------- | | resourcemanager.org.associate | Associate Organizations with Billing Account entities in the resource hierarchy | | resourcemanager.org.create | Create Organizations in the resource hierarchy | | resourcemanager.org.delete | Delete Organizations in the resource hierarchy | | resourcemanager.org.disassociate | Disassociate Organizations with Billing Account entities in the resource hierarchy | | resourcemanager.org.org.add | Add existing org to an organization | | resourcemanager.org.org.remove | Remove existing org from an organization | | resourcemanager.org.project.add | Add existing project to an organization | | resourcemanager.org.project.remove | Remove existing project from an organization | | resourcemanager.org.read | View Organizations in the resource hierarchy | | resourcemanager.org.update | Update Organizations in the resource hierarchy | ### Org Viewer[​](#org-viewer "Direct link to Org Viewer") | Role Permission Value | Permission Description | | ------------------------ | ----------------------------------- | | resourcemanager.org.read | View Orgs in the resource hierarchy | ### Partner Admin[​](#partner-admin "Direct link to Partner Admin") Manages Partner Organizations. | Role Permission Value | Permission Description | | ---------------------------------- | --------------------------------- | | resourcemanager.org.endcust.create | Create End-customer organizations | | resourcemanager.org.endcust.delete | Delete End-customer organizations | | resourcemanager.org.endcust.list | List End-customer organizations | | resourcemanager.org.endcust.move | Move End-customer organizations | | resourcemanager.org.endcust.read | View End-customer organizations | | resourcemanager.org.endcust.update | Update End-customer organizations | | resourcemanager.org.partner.create | Create Partner Orgs | | resourcemanager.org.partner.delete | Delete Partner organizations | | resourcemanager.org.partner.read | View Partner organizations | | resourcemanager.org.partner.update | Update Partner Orgs | ### Partner Viewer[​](#partner-viewer "Direct link to Partner Viewer") View Partner Organizations. | Role Permission Value | Permission Description | | -------------------------------- | ------------------------------- | | resourcemanager.org.endcust.read | View End-customer organizations | | resourcemanager.org.partner.read | View Partner organizations | ### Primary Admin[​](#primary-admin "Direct link to Primary Admin") | Role Permission Value | Permission Description | | --------------------------------------- | ----------------------------------------------------------------------------------------------------- | | fabric.l2connection.read | Get Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3serviceprofile.read | Get L3 Service profile | | fabric.port.read | Read Port | | fabric.serviceprofile.read | Get Service profile | | fabric.servicetoken.read | Get Service Token | | iam.customrole.assign | Assign custom roles in the resource hierarchy | | iam.customrole.create | Create custom roles in the resource hierarchy | | iam.customrole.delete | Delete custom roles in the resource hierarchy | | iam.customrole.read | View the custom roles in the resource hierarchy | | iam.customrole.unassign | Unassign custom roles in the resource hierarchy | | iam.customrole.update | Update custom roles in the resource hierarchy | | iam.role.administrate | Permission meant strictly for Primary Admin in order to perform special operations related with roles | | iam.role.assign | Assign Roles in the resource hierarchy (DEPRECATED: Use iam.role.assignment.create instead) | | iam.role.assignment.create | Assign a role to a principal in a resource hierarchy | | iam.role.assignment.delete | Unassign a role from a principal in a resource hierarchy | | iam.role.assignment.read | Read role assignments | | iam.role.create | Create custom roles in the resource hierarchy | | iam.role.delete | Delete custom roles in the resource hierarchy | | iam.role.read | Read roles in the resource hierarchy | | iam.role.unassign | Unassign roles in the resource hierarchy (DEPRECATED: Use iam.role.assignment.delete instead) | | iam.role.update | Update custom roles in the resource hierarchy | | iam.systemrole.assign | Assign Roles in the resource hierarchy | | iam.systemrole.unassign | Reassign and Unassign Roles in the resource hierarchy | | networkedge.acl.view | View Network Edge ACL Templates | | networkedge.acltemplate.view | View Network Edge ACL Templates | | networkedge.bgp.view | View BGP Sessions | | networkedge.internetbandwidth.view | View Internet Bandwidth ACL Templates | | networkedge.l2connection.view | View Level 2 (L2) connections | | networkedge.publickey.view | View Network Edge Public Key | | networkedge.sshuser.view | View Network Edge SSH Services | | networkedge.virtualdevice.view | View Network Edge Virtual Devices | | networkedge.vpn.view | View Network Edge VPN Connections | | resourcemanager.org.associate | Associate Orgs with entities like Billing Accounts in the resource hierarchy | | resourcemanager.org.create | Create Orgs in the resource hierarchy | | resourcemanager.org.delete | Delete Orgs in the resource hierarchy | | resourcemanager.org.disassociate | Disassociate Orgs with entities like Billing Accounts in the resource hierarchy | | resourcemanager.org.org.add | Add existing org to an organization | | resourcemanager.org.org.remove | Remove existing org from an organization | | resourcemanager.org.project.add | Add existing project to an organization | | resourcemanager.org.project.remove | Remove existing project from an organization | | resourcemanager.org.read | View Orgs in the resource hierarchy | | resourcemanager.org.update | Update Orgs in the resource hierarchy | | resourcemanager.project.associate | Associate Projects with Billing Accounts in the resource hierarchy | | resourcemanager.project.create | Create Projects in the resource hierarchy | | resourcemanager.project.delete | Delete Projects in the resource hierarchy | | resourcemanager.project.disassociate | Disassociate Projects from Billing Accounts in the resource hierarchy | | resourcemanager.project.read | View Projects in the resource hierarchy | | resourcemanager.project.resource.add | Add existing resource to a project | | resourcemanager.project.resource.remove | Remove existing resource from a project | | resourcemanager.project.update | Update Projects in the resource hierarchy | ### Project Admin[​](#project-admin "Direct link to Project Admin") Creates and manages Inventory and Projects. | Role Permission Value | Permission Description | | --------------------------------------- | --------------------------------------------------------------------- | | resourcemanager.project.associate | Associate Projects with Billing Accounts in the resource hierarchy | | resourcemanager.project.create | Create Projects in the resource hierarchy | | resourcemanager.project.delete | Delete Projects in the resource hierarchy | | resourcemanager.project.disassociate | Disassociate Projects from Billing Accounts in the resource hierarchy | | resourcemanager.project.read | View Projects in the resource hierarchy | | resourcemanager.project.resource.add | Add existing resource to a project | | resourcemanager.project.resource.remove | Remove existing resource from a project | | resourcemanager.project.update | Update Projects in the resource hierarchy | ### Project Viewer[​](#project-viewer "Direct link to Project Viewer") Views Projects and Project Resources. | Role Permission Value | Permission Description | | ---------------------------- | --------------------------------------- | | resourcemanager.project.read | View Projects in the resource hierarchy | ## Fabric[​](#fabric "Direct link to Fabric") ### Deployment Manager[​](#deployment-manager "Direct link to Deployment Manager") | Role Permission Value | Permission Description | | -------------------------- | -------------------------- | | fabric.deployment.create | Creates a deployment | | fabric.deployment.delete | Deletes a deployment | | fabric.deployment.deploy | Deploys a deployment | | fabric.deployment.download | Downloads a deployment | | fabric.deployment.read | Gets/Lists a deployment | | fabric.deployment.update | Updates a deployment | | fabric.provider.search | Searches for CSP providers | ### Deployment Viewer[​](#deployment-viewer "Direct link to Deployment Viewer") | Role Permission Value | Permission Description | | -------------------------- | -------------------------- | | fabric.deployment.download | Downloads a deployment | | fabric.deployment.read | Gets/Lists a deployment | | fabric.provider.search | Searches for CSP providers | ### End Customer Fabric Manager[​](#end-customer-fabric-manager "Direct link to End Customer Fabric Manager") End Customer - Manages Connections, Service tokens and Internet Access. | Role Permission Value | Permission Description | | ----------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.create | Create Connection | | fabric.l2connection.delete | Delete Connection | | fabric.l2connection.read | Get Connection | | fabric.l2connection.update | Update Connection | | fabric.l3connection.create | Create L3 Connection | | fabric.l3connection.delete | Delete L3 Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3connection.update | Update L3 Connection | | fabric.network.create | Create Network | | fabric.network.delete | Delete Network | | fabric.network.read | Get Network | | fabric.network.update | Update Network | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.servicetoken.create | Create Service Tokens | | fabric.servicetoken.delete | Delete Service Tokens | | fabric.servicetoken.read | View Service Tokens | | fabric.servicetoken.update | Update Service Tokens | | internetAccess.service.create | Create Internet Access service instances | | internetAccess.service.delete | Delete Internet Access service instances | | internetAccess.service.modify | Edit Internet Access service instances | | internetAccess.service.read | Read Internet Access service instances | | resourcemanager.project.read | View Projects in the resource hierarchy | ### End Customer Fabric Viewer[​](#end-customer-fabric-viewer "Direct link to End Customer Fabric Viewer") End Customer - View Ports, Connections, Service tokens and EIA. | Role Permission Value | Permission Description | | ---------------------------- | ----------------------------------------------- | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.l2connection.read | Get Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3serviceprofile.read | Get L3 Service Profiles | | fabric.network.read | Get Network | | fabric.port.read | View Port | | fabric.serviceprofile.read | Get Service Profiles | | fabric.servicetoken.read | Get Service Token | | internetAccess.service.read | Read Internet Access service instances | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Agent Factory Manager[​](#fabric-agent-factory-manager "Direct link to Fabric Agent Factory Manager") | Role Permission Value | Permission Description | | -------------------------- | -------------------------------------- | | fabric.agentfactory.create | Create Fabric Agent and Agent Template | | fabric.agentfactory.delete | Delete Fabric Agent and Agent Template | | fabric.agentfactory.read | Get Fabric Agent and Agent Template | | fabric.agentfactory.update | Update Fabric Agent and Agent Template | ### Fabric Application Connect Manager[​](#fabric-application-connect-manager "Direct link to Fabric Application Connect Manager") | Role Permission Value | Permission Description | | -------------------------------------------- | ------------------------------------------------- | | fabric.ac.appDomain.attach | Attach an App Domain to an App Link | | fabric.ac.appDomain.create | Create an App Domain | | fabric.ac.appDomain.delete | Delete an App Domain | | fabric.ac.appDomain.detach | Detach an App Domain from an App Link | | fabric.ac.appDomain.read | Read or list App Domains | | fabric.ac.appDomain.readAttach | View App Domains attached to an App Link | | fabric.ac.appDomain.update | Update an App Domain | | fabric.ac.appLink.create | Create an App Link | | fabric.ac.appLink.delete | Delete an App Link | | fabric.ac.appLink.read | Read or list App Links | | fabric.ac.appLink.update | Update an App Link | | fabric.ac.appLink.updateAttachedAppProcessor | Update an App Processor attachment on an App Link | | fabric.ac.appLink.updateAttachedAppService | Update an App Service attachment on an App Link | | fabric.ac.appProcessor.attach | Attach an App Processor to an App Link | | fabric.ac.appProcessor.create | Create an App Processor | | fabric.ac.appProcessor.delete | Delete an App Processor | | fabric.ac.appProcessor.detach | Detach an App Processor from an App Link | | fabric.ac.appProcessor.read | Read or list App Processors | | fabric.ac.appProcessor.readAttach | View App Processors attached to an App Link | | fabric.ac.appProcessor.update | Update an App Processor | | fabric.ac.appService.attach | Attach an App Service to an App Link | | fabric.ac.appService.create | Create an App Service | | fabric.ac.appService.delete | Delete an App Service | | fabric.ac.appService.detach | Detach an App Service from an App Link | | fabric.ac.appService.read | Read or list App Services | | fabric.ac.appService.readAttach | View App Services attached to an App Link | | fabric.ac.appService.readSubscriptions | View subscriptions of an App Service | | fabric.ac.appService.update | Update an App Service | | fabric.ac.appSubscription.create | Create an App Subscription | | fabric.ac.appSubscription.delete | Delete an App Subscription | | fabric.ac.appSubscription.read | Read or list App Subscriptions | | fabric.ac.appSubscription.update | Update an App Subscription | ### Fabric Application Connect Operator[​](#fabric-application-connect-operator "Direct link to Fabric Application Connect Operator") | Role Permission Value | Permission Description | | -------------------------------------------- | ------------------------------------------------- | | fabric.ac.appDomain.attach | Attach an App Domain to an App Link | | fabric.ac.appDomain.create | Create an App Domain | | fabric.ac.appDomain.read | Read or list App Domains | | fabric.ac.appDomain.readAttach | View App Domains attached to an App Link | | fabric.ac.appDomain.update | Update an App Domain | | fabric.ac.appLink.read | Read or list App Links | | fabric.ac.appLink.update | Update an App Link | | fabric.ac.appLink.updateAttachedAppProcessor | Update an App Processor attachment on an App Link | | fabric.ac.appProcessor.attach | Attach an App Processor to an App Link | | fabric.ac.appProcessor.create | Create an App Processor | | fabric.ac.appProcessor.read | Read or list App Processors | | fabric.ac.appProcessor.readAttach | View App Processors attached to an App Link | | fabric.ac.appProcessor.update | Update an App Processor | | fabric.ac.appService.attach | Attach an App Service to an App Link | | fabric.ac.appService.create | Create an App Service | | fabric.ac.appService.read | Read or list App Services | | fabric.ac.appService.readAttach | View App Services attached to an App Link | | fabric.ac.appService.readSubscriptions | View subscriptions of an App Service | | fabric.ac.appService.update | Update an App Service | | fabric.ac.appSubscription.create | Create an App Subscription | | fabric.ac.appSubscription.read | Read or list App Subscriptions | | fabric.ac.appSubscription.update | Update an App Subscription | ### Fabric Application Connect Viewer[​](#fabric-application-connect-viewer "Direct link to Fabric Application Connect Viewer") | Role Permission Value | Permission Description | | -------------------------------------- | ------------------------------------------- | | fabric.ac.appDomain.read | Read or list App Domains | | fabric.ac.appDomain.readAttach | View App Domains attached to an App Link | | fabric.ac.appLink.read | Read or list App Links | | fabric.ac.appProcessor.read | Read or list App Processors | | fabric.ac.appProcessor.readAttach | View App Processors attached to an App Link | | fabric.ac.appService.read | Read or list App Services | | fabric.ac.appService.readAttach | View App Services attached to an App Link | | fabric.ac.appService.readSubscriptions | View subscriptions of an App Service | | fabric.ac.appSubscription.read | Read or list App Subscriptions | ### Fabric Cloud Router Manager[​](#fabric-cloud-router-manager "Direct link to Fabric Cloud Router Manager") Creates and manages Fabric Cloud Router instances. | Role Permission Value | Permission Description | | -------------------------------------- | ------------------------------------------- | | fabric.fabriccloudrouter.create | Create Fabric Cloud Router | | fabric.fabriccloudrouter.delete | Delete Fabric Cloud Router | | fabric.fabriccloudrouter.gatewayattach | Attach VPN Gateway from Fabric Cloud Router | | fabric.fabriccloudrouter.gatewaydetach | Detach VPN Gateway from Fabric Cloud Router | | fabric.fabriccloudrouter.read | Get Fabric Cloud Router | | fabric.fabriccloudrouter.update | Update Fabric Cloud Router | | fabric.routeaggregation.create | Create Route Aggregation | | fabric.routeaggregation.delete | Delete Route Aggregation | | fabric.routeaggregation.read | Get Route Aggregation | | fabric.routeaggregation.update | Update Route Aggregation | | fabric.routefilter.create | Create Route Filter | | fabric.routefilter.delete | Delete Route Filter | | fabric.routefilter.read | Get Route Filter | | fabric.routefilter.update | Update Route Filter | ### Fabric Cloud Router Viewer[​](#fabric-cloud-router-viewer "Direct link to Fabric Cloud Router Viewer") Views Fabric Cloud Router instances. | Role Permission Value | Permission Description | | ----------------------------- | ----------------------- | | fabric.fabriccloudrouter.read | Get Fabric Cloud Router | | fabric.routeaggregation.read | Get Route Aggregation | | fabric.routefilter.read | Get Route Filter | ### Fabric Connection Manager[​](#fabric-connection-manager "Direct link to Fabric Connection Manager") Manages Connections, Service tokens and Internet Access. | Role Permission Value | Permission Description | | ----------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.create | Create Connection | | fabric.l2connection.delete | Delete Connection | | fabric.l2connection.read | Get Connection | | fabric.l2connection.update | Update Connection | | fabric.servicetoken.create | Create Service Token | | fabric.servicetoken.delete | Delete Service Token | | fabric.servicetoken.read | Get Service Token | | fabric.servicetoken.update | Update Service Token | | internetAccess.service.create | Create Internet Access service | | internetAccess.service.delete | Delete Internet Access service | | internetAccess.service.modify | Modify Internet Access service | | internetAccess.service.read | Read Internet Access service | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Event Subscription Manager[​](#fabric-event-subscription-manager "Direct link to Fabric Event Subscription Manager") | Role Permission Value | Permission Description | | ------------------------------- | -------------------------------- | | fabric.eventsubscription.create | Create Fabric Event Subscription | | fabric.eventsubscription.delete | Delete Fabric Event Subscription | | fabric.eventsubscription.read | Get Fabric Event Subscription | | fabric.eventsubscription.update | Update Fabric Event Subscription | ### Fabric Manager[​](#fabric-manager "Direct link to Fabric Manager") Manages Ports, Connections, Service Tokens, Internet Access, and Internet Exchange for their organization. | Role Permission Value | Permission Description | | ------------------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.fabricone.create | Create Fabric One Router | | fabric.fabricone.delete | Delete Fabric One Router | | fabric.fabricone.read | Read Fabric One Router | | fabric.fabricone.update | Update Fabric One Router | | fabric.internetexchangeservice.create | Create Internet Exchange service instances | | fabric.internetexchangeservice.delete | Delete Internet Exchange service instances | | fabric.internetexchangeservice.read | View Internet Exchange service instances | | fabric.internetexchangeservice.update | Update Internet Exchange service instances | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.create | Create Connection | | fabric.l2connection.delete | Delete Connection | | fabric.l2connection.read | Get Connection | | fabric.l2connection.update | Update Connection | | fabric.l3connection.create | Create L3 Connection | | fabric.l3connection.delete | Delete L3 Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3connection.update | Update L3 Connection | | fabric.network.create | Create Network | | fabric.network.delete | Delete Network | | fabric.network.read | Get Network | | fabric.network.update | Update Network | | fabric.port.delete | Delete a Port | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.port.update | Update a port | | fabric.servicetoken.create | Create Service Token | | fabric.servicetoken.delete | Delete Service Token | | fabric.servicetoken.read | Get Service Token | | fabric.servicetoken.update | Update Service Token | | internetAccess.service.create | Create Internet Access service | | internetAccess.service.delete | Delete Internet Access service | | internetAccess.service.modify | Edit Internet Access service | | internetAccess.service.read | View Internet Access service | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Partner Resource Manager[​](#fabric-partner-resource-manager "Direct link to Fabric Partner Resource Manager") Manages Fabric Partner Projects and Resources. | Role Permission Value | Permission Description | | ---------------------------- | --------------------------------------- | | fabric.port.assign | Assign a Port | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.port.unassign | Unassign a Port | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Port Manager[​](#fabric-port-manager "Direct link to Fabric Port Manager") Manages Fabric Ports | Role Permission Value | Permission Description | | ---------------------------- | --------------------------------------- | | fabric.port.delete | Delete a Port | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.port.update | Update a Port | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Port Viewer[​](#fabric-port-viewer "Direct link to Fabric Port Viewer") View Fabric Ports. | Role Permission Value | Permission Description | | ---------------------------- | ----------------------------------------------- | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.port.read | Read Port | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Service Profile Manager[​](#fabric-service-profile-manager "Direct link to Fabric Service Profile Manager") Manages Service profiles, Connections and EIA. | Role Permission Value | Permission Description | | ----------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.approve | Approve or Reject Connection | | fabric.l2connection.create | Create Connection | | fabric.l2connection.delete | Delete Connection | | fabric.l2connection.read | Get Connection | | fabric.l2connection.update | Update Connection | | fabric.network.create | Create Network | | fabric.network.delete | Delete Network | | fabric.network.read | Get Network | | fabric.network.update | Update Network | | fabric.serviceprofile.create | Create Service profile | | fabric.serviceprofile.delete | Delete Service profile | | fabric.serviceprofile.read | Get Service profile | | fabric.serviceprofile.update | Update Service profile | | fabric.servicetoken.create | Create Service Token | | fabric.servicetoken.delete | Delete Service Token | | fabric.servicetoken.read | Get Service Token | | fabric.servicetoken.update | Update Service Token | | internetAccess.service.create | Create Internet Access service | | internetAccess.service.delete | Delete Internet Access service | | internetAccess.service.modify | Modify Internet Access service | | internetAccess.service.read | Read Internet Access service | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Service Provider[​](#fabric-service-provider "Direct link to Fabric Service Provider") Manages Service profiles, Ports, Connections, Service tokens and EIA. | Role Permission Value | Permission Description | | ------------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.fabriccloudrouter.create | Create Fabric Cloud Router | | fabric.fabriccloudrouter.delete | Delete Fabric Cloud Router | | fabric.fabriccloudrouter.read | Get Fabric Cloud Router | | fabric.fabriccloudrouter.update | Update Fabric Cloud Router | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.l2connection.approve | Approve or Reject Connection | | fabric.l2connection.create | Create Connection | | fabric.l2connection.delete | Delete Connection | | fabric.l2connection.read | Get Connection | | fabric.l2connection.update | Update Connection | | fabric.l3connection.approve | Approve or Reject L3 Connection | | fabric.l3connection.create | Create L3 Connection | | fabric.l3connection.delete | Delete L3 Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3connection.update | Update L3 Connection | | fabric.l3serviceprofile.create | Create L3 Service profile | | fabric.l3serviceprofile.delete | Delete L3 Service profile | | fabric.l3serviceprofile.read | Get L3 Service profile | | fabric.l3serviceprofile.update | Update L3 Service profile | | fabric.network.create | Create Network | | fabric.network.delete | Delete Network | | fabric.network.read | Get Network | | fabric.network.update | Update Network | | fabric.port.delete | Delete a Port | | fabric.port.placeorder | Place VC Order on Port | | fabric.port.read | Read Port | | fabric.port.update | Update a port | | fabric.routefilter.create | Create Route Filter | | fabric.routefilter.delete | Delete Route Filter | | fabric.routefilter.read | Get Route Filter | | fabric.routefilter.update | Update Route Filter | | fabric.serviceprofile.create | Create Service profile | | fabric.serviceprofile.delete | Delete Service profile | | fabric.serviceprofile.read | Get Service profile | | fabric.serviceprofile.update | Update Service profile | | fabric.servicetoken.create | Create Service Token | | fabric.servicetoken.delete | Delete Service Token | | fabric.servicetoken.read | Get Service Token | | fabric.servicetoken.update | Update Service Token | | internetAccess.service.create | Create Internet Access Service | | internetAccess.service.delete | Delete Internet Access Service | | internetAccess.service.modify | Modify Internet Access Service | | internetAccess.service.read | Read Internet Access Service | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric Stream Subscription Manager[​](#fabric-stream-subscription-manager "Direct link to Fabric Stream Subscription Manager") Create Stream Subscriptions | Role Permission Value | Permission Description | | -------------------------------- | --------------------------------- | | fabric.stream.create | Create Fabric Stream | | fabric.stream.delete | Delete Fabric Stream | | fabric.stream.read | Get Fabric Stream | | fabric.stream.update | Update Fabric Stream | | fabric.streamsubscription.create | Create Fabric Stream Subscription | | fabric.streamsubscription.delete | Delete Fabric Stream Subscription | | fabric.streamsubscription.read | Get Fabric Stream Subscription | | fabric.streamsubscription.update | Update Fabric Stream Subscription | ### Fabric Viewer[​](#fabric-viewer "Direct link to Fabric Viewer") View Service profiles, Ports, Connections, Service Tokens, Internet Access services, and Internet Exchange services. | Role Permission Value | Permission Description | | ----------------------------------- | ------------------------------------------------ | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.fabricone.read | Read Fabric One Router | | fabric.internetexchangeservice.read | View Equinix Internet Exchange service instances | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.l2connection.read | Get Connection | | fabric.l3connection.read | Get L3 Connection | | fabric.l3serviceprofile.read | Get L3 Service profile | | fabric.network.read | Get Network | | fabric.port.read | Read Port | | fabric.serviceprofile.read | Get Service profile | | fabric.servicetoken.read | Get Service Token | | internetAccess.service.read | Read Internet Access Service | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Fabric VPN Gateway Manager[​](#fabric-vpn-gateway-manager "Direct link to Fabric VPN Gateway Manager") | Role Permission Value | Permission Description | | -------------------------------------- | ------------------------------------------- | | fabric.gateway.create | Creates a Gateway | | fabric.gateway.delete | Deletes a Gateway | | fabric.gateway.fabriccloudrouterattach | Attaches a Gateway to a Fabric Cloud Router | | fabric.gateway.read | Read operations on a Gateway | | fabric.gateway.update | Updates a Gateway | | fabric.gatewayinterface.addtunnel | Adds a Tunnel to an Interface | | fabric.gatewayinterface.attach | Attaches an Interface to a Gateway | | fabric.gatewayinterface.create | Creates an Interface | | fabric.gatewayinterface.delete | Deletes an Interface | | fabric.gatewayinterface.deletetunnel | Deletes a Tunnel from an Interface | | fabric.gatewayinterface.detach | Detaches an Interface from a Gateway | | fabric.gatewayinterface.read | Read operations on an Interface | | fabric.gatewayinterface.update | Updates an Interface | | fabric.gatewayinterface.updatetunnel | Updates a Tunnel in an Interface | ### Fabric VPN Gateway Viewer[​](#fabric-vpn-gateway-viewer "Direct link to Fabric VPN Gateway Viewer") | Role Permission Value | Permission Description | | ---------------------------- | ------------------------------- | | fabric.gateway.read | Read operations on a Gateway | | fabric.gatewayinterface.read | Read operations on an Interface | ### Subscription Key Viewer[​](#subscription-key-viewer "Direct link to Subscription Key Viewer") Views Subscription Keys | Role Permission Value | Permission Description | | --------------------------- | ----------------------- | | fabric.subscriptionkey.view | View a subscription key | ## Managed Solutions[​](#managed-solutions "Direct link to Managed Solutions") ### MPB Tenant Access[​](#mpb-tenant-access "Direct link to MPB Tenant Access") | Role Permission Value | Permission Description | | ---------------------- | -------------------------------------------------------------------- | | ems.mpb\_tenant.access | Can view jobs in Commvault tenant (company) | | ems.mpb\_tenant.read | Allows viewing (reading) MPB tenant assets in the resource hierarchy | ### MPB Tenant Admin[​](#mpb-tenant-admin "Direct link to MPB Tenant Admin") | Role Permission Value | Permission Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------ | | ems.mpb\_tenant.admin | Administrative access to Commvault tenant (company), including users, clients, backup policies, and configurations | | ems.mpb\_tenant.move | Allows moving MPB tenant assets within the resource hierarchy | | ems.mpb\_tenant.read | Allows viewing (reading) MPB tenant assets in the resource hierarchy | ### MPB Tenant Operator[​](#mpb-tenant-operator "Direct link to MPB Tenant Operator") | Role Permission Value | Permission Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------- | | ems.mpb\_tenant.operator | Can manage assigned backup operations, view jobs, and interact with configured clients and policies in Commvault | | ems.mpb\_tenant.read | Allows viewing (reading) MPB tenant assets in the resource hierarchy | ### MPC Tenant Admin[​](#mpc-tenant-admin "Direct link to MPC Tenant Admin") | Role Permission Value | Permission Description | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | ems.mpc\_tenant.admin | Full administrative access to the tenant organization in vCloud Director, including users, org VDCs, networks, and policies. | | ems.mpc\_tenant.move | Allows moving MPC tenant assets within the resource hierarchy. | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | ### MPC Tenant Author[​](#mpc-tenant-author "Direct link to MPC Tenant Author") | Role Permission Value | Permission Description | | ---------------------- | --------------------------------------------------------------------------------------------------------------- | | ems.mpc\_tenant.author | Can create and manage standard resources (VMs, networks) within assigned quotas and policies in vCloud Director | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | ### MPC Tenant Author Full[​](#mpc-tenant-author-full "Direct link to MPC Tenant Author Full") | Role Permission Value | Permission Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------ | | ems.mpc\_tenant.author\_full | Can create and manage all resources with fewer restrictions, including advanced configurations in vCloud Director. | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | ### MPC Tenant User[​](#mpc-tenant-user "Direct link to MPC Tenant User") | Role Permission Value | Permission Description | | --------------------- | -------------------------------------------------------------------------------------------------------------------- | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | ems.mpc\_tenant.user | Can operate and manage assigned resources (e.g. power on/off VMs) without creation privileges beyond standard limits | ### MPC Tenant User Full[​](#mpc-tenant-user-full "Direct link to MPC Tenant User Full") | Role Permission Value | Permission Description | | -------------------------- | --------------------------------------------------------------------- | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | ems.mpc\_tenant.user\_full | Can fully operate and manage all assigned resources across the tenant | ### MPC Tenant Viewer[​](#mpc-tenant-viewer "Direct link to MPC Tenant Viewer") | Role Permission Value | Permission Description | | ---------------------- | ------------------------------------------------------------------------- | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | ems.mpc\_tenant.viewer | Read-only access to tenant resources and configuration in vCloud Director | ### MPC Tenant Viewer Full[​](#mpc-tenant-viewer-full "Direct link to MPC Tenant Viewer Full") | Role Permission Value | Permission Description | | ---------------------------- | -------------------------------------------------------------------- | | ems.mpc\_tenant.read | Allows viewing (reading) MPC tenant assets in the resource hierarchy | | ems.mpc\_tenant.viewer\_full | Full visibility across all tenant resources in read-only mode | ## Network Edge[​](#network-edge "Direct link to Network Edge") ### Company Profile Admin[​](#company-profile-admin "Direct link to Company Profile Admin") | Role Permission Value | Permission Description | | ------------------------------- | --------------------------------------- | | discovery.companyprofile.read | Get Company Profile | | discovery.companyprofile.update | Update Company Profile | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Device Profile Approver[​](#device-profile-approver "Direct link to Device Profile Approver") | Role Permission Value | Permission Description | | ------------------------------- | ---------------------- | | networkedge.vsocprofile.approve | Approve a VSOC Profile | | networkedge.vsocprofile.create | Create a VSOC Profile | | networkedge.vsocprofile.delete | Delete a VSOC Profile | | networkedge.vsocprofile.modify | Modify a VSOC Profile | | networkedge.vsocprofile.reject | Reject a VSOC Profile | | networkedge.vsocprofile.view | View a VSOC Profile | ### Device Profile Manager[​](#device-profile-manager "Direct link to Device Profile Manager") | Role Permission Value | Permission Description | | ------------------------------ | ---------------------- | | networkedge.vendorimage.create | Upload Vendor Image | | networkedge.vendorimage.delete | Delete Vendor Image | | networkedge.vendorimage.read | Read/View Vendor Image | | networkedge.vendorimage.update | Modify Vendor Image | | networkedge.vsocprofile.create | Create a VSOC Profile | | networkedge.vsocprofile.delete | Delete a VSOC Profile | | networkedge.vsocprofile.modify | Modify a VSOC Profile | | networkedge.vsocprofile.view | View a VSOC Profile | ### Network Edge Connections Manager[​](#network-edge-connections-manager "Direct link to Network Edge Connections Manager") Manages Network Edge Connections. | Role Permission Value | Permission Description | | ---------------------------------- | ----------------------------------------------- | | fabric.asn.create | Allows to provision private or public ASN | | fabric.asn.delete | Allows to deprovision private or public ASN | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.create | Create IP Block in the resource hierarchy | | fabric.ipblock.delete | Delete IP Block from resource hierarchy | | fabric.ipblock.read | Read IP Block from resource hierarchy | | fabric.ipblock.update | Update IP Block in the resource hierarchy | | fabric.serviceprofile.read | Get Service profile | | internetAccess.service.create | Create Internet Access Service | | internetAccess.service.delete | Delete Internet Access Service | | internetAccess.service.modify | Modify Internet Access Service | | internetAccess.service.read | Read Internet Access Service | | networkedge.acl.view | View Network Edge ACL Templates | | networkedge.acltemplate.view | View Network Edge ACL Templates | | networkedge.bgp.create | Create BGP Sessions | | networkedge.bgp.delete | Delete BGP Sessions | | networkedge.bgp.modify | Modify BGP Sessions | | networkedge.bgp.view | View BGP Sessions | | networkedge.internetbandwidth.view | View Internet Bandwidth ACL Templates | | networkedge.l2connection.create | Create Layer 2 (L2) Connections | | networkedge.l2connection.delete | Delete Layer 2 (L2) Connections | | networkedge.l2connection.modify | Modify Layer 2 (L2) Connections | | networkedge.l2connection.view | View Layer 2 (L2) Connections | | networkedge.publickey.view | View Network Edge Public Key | | networkedge.sshuser.view | View Network Edge SSH Services | | networkedge.virtualdevice.view | View Network Edge Virtual Devices | | networkedge.vpn.view | View Network Edge VPN Connections | | resourcemanager.project.read | View Projects in the resource hierarchy | ### Network Edge Device Manager[​](#network-edge-device-manager "Direct link to Network Edge Device Manager") Manages Network Edge Devices. | Role Permission Value | Permission Description | | ------------------------------------ | --------------------------------------- | | networkedge.acl.create | Create Network Edge ACL Templates | | networkedge.acl.modify | Modify Network Edge ACL Templates | | networkedge.acl.view | View Network Edge ACL Templates | | networkedge.acltemplate.create | Create Network Edge ACL Templates | | networkedge.acltemplate.delete | Delete Network Edge ACL Templates | | networkedge.acltemplate.modify | Modify Network Edge ACL Templates | | networkedge.acltemplate.view | View Network Edge ACL Templates | | networkedge.bgp.view | View BGP Sessions | | networkedge.devicelinking.create | Create a Device Linking Group | | networkedge.devicelinking.delete | Delete a Device Linking Group | | networkedge.devicelinking.modify | Modify a Device Linking Group | | networkedge.devicelinking.view | View a Device Linking Group | | networkedge.internetbandwidth.modify | Modify Internet Bandwidth ACL Templates | | networkedge.internetbandwidth.view | View Internet Bandwidth ACL Templates | | networkedge.l2connection.create | Create Level 2 (L2) connections | | networkedge.l2connection.delete | Delete Level 2 (L2) connections | | networkedge.l2connection.modify | Modify Level 2 (L2) connections | | networkedge.l2connection.view | View Level 2 (L2) connections | | networkedge.publickey.create | Create Network Edge Public Key | | networkedge.publickey.delete | Delete Network Edge Public Key | | networkedge.publickey.modify | Modify Network Edge Public Key | | networkedge.publickey.view | View Network Edge Public Key | | networkedge.solutionbuilder.create | Create a Solution Builder | | networkedge.solutionbuilder.delete | Delete a Solution Builder | | networkedge.solutionbuilder.modify | Modify a Solution Builder | | networkedge.solutionbuilder.view | View a Solution Builder | | networkedge.sshuser.create | Create Network Edge SSH Services | | networkedge.sshuser.modify | Modify Network Edge SSH Services | | networkedge.sshuser.view | View Network Edge SSH Services | | networkedge.virtualdevice.create | Create Network Edge Virtual Devices | | networkedge.virtualdevice.delete | Delete Network Edge Virtual Devices | | networkedge.virtualdevice.modify | Modify Network Edge Virtual Devices | | networkedge.virtualdevice.view | View Network Edge Virtual Devices | | networkedge.vpn.create | Create Network Edge VPN Connections | | networkedge.vpn.delete | Delete Network Edge VPN Connections | | networkedge.vpn.modify | Modify Network Edge VPN Connections | | networkedge.vpn.view | View Network Edge VPN Connections | | resourcemanager.project.read | View Projects in the Resource Hierarchy | ### Network Edge Viewer[​](#network-edge-viewer "Direct link to Network Edge Viewer") Views Network Edge Projects and Resources. | Role Permission Value | Permission Description | | ---------------------------------- | ----------------------------------------------- | | fabric.asn.read | Allows to display and use private or public ASN | | fabric.ipblock.read | Read IP Block from resource hierarchy | | internetAccess.service.read | Read Internet Access Service | | networkedge.acl.view | View Network Edge ACL Templates | | networkedge.acltemplate.view | View Network Edge ACL Templates | | networkedge.bgp.view | View BGP Sessions | | networkedge.devicelinking.view | View a Device Linking Group | | networkedge.internetbandwidth.view | View Internet Bandwidth ACL Templates | | networkedge.l2connection.view | View Layer 2 (L2) Connections | | networkedge.publickey.view | View Network Edge Public Key | | networkedge.solutionbuilder.create | Create a Solution Builder | | networkedge.solutionbuilder.delete | Delete a Solution Builder | | networkedge.solutionbuilder.modify | Edit a Solution Builder | | networkedge.solutionbuilder.view | View a Solution Builder | | networkedge.sshuser.view | View Network Edge SSH Services | | networkedge.virtualdevice.view | View Network Edge Virtual Devices | | networkedge.vpn.view | View Network Edge VPN Connections | | resourcemanager.project.read | View Projects in the resource hierarchy | ## Precision Time[​](#precision-time "Direct link to Precision Time") ### EPT Service Admin[​](#ept-service-admin "Direct link to EPT Service Admin") Manages the Precision Time service. | Role Permission Value | Permission Description | | ---------------------------- | --------------------------------------- | | ept.service.admin | Precision Time service admin | | ept.service.create | Create Precision Time services | | ept.service.delete | Delete Precision Time services | | ept.service.update | Update Precision Time services | | ept.service.view | View Precision Time services | | resourcemanager.org.read | View Orgs in the resource hierarchy | | resourcemanager.project.read | View Projects in the resource hierarchy | ## Colocation Dashboard Permissions[​](#colocation-dashboard-permissions "Direct link to Colocation Dashboard Permissions") These permissions apply to colocation products, assets, and services. | Category | Description | | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Administration and IBX Access Services Request | Allows the user to schedule IBX access requests (Work Visits, Conference Rooms, and Data Center Tours). Allows administrators to manage other Customer Portal user accounts. | | Ordering | Allows the user to place orders in the portal (for Shipments, Cross Connect and Intra-Facility Cables, Network Ports, Smart Hands, Accessories, Power, Trouble Tickets), to view orders by other users, and to view purchase orders for their organization. | | IBX Data Center Access | Allows the user to access IBX data centers and cages/cabinets, to bring guests, and to remove equipment. | | Install Base | Allows the user to view details about their organization's products/assets and purchase orders. Controls access to the Install Base screen, Install Base report, Colocation Assets screen, and Purchase Order Management screen. | | Billing and Payments | Allows the user to view financial records, payment history, and purchase orders for their organization. | | Smart Hands Support Plan | Allows the user to order a Smart Hands support plan and subscribe to support plan notifications. | | IBX Services Notifications | Allows the user to subscribe to notifications about IBX incidents, network incidents, unannounced shipments, managed services, and IBX policy violations. Also allows the user to view incidents on the [Service Insight Dashboard](https://docs.equinix.com/incidents-notifications/service-insight/esi.md). **Important:** At least two administrators in each organization must be configured to receive IBX policy violations (i.e., the **Can view and subscribe to IBX Policy Violation Notifications** permission). | | Colocation Ordering | Allows the user to order Secure Cabinet and Private Cage products online. | | Virtual Asset Notification Permission | Allows the user to view and subscribe to Fabric and Network Edge virtual asset notifications. | | Sustainability Report | Allows the user to generate [Sustainability](https://docs.equinix.com/observability/sustainability/ecp-sustainability.md) reports | | Internet Exchange Portal | Allows the user to access the Internet Exchange (IX) portal. | | Managed Solutions Portal | Allows the user to see the Managed Solutions menu item in Customer Portal and access a ServiceNow instance for Managed Solutions. | | Internet Access and Equinix Connect | Allows the user to view their Equinix Internet Access and Equinix Connect traffic and network behavior. | | Smart View | Allows the user to order Equinix Smart View for IBXs, and view Smart View data. | | Remote Network Products | Allows the user to order remote network products for IBXs in a specific region. | | Crisis Contact Management | Allows the user to receive notifications for IBX-related crisis events. | | Power Consumption Report | Allows the user to run the Power Consumption Report. | | Data Center Infrastructure Management APIs | Allows the user to access and use DCIM APIs. |