Permissions

The Group Permission section of the portal allows you to customize the permissions that users within an assigned group have. Because users can be a part of multiple groups, their permissions are based on the highest allowable permission granted to them.

For example, if a user is in Group A with Read, Write, and Create permissions, and in Group B with only Read permission, that user will maintain Read, Write, and Create permissions across the portal even though their Group B permissions are only for Read access.

The three system-created Default groups cannot have their permissions changed, not even by an account Administrator.

Access the Permissions Configuration

1. Select Accounts from the left-hand navigation menu.
2. Select the account name.
3. Select the Groups tab.
4. Select a group name from the list. 
5. Select View Permissions.
6. Use the slider bar to increase or decrease the permissions for a specific Type, and then click Save when you are done setting the permission level.
7. You can also use the Inherit check box option to apply the settings from a higher tier to a lower tier from the Type column.
   1. For example, apply Read Write Create to the Domain type (click Save), and then click Inherit next to Resource Records. The permissions from the Domains will apply to the Resource Records, and then trickle down to each subsequent type that is also set to Inherit.
8. Click Save when you are done applying permissions.

The following are the different permission levels you can apply (permission types cannot be customized):

• Read
• Read Write
• Read Write Create
• Read Write Create Delete
• Read Write Create Grant
  • Reports can have either None or Read.
  • Reports permission cannot be configured for Custom groups.
  • The Grant permission type cannot be configured for Custom groups. It is restricted to only the Owner and Administrative groups.

The Domain Services and Domain configurations control most of the same functions and behavior. The main difference is that the Domain configuration provides more granular control over the various records and pools, especially when configuring the Inherit setting. Some features controlled by Domain Services/Domain include enabling DNSSEC for a domain, configuring Zone Transfer Settings, and the ability to create or edit pools and records within a domain.

The following system-default groups cannot have their permissions changed:

• Administrative - Users will have access to all account functions, including being able to change the Primary user for the account. The Primary user and Administrative users are the only users who can invite new users to the account.
• Reporting - Users will have Read-only access for the entire account, meaning they cannot edit any account-level or domain-level details.
• Technical - Users will have access to all account functions except for the following:
  • Cannot add new users.
  • Cannot move users to and from groups.
  • Cannot change any of the Account Notification Settings.
  • Cannot access Account-level Zone Transfer Settings.
  • Cannot initiate a DNS Health Check.

Multi-Level Account Groups and Permissions

Permissions and access for users associated with a Multi-Level Account will differ from those listed above. A key difference is that users who are assigned to the Technical Group in a Sub Account will only have basic reporting access, and will have limited access to various features on the portal (they will not be able to view several of the features on the Accounts.