---
title: Kibana privileges
description: Kibana privileges grant users access to features within Kibana. Roles have privileges to determine whether users have write or read access. To learn how...
url: https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges
products:
- Elastic Documentation
- Kibana
applies_to:
- Elastic Stack: Generally available
---
# Kibana privileges
Kibana privileges grant users access to features within Kibana. Roles have privileges to determine whether users have write or read access.
To learn how to assign privileges to a role, refer to [Defining roles](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles).
## Base privileges
Assigning a base privilege applies the same access level across all feature groups instead of setting a level for each feature.
Some features and sub-feature privileges are excluded from base privileges and must be granted individually.
- **All**: Grants full read-write access.
- **Read**: Grants read-only access.
- **Customize**: Allows you to set the access level for each feature separately.
### Assigning base privileges
From the role management screen:
Using the [role APIs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-roles):
```js
PUT /api/security/role/my_kibana_role
{
"elasticsearch": {
"cluster" : [ ],
"indices" : [ ]
},
"kibana": [
{
"base": ["all"],
"feature": {},
"spaces": ["marketing"]
}
]
}
```
## Feature privileges
Assigning a feature privilege grants access to a specific feature. For each feature, select the type of access you want to allow:
- **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
- **Read**: Users can view the feature, but can't perform any actions or manage configuration.
- **None**: Users can't access or view the feature.
Some features don't have a **Read** privilege.
In role management, features are organized into the following groups.
| Group | What it contains |
|--------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Analytics** | Privileges for the features you use to explore and visualize data. Refer to [Privileges in the Analytics group](#kibana-privileges-analytics). |
| **Alerting V2** Elastic Stack: Experimental since 9.5 | Privileges for the experimental alerting system. Refer to [Configure access to the experimental alerting system](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/alerting/experimental-alerting-system/get-started/configure-access). Elastic Stack: Experimental in 9.5 Before 9.5.4, this group is called **Alerting**. |
| **Elasticsearch** | Privileges for Elasticsearch features. |
| **Observability** | Privileges for Elastic Observability features. Refer to [Observability Kibana privileges](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/get-started/observability-kibana-privileges). |
| **Security** | Privileges for Elastic Security features. Refer to [Security Kibana privileges](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/security/manage/security-kibana-privileges). |
| **Management** | Privileges for the features you use to administer Kibana and your data. Refer to [Privileges in the Management group](#kibana-privileges-management). |
### Sub-feature privileges
Some features allow for finer access control than the **All** and **Read** privileges. This additional level of control is a [subscription feature](https://www.elastic.co/subscriptions).
### Assigning feature privileges
From the role management screen:
Using the [role APIs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-roles):
```js
PUT /api/security/role/my_kibana_role
{
"elasticsearch": {
"cluster" : [ ],
"indices" : [ ]
},
"kibana": [
{
"base": [],
"feature": {
"visualize_v2": ["all"],
"dashboard_v2": ["read", "url_create"]
},
"spaces": ["marketing"]
}
]
}
```
## Privileges in the Analytics group
Each of the following privileges controls access to a different feature.
| Privilege | What it allows |
|-------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Discover** | Access [Discover](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/discover), and save and manage Discover sessions. Turn on **Customize sub-feature privileges** to grant individual Discover privileges. For the full list, refer to [Discover sub-feature privileges](#kibana-privileges-discover-subfeatures). |
| **Dashboard** | Access [dashboards](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/dashboards), and create and edit them. To add new visualizations or maps to a dashboard, users also need the **Visualize library** or **Maps** privilege. Turn on **Customize sub-feature privileges** to grant individual dashboard privileges. For the full list, refer to [Dashboard sub-feature privileges](#kibana-privileges-dashboard-subfeatures). |
| **Canvas** | Access [Canvas](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/visualize/canvas), and create and edit workpads. Turn on **Customize sub-feature privileges** to grant the reporting privilege. For details, refer to [Canvas sub-feature privileges](#kibana-privileges-canvas-subfeatures). |
| **Maps** | Access [Maps](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/visualize/maps), create and edit maps, and add maps to dashboards. |
| **Machine Learning** | Access [machine learning](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/machine-learning), and create and manage jobs and trained models. This privilege grants the same access level to data views, dashboards, Discover sessions, and visualizations. |
| **Graph** | Access [Graph](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/visualize/graph), and create and edit graphs. |
| **Visualize library** | Access the [Visualize library](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/visualize), create and edit visualizations, and add visualizations to dashboards. Turn on **Customize sub-feature privileges** to grant individual Visualize library privileges. For the full list, refer to [Visualize library sub-feature privileges](#kibana-privileges-visualize-subfeatures). |
| **Agent Builder** Elastic Stack: Generally available since 9.2 | Access [Elastic Agent Builder](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/ai-features/elastic-agent-builder), including agents, tools, and conversations. Elastic Stack: Generally available since 9.4 Turn on **Customize sub-feature privileges** to grant individual Elastic Agent Builder privileges. For the full list, refer to [Elastic Agent Builder permissions](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/ai-features/agent-builder/permissions). |
| **Agent Builder - Semantic Metadata Layer (SML)** Elastic Stack: Generally available since 9.5 | Access the semantic metadata that Elastic Agent Builder uses to interpret your data. Elastic Stack: Generally available in 9.5 This privilege is called **Agent Context Layer**. |
| **Workflows** Elastic Stack: Generally available since 9.3 | Access [Workflows](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/workflows), and create, edit, and run workflows. Turn on **Customize sub-feature privileges** to grant individual workflow privileges. For the full list, refer to [Workflows sub-feature privileges](#kibana-privileges-workflows-subfeatures). |
### Discover sub-feature privileges
These privileges control specific actions in Discover. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Create Short URLs** | Create short URLs for Discover sessions, so that they can be shared. |
| **Store Background search** | Save the results of a long-running search, so that they can be viewed again without rerunning the search. Elastic Stack: Generally available from 9.0 to 9.1 This privilege is called **Store Search Sessions**. |
| **Generate CSV reports** | Export the results of a Discover session as a CSV file. |
### Dashboard sub-feature privileges
These privileges control specific actions on dashboards. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Create Short URLs** | Create short URLs for dashboards, so that they can be shared. |
| **Store Background search** | Save the results of a long-running search, so that they can be viewed again without rerunning the search. Elastic Stack: Generally available from 9.0 to 9.1 This privilege is called **Store Search Sessions**. |
| **Generate PDF or PNG reports** | Export a dashboard as a PDF or PNG file. |
| **Generate CSV reports from Discover session panels** | Export the data behind a Discover session panel as a CSV file. |
### Canvas sub-feature privileges
This privilege controls a specific action in Canvas. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|--------------------------|---------------------------------|
| **Generate PDF reports** | Export a workpad as a PDF file. |
### Visualize library sub-feature privileges
These privileges control specific actions in the Visualize library. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|---------------------------------|-------------------------------------------------------------------|
| **Create Short URLs** | Create short URLs for visualizations, so that they can be shared. |
| **Generate PDF or PNG reports** | Export a visualization as a PDF or PNG file. |
### Workflows sub-feature privileges
- Elastic Stack: Generally available since 9.3
These privileges control specific actions on workflows. Selecting **All** includes every privilege in the following table except **Update managed workflows**, which you grant separately.
| Privilege | What it allows |
|-----------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
| **Create** | Create workflows. |
| **Update** | Edit existing workflows. |
| **Delete** | Delete workflows. |
| **Execute** | Run workflows. |
| **Read** | View workflows. |
| **Read Workflow Execution** | View the results of a workflow run, including its logs. |
| **Cancel Workflow Execution** | Stop a workflow that's currently running. |
| **Read managed workflows** Elastic Stack: Generally available since 9.5 | View the workflows that Elastic provides. |
| **Read managed workflow execution** Elastic Stack: Generally available since 9.5 | View the results of a managed workflow run. |
| **Update managed workflows** Elastic Stack: Generally available since 9.5 | Edit the workflows that Elastic provides. |
## Privileges in the Management group
Each of the following privileges controls access to a different feature.
| Privilege | What it allows |
|----------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Streams** Elastic Stack: Generally available since 9.1 | Access [Streams](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/streams/streams), and change stream processing, retention, and routing. Elastic Stack: Generally available in 9.1 This privilege is in the **Observability** group. |
| **AI Anonymization** Elastic Stack: Generally available since 9.4 | Change the anonymization rules that control which field values are masked before they're sent to a large language model. |
| **Dev Tools** | Access [Console](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/query-filter/tools/console), Search Profiler, and Grok Debugger. Users also need the matching Elasticsearch cluster and index privileges for the requests they run. |
| **Advanced Settings** | Change the settings that control how Kibana behaves in a space, such as the default index pattern and date format. |
| **Data View Management** | Create and edit [data views](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/find-and-organize/data-views). |
| **Files Management** | Manage the files that other features store in Kibana. |
| **Shared images** | Upload and manage the images that other features reuse, such as dashboard panel images. |
| **Saved Objects Management** | Manage [saved objects](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/find-and-organize/saved-objects), including importing, exporting, and copying them between spaces. |
| **Saved Query Management** | Save and manage [queries](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/query-filter/tools/saved-queries) across all features that use them. |
| **Tag Management** | Create and edit [tags](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/find-and-organize/tags), and apply them to saved objects. |
| **Stack Rules** | Create and manage [Elastic Stack rules](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/alerting), such as index threshold and Elasticsearch query rules. |
| **Stack Alerts** Elastic Stack: Generally available since 9.5 | View and manage the alerts that Elastic Stack rules generate, without granting access to the rules themselves. |
| **Osquery** | Access [Osquery](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/security/investigate/osquery), and run and save queries. Turn on **Customize sub-feature privileges** to grant individual Osquery privileges. For the full list, refer to [Osquery sub-feature privileges](#kibana-privileges-osquery-subfeatures). |
| **Actions and Connectors** | Create and manage [connectors](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/manage-connectors), and run the actions that rules and cases trigger. Turn on **Customize sub-feature privileges** to grant the endpoint security privilege. For details, refer to [Actions and Connectors sub-feature privileges](#kibana-privileges-actions-subfeatures). |
| **Cases** | Access [cases](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/cases), and create and edit them. Turn on **Customize sub-feature privileges** to grant individual case privileges. For the full list, refer to [Customize sub-feature privileges for cases](/elastic/docs-builder/docs/4493/explore-analyze/cases/control-case-access#cases-sub-feature-privileges). |
| **Inference Endpoints** | Create and manage [inference endpoints](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/elastic-inference/inference-api). Elastic Stack: Generally available from 9.0 to 9.3 This privilege is in the **Elasticsearch** group. |
| **Cloud Connect** Elastic Stack: Generally available since 9.3 | Connect a cluster to Elastic Cloud services. This privilege appears on Elastic Cloud Enterprise and self-managed clusters, but not on Elastic Cloud Hosted. |
| **Automatic Import** Elastic Stack: Generally available since 9.4 | Access [Automatic Import](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/security/get-started/automatic-import), and create custom integrations from sample data. |
| **Data Set Quality** | Access the [Data Set Quality](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/data-set-quality-monitoring) page. Turn on **Customize sub-feature privileges** to grant individual data set quality privileges. For the full list, refer to [Data Set Quality sub-feature privileges](#kibana-privileges-data-set-quality-subfeatures). |
| **Fleet** | Access [Fleet](https://www.elastic.co/elastic/docs-builder/docs/4493/reference/fleet), and manage agents and agent policies. Turn on **Customize sub-feature privileges** to grant individual Fleet privileges. For the full list, refer to [Fleet privileges and available actions](/elastic/docs-builder/docs/4493/reference/fleet/fleet-roles-privileges#fleet-roles-and-privileges-sub-features-table). |
| **Integrations** | Browse and install [integrations](https://www.elastic.co/elastic/docs-builder/docs/4493/reference/fleet). |
| **Maintenance Windows** | Create and manage [maintenance windows](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/alerting/alerts/maintenance-windows), which suppress rule notifications for a scheduled period. |
| **Manage Scheduled Reports** Elastic Stack: Generally available since 9.1 | View and manage the [scheduled reports](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/report-and-share/automating-report-generation) of every user in the space. |
| **Query activity** Elastic Stack: Generally available since 9.4 | Access [Query activity](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/monitor/query-activity), and cancel long-running queries. |
| **Rules Settings** | Change the settings that apply to all rules in a space. Turn on **Customize sub-feature privileges** to grant individual rule settings privileges. For the full list, refer to [Rules Settings sub-feature privileges](#kibana-privileges-rules-settings-subfeatures). |
| **Stack Monitoring** | Access [Elastic Stack monitoring](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/monitor/stack-monitoring). This privilege has no access levels to select: to grant access, assign the `monitoring_user` role. |
| **AI Assistant** Elastic Stack: Removed in 9.3 | Change which AI Assistants are available, from the AI Assistant settings in Elastic Stack Management. Elastic Stack: Generally available in 9.2 This privilege is called **AI Assistant Settings**. |
| **Setup guides** Elastic Stack: Removed in 9.2 | Access the getting-started page that helps you ingest data and start using Search, Observability, or Security. |
| **Entity Manager** Elastic Stack: Removed in 9.1 | Access the Elastic Entity Model of hosts, containers, and services in Observability. |
### Osquery sub-feature privileges
These privileges control specific parts of Osquery. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Live queries** | Run live queries against hosts, and view the results. **Read** allows viewing the results of queries that other users ran. Select **Run Saved queries** within this privilege to also allow running saved queries without being able to change them. |
| **Saved queries** | Create, edit, and delete saved queries. |
| **Packs** | Create, edit, and delete query packs, and schedule them to run against agent policies. |
### Actions and Connectors sub-feature privileges
This privilege controls a specific action on connectors. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|-------------|--------------------------------------------------------------------------------------------------------------------|
| **Execute** | Run the endpoint security connectors, which include SentinelOne, CrowdStrike, and Microsoft Defender for Endpoint. |
### Data Set Quality sub-feature privileges
- Elastic Stack: Generally available since 9.1
These privileges control specific actions on the **Data Set Quality** page. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|-------------------|-------------------------------------------------------------|
| **Manage rules** | Create and edit the rules that alert on degraded documents. |
| **Manage alerts** | View and manage the alerts that those rules generate. |
### Rules Settings sub-feature privileges
These privileges control the settings that apply to all rules in a space. Selecting **All** includes everything in the following table.
| Privilege | What it allows |
|------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|
| **Flapping detection** | Change the settings that control when an alert is treated as flapping between states. |
| **Alert deletion** Elastic Stack: Generally available since 9.1 | Change how long alerts are kept before they're deleted, and delete them on demand. |