---
title: Observability Kibana privileges
description: Lists Kibana privileges in the Observability group of Assign role to spaces, with privilege levels and links to sub-feature catalogs.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/get-started/observability-kibana-privileges
products:
- Elastic Cloud Serverless
- Elastic Documentation
- Elastic Observability
applies_to:
- Serverless Observability projects: Generally available
- Elastic Stack: Generally available
---
# Observability Kibana privileges
Roles control what users can access and what actions they can perform. When you create or edit a role, you grant it [Kibana privileges](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges), which give access to individual features within one or more spaces.
When you add Kibana privileges to a role, the **Assign role to spaces** flyout opens. Access to Observability features is controlled by the privileges in the **Observability** group, described on this page.
For more details on creating a role, refer to [Role management using Kibana](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for Elastic Stack, or to [Serverless project custom roles](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/users-roles/serverless-custom-roles) for Serverless.
Kibana feature privileges do not grant Elasticsearch cluster or index privileges. Users still need the matching index privileges for the data they query.
## Access levels
For each of the feature privileges, select the type of access you want to allow:
- **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
- **Read**: Users can view the feature, but can't perform any actions or manage configuration.
- **None**: Users can't access or view the feature.
Some features don't have a **Read** privilege.
## Privileges in the Observability group
Each of the following privileges controls access to a different part of Observability.
| Privilege | What it allows |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Logs** | Access [Logs](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/logs) and related apps, including Logs Explorer. Create and manage logs alert rules and alerts. |
| **Infrastructure** | Access [Infrastructure](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics) and related metrics apps. Create and manage infrastructure alert rules and alerts. |
| **APM and User Experience** | Access [Applications (APM)](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/apm) and [User Experience](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/applications/user-experience). Create and manage APM alert rules and alerts. Turn on **Customize sub-feature privileges** to grant individual privileges. Refer to [APM and User Experience sub-feature privileges](#apm-and-user-experience-sub-feature-privileges). Elastic Cloud Serverless: Generally available In Serverless, this privilege is called **Applications**. |
| **Synthetics and Uptime** | Access [Synthetics](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/synthetics) and [Uptime](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/uptime). Create and manage monitors, settings, and Synthetics and Uptime alert rules and alerts. Turn on **Customize sub-feature privileges** to grant individual privileges. Refer to [Synthetics and Uptime sub-feature privileges](#synthetics-and-uptime-sub-feature-privileges). Elastic Cloud Serverless: Generally available In Serverless, this privilege is called **Synthetics**. |
| **Cases** | Access [cases](https://www.elastic.co/elastic/docs-builder/docs/4493/explore-analyze/cases). Turn on **Customize sub-feature privileges** to grant individual case privileges. For the full list, refer to [Customize sub-feature privileges for cases](/elastic/docs-builder/docs/4493/explore-analyze/cases/control-case-access#cases-sub-feature-privileges). |
| **SLOs** | Access [service-level objectives (SLOs)](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/incident-management/service-level-objectives-slos). Create and manage SLOs and burn rate rules and alerts. For the matching Elasticsearch index privileges, refer to [Configure SLO access](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/incident-management/configure-service-level-objective-slo-access). |
| **Universal Profiling** | Access [Universal Profiling](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/infra-and-hosts/universal-profiling). **All** and **Read** grant the same Universal Profiling access. |
| **Observability Alerts** Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available | Read Observability alerts and perform per-alert actions such as snooze, unsnooze, and acknowledge, without managing rules. For details, refer to [Give access to triage alerts without managing rules](/elastic/docs-builder/docs/4493/explore-analyze/alerting/alerts/alerting-setup#_give_access_to_triage_alerts_without_managing_rules). |
| **Observability AI Assistant** | Access the [Observability AI Assistant](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/ai/observability-ai-assistant). This privilege has no **Read** level. |
| **Streams** Elastic Stack: Removed in 9.2, Elastic Stack: Generally available in 9.1 | Access [Streams](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/streams/streams). Elastic Stack: Generally available since 9.2 This privilege is in the [**Management** group](/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-management). |
| **Inventory** Elastic Stack: Removed in 9.1, Elastic Stack: Generally available in 9.0 | Access Inventory. Roles that use this privilege keep working only on 9.0. |
In Serverless, the **Observability** group also includes privileges that belong to the [**Analytics** group](/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-analytics) or [**Management** group](/elastic/docs-builder/docs/4493/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-management) in Elastic Stack, such as Dashboards, Discover, Machine Learning, Workflows Management, Agent Builder, and Context Engine. Which ones appear depends on your [project feature tier](https://www.elastic.co/elastic/docs-builder/docs/4493/deploy-manage/deploy/elastic-cloud/project-settings).
## APM and User Experience sub-feature privileges
These privileges control specific Applications (APM) settings. Selecting **All** for **APM and User Experience** (or **Applications** in Serverless) includes everything in the following table.
| Privilege | What it allows |
|--------------------------------|-------------------------------------|
| **Ability to modify settings** | Change Applications (APM) settings. |
## Synthetics and Uptime sub-feature privileges
These privileges control specific Synthetics actions. Selecting **All** for **Synthetics and Uptime** (or **Synthetics** in Serverless) includes **Enabled** and **Can manage**. The other privileges in this table are opt-in: grant them separately even when the feature privilege is **All**.
| Privilege | What it allows |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Can run tests manually** Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available | Trigger a manual test run of an existing monitor without creating, editing, or deleting monitors. |
| **Enabled** | Under **Elastic managed locations**, create monitors that run from Elastic managed locations. There is an additional charge to use Elastic managed testing locations. |
| **Can manage** | Under **Private locations**, add and delete private locations. |
| **Can read global parameter values** Elastic Stack: Generally available since 9.1 Elastic Cloud Serverless: Generally available | View unredacted [global parameter](https://www.elastic.co/elastic/docs-builder/docs/4493/solutions/observability/synthetics/work-with-params-secrets) values. |
| **Can manage rules** Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available | Create, update, delete, enable, disable, run, and backfill Synthetics and Uptime alert rules, including the default status and TLS rules, without granting permission to create or edit monitors. |