﻿---
title: Privileged user monitoring requirements
description: This page covers the requirements for using the privileged user monitoring feature, as well as its known limitations. The privileged user monitoring feature...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/3897/solutions/security/advanced-entity-analytics/privileged-user-monitoring-requirements
products:
  - Elastic Cloud Serverless
  - Elastic Security
---

# Privileged user monitoring requirements
This page covers the requirements for using the privileged user monitoring feature, as well as its known limitations.
The privileged user monitoring feature requires:
- `stack: ` The appropriate [subscription](https://www.elastic.co/subscriptions)
- `serverless: ` The appropriate [feature tier](https://www.elastic.co/pricing/serverless-security)

To enable this feature, turn on the `securitySolution:enablePrivilegedUserMonitoring` [advanced setting](/elastic/docs-content/pull/3897/solutions/security/get-started/configure-advanced-settings#access-privileged-user-monitoring).
To use this feature, you need:
- `stack: ` A role with the appropriate [privileges](#privmon_privs)
- `serverless: ` Either the appropriate [predefined Security user role](#privmon_roles) or a [custom role](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/3897/deploy-manage/users-roles/cloud-organization/user-roles) with the right [privileges](#privmon_privs)


## Privileges


| Action                                        | Index Privileges                                                                                                                                                                                              | Kibana Privileges                                 |
|-----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|
| Enable the privileged user monitoring feature | N/A                                                                                                                                                                                                           | **All**All for the **Security**Security feature   |
| View the Privileged user monitoring dashboard | `Read` for the following indices: - `.entity_analytics.monitoring.users-<space-id>` - `risk-score.risk-score-*` - `.alerts-security.alerts-<space-id>` -  `.ml-anomalies-shared` - Security data view indices | **Read**Read for the **Security**Security feature |


## Predefined roles

```yaml
serverless: 
```


| Action                                        | Predefined role                                                                                                        |
|-----------------------------------------------|------------------------------------------------------------------------------------------------------------------------|
| Enable privileged user monitoring             | - Platform engineer- Admin                                                                                             |
| View the Privileged user monitoring dashboard | - Tier 1 analyst- Tier 2 analyst- Tier 3 analyst- Rule author- SOC manager- Platform engineer- Detections admin- Admin |


## Known limitations

- Currently, none of the privileged user monitoring visualizations support [cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/3897/solutions/search/cross-cluster-search) as part of the data that they query from.
- You can define up to 10,000 privileged users per data source.