Manage Users & Roles

To manage user access to your Cohesity Cloud Protection Service, we recommend that you add users and groups. Once you create them, your users can start using your Cohesity Cloud Protection Service with their own logins.

Add Users

To add a user:

In Cloud Protection Service, navigate to Settings > Access Management and click the Users tab.
Click Add User.

Only the user with Admin privileges will be able to add a new user.
In the dialog, select Add User and enter:
- Username. The user's email address.
- Email Address. The user's email address again.
- First Name. The user's first name in Cohesity Cloud Protection Service.
- Last Name. Typically, the domain of your email address.
Under Roles and Access, assign an appropriate Role to this user. See Roles for more information.
Click Save.

The new user receives a welcome email with a link to reset their password, and appears in the list on the Users tab. From there, you can edit or delete the user, or prompt them to reset their password.

Manage Users

To change a user's settings, click the Actions menu (⋮) next to the user and select:

Edit. To update their Email Address, First Name, and/or Last Name.
Delete. To delete the user from your Cloud Protection Service.
Reset Password. To send the user an email with a link to reset their password.

Change Password

To change your Cloud Protection Service password:

In Cloud Protection Service, navigate to Settings > Access Management and click the user to open the User Details page.
Click Reset Password and follow the prompts.

Add SSO Users & Groups

If you have added Single Sign-on (SSO) toCloud Protection Service, you can add users and groups from your SSO domain for additional user management.

To add SSO users and groups:

In Cloud Protection Service, navigate to Settings > Access Management.
Click Add User on the Users tab.
In the dialog, select Add SSO Users & Groups and enter:
- SSO Domain. The domain you used to add SSO.
- SSO Users. The users in your SSO domain who need access to Cloud Protection Service.
- SSO Groups. The groups in your SSO domain who need access Cloud Protection Service.
Click Save.

The new SSO users and groups you entered appear in the list on the Users tab. To group them, click the Domain column sort them by your SSO domain.

Click the Actions menu (⋮) next to the SSO user or group to Edit or Delete them.

Roles

The following table lists the default roles available in Cloud Protection Service.

Roles	Description
Cohesity Support Admin	This role allows Cohesity Support to create a Super Admin user for the customer. Only Cohesity Support has access to this role, and it is typically used when the customer has lost access to a Super Admin user due to turnover and other events.
DR Admin	DR Admin users have Viewer role privileges and can also create and manage DR related workflows and associated tasks.
Gaia Admin	Gaia Admin users have Self Service Gaia role privileges and can view and manage details and results.
Gaia Viewer	Gaia Viewer users have query and read-only access to Gaia.
Helios platform	Helios Platform users have access management and helios access management privileges.
Data Security	Data Security users have Self Service Data Protection role privileges and can create DataLock Views and set DataLock expiration dates. Data Security user does not have the delete option. Change the user role to delete that particular user.
High Classified	User who has High classified role can fetch cluster details needed for specific API calls.
Operator	Operator users have Viewer role privileges and can run existing Protection Groups and create Recover Tasks.
Replication	Replication users have access to setup and replicate data to another cluster.

The combination of any custom role with Admin or Super Admin is supported. As a result, you can select a custom role along with Admin or Super Admin for a user. For example, you can create a custom role with Manage gflag privilege and select this custom role along with Admin or Super Admin to allow that user to manage Gflag and other administrative operations on a Cohesity cluster. However, you cannot combine a default role such as Viewer with the Admin or Super Admin role for a user.

Custom Roles and Privileges

You can select Add Custom Role to create a new role and define a specific set of privileges.

To create a custom role:

Navigate to Settings > Access Management.
Select Roles tab.
Click Add Custom Role drop-down menu and select DataProtect Role.

Select NetBackup Role to create a custom NetBackup role.
Enter a name for the role in Name column. Role names cannot be edited after you create them.

Only letters, numbers, spaces and the special characters . - _ are allowed.
You can optionally provide a description for the role in Description column.
Set the role's privileges by using the toggles and check boxes. For a description of the privileges, see Privileges.

In the Add Role screen, hover your mouse over the privilege name to display its description in a pop-up tooltip.

Privileges

The privileges for all workflows are described below.

Access Management Privileges

Workflow	Privileges	Description
Access Management	View Users	Allows viewing users, groups and other access control information.
	Manage Users	Allows modifying users, groups and other access control information. If the user's access is restricted to specific Objects, then this privilege is not granted, even if the role grants it.
	View API Key	Allow user to view other users' API Keys.
	Manage API Key	Allow user to modify other users' API Keys.
	Manage S3 Keys	Allow user to manage and view other users' S3 keys.
Cloud Protection Service Access Management	Manage super admins on Helios	Allows the user to manage super admins on Helios.
	View super admins on Helios	Allows the user to view super admins on Helios.
	Manage admins on Helios	Allows the user to manage admins on Helios.
	View admins on Helios	Allows the user to view admins on Helios.
	Manage Helios MFA	Allow users to modify Helios level MFA settings.
	View Audit Logs	Allows the user to view audit logs and related settings.
	Manage Audit Logs	Allows the user to manage audit log settings.
	View Access Scopes	Allows the user to view access scopes in Helios.
	Manage Access Scopes	Allows the user to manage access scopes in Helios.
	Manage Session Management	Allows the user to view and modify session management configuration in Helios.

Helios Privileges

Workflow	Privileges	Description
DataProtect Service	Search Objects	Allows the user to perform search of objects.
	Configure Regions	Allows the user to configure regions in Helios Data Protect.
	Manage Tags	Allows the user to manage tags.
Account Management on Helios	View Account properties on Helios	Allows viewing Account properties on Helios.
Account Management on Helios	Manage Account properties on Helios	Allows managing Account properties on Helios.
FortKnox Service	Helios FortKnox vault provision permission	Allows the user to modify vaults in Helios FortKnox service.
Gaia Service	View Gaia	Allows the user to view Gaia details and results.
Gaia Service	Manage Gaia	Allows the user to manage Gaia details and results.
DataHawk Services	View Rules	Allows the user to view rules.
	Manage Rules	Allows the user to manage rules.
	View Threat Scan	Allows users to view threat scan.
	Manage Threat Scan	Allows users to manage threat scan.
	Download Threat Scan Summary Report	Allows users to download threat scan summary report.
	Integrate Third Party Threat Intelligence Feed	Allows users to integrate third party threat intelligence feed.
	Manage Custom YARA Rules	Allows users to manage custom YARA rules.
	View Data Classification Scan	Allows users to view data classification scan.
	Manage Data Classification Scan	Allows users to manage data classification scan.
	Download Data Classification Scan Summary Report	Allows users to download data classification scan summary report.
	Manage Data Classification Policy	Allows users to manage data classification policy.
	Manage Cluster Scanning Order	Allows users to manage cluster scanning order.
	View Isolated Recovery Room	Allows the user to view isolated recovery room.
	Manage Isolated Recovery Room	Allows the user to manage isolated recovery room.
	View Isolated Recovery Plan	Allows the user to view isolated recovery plan.
	Manage Isolated Recovery Plan	Allows the user to manage isolated recovery plan.
AntiRansomware Service	View AntiRansomware Rules	Allows users to view anti ransomware rules.
AntiRansomware Service	Manage AntiRansomware Rules	Allow users to manage anti ransomware rules.
SiteContinuity Service	View SiteContinuity	Allows the user to view site continuity details and results.
SiteContinuity Service	Manage SiteContinuity	Allows the user to manage site continuity details and results.

Multi-Cluster Privileges

Workflow	Privileges	Description
Security Integration	View Security Integrations	Allows the user to view security integrations.
Security Integration	Manage Security Integrations	Allows the user to modify Security Integrations.
FortKnox Self-Managed Service	FortKnox Self-Managed Vault provision permission	Allows the user to modify vaults in FortKnox Self-Managed service.
Multi Cluster Management	Register clusters	Allows the users to register clusters.
	Unregister clusters	Allows the users to unregister clusters.
	Multi cluster upgrade	Allows the user to perform multi cluster upgrade.
	View Backup Configurations on Helios	Allows viewing backup Configurations and runs on Helios.
	Manage Backup Configurations on Helios	Allows managing backup Configurations and runs on Helios.
	View Cluster Configuration Backups	Allows the user to view Cluster Configuration Backups.
	Modify Cluster Configuration Backups	Allows the user to modify Cluster Configuration Backups.
	View Cluster Configuration Restores	Allows the user to view Cluster Configuration Restores.
	Modify Cluster Configuration Restores	Allows the user to modify Cluster Configuration Restores.
Helios Simulator	View simulations	Allows the user to view simulations' details and results.
Helios Simulator	Create and run simulations	Allows the user to create, modify, run and delete simulations.
Cluster Management	Manage Gflags	Allows the user to manage gflags through recipes.
Snapshot Tagging	Enable or disable snapshot tagging feature	Allows the user to manage snapshot tagging feature, tag and untag snapshots.
Snapshot Tagging	Restore from tagged snapshots	Allows the user to restore from snapshots tagged due to anomaly data ingest.
Quorum	View Quorum Groups	Allows the user to view quorum groups and their details.
Quorum	Create Quorum Groups	Allows the user to create and modify quorum groups.
Posture Advisor Service	View Posture Advisor	Allow users to view posture advisor.
Posture Advisor Service	Manage Posture Advisor	Allow users to manage posture advisor.
Helios Alerts Service	View Alert Resolution, Notification and Silencing on Helios	Allows the user to view alert resolutions, notification rules and silence rules on Helios.
Helios Alerts Service	Manage Alert Resolution, Notification and Silencing on Helios	Allows the user to resolve alerts and manage notification/silence rules on Helios.
RecoveryAgent	View Recovery Groups	Allows the user to view RecoveryAgent recovery groups.
	Manage Recovery Groups	Allows the user to create, edit, delete, and execute RecoveryAgent recovery groups.
	View Blueprints	Allows the user to view RecoveryAgent blueprints.
	Manage Blueprints	Allows the user to create, edit, delete, and execute RecoveryAgent blueprints.
	Restore Infected Workloads	Allows the user to restore workloads flagged as infected during threat scans.
	View Automation Hosts	Allows the user to view Automation Host configurations.
	Manage Automation Hosts	Allows the user to configure, manage, and execute scripts on Automation Hosts.

Local-Cluster Privileges

Workflow	Privileges	Description
Apps	Launch Apps Instances	Allows viewing apps, instances and app management information. For an app instance, access is restricted to the user who launched the app instance.
Apps	Manage Apps and Instances	Allows install, uninstall and launch of the app, and pause, resume and stop of the app instance. User specific restrictions of app instance do not apply.
Organization Management	View Organizations	Allows viewing organizations registered on the cluster.
	Manage Organizations	Allows managing organizations registered on the cluster.
	Switch Organization	Allows to switch to an organization's perspective and perform actions on their behalf.
Clone Management	View Clone Tasks	Allows the user to view Clone tasks.
Clone Management	Manage Clone Tasks	Allows the user to create, modify and delete Clone tasks.
Free Node Management	View Free Nodes	Allows the user see information about free nodes.
Cluster Management	View Cluster Details	Allows the user to view Cluster settings. The user cannot make changes.
	Manage Cluster	Allows the user to modify Cluster setup and to add and remove Nodes.
	Cluster Support	Allows the user to perform support related operations such as collecting data and browsing logs.
	Upgrade Cluster	Allows the user to upgrade and patch the Cluster.
	Manage Patches	This privilege allows a User to apply or revert patches to the Cluster.
	View Remote Clusters	Allows the user to view the Remote Clusters for remote access or replication.
	Manage Remote Clusters	Allows the user to register and modify Remote Clusters for replication.
	View External Targets	Allows the user to view External Targets for archival.
	Manage External Targets	Allows the user to register and modify External Targets for archival.
	View Audit Logs	Allows the user to view the Audit Logs.
	View Alert Details	Allows the user to view alerts. The user cannot make changes.
	Manage Alerts	Allows the user to resolve alerts and manage email addresses where alert notifications should be received.
	View VLANs	Allows the user to view available VLANs.
	Manage VLANs	Allows the user to modify VLANs.
	View Bifrost VLANs	Allows the user to view available Bifrost VLANs.
	View data-source connections	Allows a user to view data-source connections.
	Modify data-source connections	Allows a user to create or modify data-source connections.
	View data-source connectors	Allows a user to view data-source connectors.
	Modify data-source connectors	Allows a user to create or modify data-source connectors.
	Modify Bifrost VLANs	Allows the user to modify available Bifrost VLANs.
	View Bifrost Connections	Allows a user to have view-only access to the available Bifrost Connections.
	Modify Bifrost Connections	Allows a user to create or modify Bifrost Connections.
	View Hybrid Extender Details	Allows the user to view the Hybrid Extender details.
	Download Hybrid Extender	Allows the user to download Hybrid Extender VM or configuration file.
	View AD and LDAP Details	Allows the user to view active directory and LDAP providers. The user cannot make changes.
	Manage AD and LDAP	Allows the user to manage active directory and LDAP providers on the cluster.
	View report schedules	Allows the user to view report schedules on cluster. The user cannot make changes.
	Manage report schedules	Allows the user to manage report schedules on the cluster.
	View NIS	Allows the user to view NIS providers on the cluster.
	Manage NIS	Allows the user to manage NIS providers on the cluster.
	View KERBEROS	Allows the user to view registered Kerberos providers on the cluster.
	Manage KERBEROS	Allows the user to manage registered Kerberos providers on the cluster.
	View S3 ABAC Details	Allows the user to view S3 ABAC configuration. The user cannot make changes.
	Manage S3 ABAC	Allows the user to manage S3 ABAC configuration on the cluster.
	View Account Security	Allows the user to view Account Security settings on the cluster.
	Manage Account Security	Allows the user to modify Account Security settings on the cluster.
	View Tags	Allows the user to view tags on the cluster.
	Modify Tags	Allows the user to create/ modify tags on the cluster.
	Manage Tags	Allows the user to apply/ remove tags on the cluster.
	Manage Support Channel	Allows the user to modify Support Channel settings on the cluster.
	Manage Linux user sudo access	Allows the user to grant linux user to bash shell access.
	Allow access to Cohesity UI	Allows the user to access Cohesity cluster through UI.
	Manage MFA	Allow users to modify cluster level MFA settings.
	Manage Helios	Manage connection to Helios.
	View Keystone Details	Allows the user to view Keystone configuration. The user cannot make changes.
	Manage Keystone	Allows the user to manage Keystone configuration on the cluster.
Data Protection	View Protection Groups	Allows the user to view Protection Groups, Protection Sources and Protection Group runs. The user cannot make any changes.
	Manage Protection Groups	Allows the user to create, modify and delete Protection Groups as well as the ability to delete runs.
	Delete snapshots	Allows user to delete snapshots.
	Protection Group Operator	Allows the user to run, cancel or pause a Protection Group.
	Manage Sources	Allows the user to register or delete a Protection Source and modify its information. If the user's access is restricted to specific Objects, then this privilege is not granted, even if the role grants it.
	View Protection Policies	Allows the user to view Protection Policies. The user cannot make any changes.
	Manage Protection Policies	Allows the user to create, modify and delete Protection Policies.
	View agent upgrade tasks	This privilege allows a user to view agent upgrade tasks.
	Create or modify agent upgrade tasks	This privilege allows a user to modify and create upgrade tasks.
	Search objects	Allows the user to perform search of objects from sources registered on the cluster.
	Manage agents	Allows the user to deploy and register the Cohesity agent on servers.
	View Runbooks	Allows the user to list and view the created Runbooks.
	Execute Runbooks	Allows the user to execute Runbooks.
	Manage Runbooks	Allows the user to create, modify, remove and execute Runbooks.
Recovery Management	View Recover Tasks	Allows the user to view Recover and Clone Tasks. The user cannot make any changes.
	Manage Recover Tasks	Allows the user to create Recover Tasks.
	Download File	Allows the user to download files. The user also needs the 'Manage Recover Tasks' privilege to download files.
	Recover from External Targets	Allows the user to search External Targets and recover using data archived from a Remote Cluster.
Storage Management	Read Cohesity Views	Allows the user to view Cohesity Views.
	Manage Cohesity Views	Allows the user to create, modify and delete Cohesity Views.
	Read Cohesity Storage Domains	Allows the user to view Cohesity Storage Domains.
	Manage Cohesity Storage Domains	Allows the user to create and modify Cohesity Storage Domains.
Analytics Management	View Analytics Workbench	Allows the user to view Analytics Workbench related entities.
	Manage Analytics Workbench	Allows the user to modify Analytics Workbench related entities.
	Reporting	Allows the user to generate and view reports.
Source Access Control	Data Security	Allows the user to lock a View and set its lock expiration date.
Source Access Control	Manage Enterprise File DataLock	Allows the user to decrease the Enterprise File DataLock expiration period and to delete a view with Enterprise File DataLock configured.
SMB Security	SMB Backup	This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
	SMB Restore	This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file.
	Take ownership of SMB files	This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
	Manage system access control list on SMB files	Required to perform a number of security-related functions, such as controlling and viewing audit messages. This privilege identifies its holder as a security operator.
Source Management	Manage VMware Standalone Hosts	This privilege allows a User to manage VMware Standalone Hosts.
	Manage VMware VCenters	This privilege allows a User to manage all VMware VCenters.
	Manage VMware VCloudDirector	This privilege allows a User to manage VMware VCloudDirector.
	Manage HyperV SCVMM Servers	This privilege allows a User to manage HyperV SCVMM Servers.
	Manage HyperV Standalone Hosts	This privilege allows a User to manage HyperV Standalone Hosts.
	Manage HyperV Failover Clusters	This privilege allows a User to manage HyperV Failover Clusters.
	Manage Acropolis Standalone Clusters	This privilege allows a User to manage Acropolis Standalone Clusters.
	Manage Acropolis Generic Standalone Clusters	This privilege allows a User to manage Acropolis Generic Standalone Clusters.
	Manage GCP IAM users	This privilege allows a User to manage GCP IAM users.
	Manage AWS IAM users	This privilege allows a User to manage AWS IAM Users.
	Manage Azure Subscriptions	This privilege allows a User to manage Azure Subscriptions.
	Manage KVM OVirtualManager Sources	This privilege allows a User to manage KVM OVirtualManager Sources.
	Manage Physical Servers	This privilege allows a User to manage Physical Servers.
	Manage Office365 Domains	This privilege allows a User to manage Office365 Domains.
	Manage SQL Servers	This privilege allows a User to manage SQL Servers.
	Manage Oracle Servers	This privilege allows a User to manage Oracle Servers.
	Manage Pure Storage Arrays	This privilege allows a User to manage Pure Storage Arrays.
	Manage Nimble Storage Arrays	This privilege allows a User to manage Nimble Storage Arrays.
	Manage Hyperflex Servers	This privilege allows a User to manage Hyperflex Servers.
	Manage Active Directory Servers	This privilege allows a User to manage Active Directory Servers.
	Manage Isilon Clusters	This privilege allows a User to manage Isilon Clusters.
	Manage NetApp Clusters	This privilege allows a User to manage NetApp Clusters.
	Manage NetApp VServers	This privilege allows a User to manage NetApp VServers.
	Manage Generic NAS hosts	This privilege allows a User to manage Generic NAS hosts.
	Manage Pure Flashblade Storage Arrays	This privilege allows a User to manage Pure Flashblade Storage Arrays.
	Manage GPFS Cluster	This privilege allows a User to manage GPFS Cluster.
	Manage Elastifile Clusters	This privilege allows a User to manage Elastifile Clusters.
	Manage Exchange Servers	This privilege allows a User to manage Exchange Servers.
	Manage Cassandra Clusters	This privilege allows a User to manage Cassandra Clusters.
	Manage MongoDB Clusters	This privilege allows a User to manage MongoDB Clusters.
	Manage Couchbase Clusters	This privilege allows a User to manage Couchbase Clusters.
	Manage HDFS Sources	This privilege allows a User to manage HDFS sources of Hadoop Clusters.
	Manage HBASE Sources	This privilege allows a User to manage HBASE sources of Hadoop Clusters.
	Manage HIVE Sources	This privilege allows a User to manage HIVE sources of Hadoop Clusters.
	Manage Kubernetes Sources	This privilege allows a User to manage Kubernetes sources.
	Manage Universal Data Adapter Sources	This privilege allows a User to manage Universal Data Adapter sources.
	Manage SAP HANA Sources	This privilege allows a User to manage SAP HANA sources.
	Manage SFDC Adapter Sources	This privilege allows a User to manage SFDC Adapter sources.
Highly Classified	High Classified	User who has High classified privilege can fetch cluster details needed for specific API calls.

Baas Documentation