---
title: Elastic Defend feature privileges
description: You can create user roles and define privileges to manage feature access in Elastic Security. This allows you to use the principle of least privilege...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges
products:
  - Elastic Cloud Serverless
  - Elastic Security
---

# Elastic Defend feature privileges
You can create user roles and define privileges to manage feature access in Elastic Security. This allows you to use the principle of least privilege while managing access to Elastic Defend's features.
To configure roles and privileges, find **Roles** in the navigation menu or by using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/explore-analyze/find-and-organize/find-apps-and-objects). For more details on using this UI, refer to [Role management using Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for Elastic Stack, or to [Custom roles](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/deploy-manage/users-roles/cloud-organization/user-roles) for Serverless.
<note>
  `stack: ga 9.1` Elastic Defend's feature privileges can be assigned on a per-space basis. For more information, refer to [Spaces and Elastic Defend FAQ](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/get-started/spaces-defend-faq).
</note>

To grant access, select **All** for the **Security** feature in the **Assign role to space** configuration UI, then turn on the **Customize sub-feature privileges** switch.
<important>
  Selecting **All** for the overall **Security** feature does NOT enable any sub-features. You must also enable the **Customize sub-feature privileges** switch, and then enable each sub-feature privilege individually.
</important>

For each of the following sub-feature privileges, select the type of access you want to allow:
- **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
- **Read**: Users can view the feature, but can’t perform any actions or manage configuration (some features don’t have this privilege).
- **None**: Users can’t access or view the feature.


|                                                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
|-----------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Endpoint List**Endpoint List                                              | Access the [Endpoints](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/endpoints)Endpoints page, which lists all hosts running Elastic Defend, and associated integration details.                                                                                                                                                                                                                            |
| **Automatic Troubleshooting**Automatic Troubleshooting                      | Access [Automatic Troubleshooting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/automatic-troubleshooting)Automatic Troubleshooting to check if your hosts have third-party AV software installed.**Note:**Note: In Elastic Stack 9.0.0, this privilege is called **Endpoint Insights**Endpoint Insights.                                                                                                  |
| **Global Artifact Management**Global Artifact Management `stack: ga 9.1`    | Manage global assignment of endpoint artifacts (e.g., trusted applications, event filters) across all spaces and policies. This privilege controls global assignment rights only; privileges for each artifact type are required for full artifact management.                                                                                                                                                                                                            |
| **Trusted Applications**Trusted Applications                                | Access the [Trusted applications](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/trusted-applications)Trusted applications page to remediate conflicts with other software, such as antivirus or endpoint security applications.                                                                                                                                                                             |
| **Trusted Devices**Trusted Devices `stack: ga 9.2` `serverless: ga`         | Access the [Trusted devices](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/trusted-devices)Trusted devices page to specify which trusted devices can connect to hosts with [Device Control](/elastic/docs-content/pull/4236/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#device-control)Device Control enabled.                                           |
| **Host Isolation Exceptions**Host Isolation Exceptions                      | Access the [Host isolation exceptions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/host-isolation-exceptions)Host isolation exceptions page to add specific IP addresses that isolated hosts can still communicate with.                                                                                                                                                                                  |
| **Blocklist**Blocklist                                                      | Access the [Blocklist](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/blocklist)Blocklist page to prevent specified applications from running on hosts, extending the list of processes that Elastic Defend considers malicious.                                                                                                                                                                             |
| **Event Filters**Event Filters                                              | Access the [Event Filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/event-filters)Event Filters page to filter out endpoint events that you don’t want stored in Elasticsearch.                                                                                                                                                                                                                        |
| **Endpoint Exceptions**Endpoint Exceptions `stack: ga 9.2` `serverless: ga` | Add and use [endpoint exceptions](/elastic/docs-content/pull/4236/solutions/security/detect-and-alert/add-manage-exceptions#endpoint-rule-exceptions)endpoint exceptions.**Note:**Note: In Elastic Stack 9.1.0 and earlier, this privilege is included within the **Security**Security privilege.                                                                                                                                                                         |
| **Elastic Defend Policy Management**Elastic Defend Policy Management        | Access the [Policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/manage-elastic-defend/policies)Policies page and Elastic Defend integration policies to configure protections, event collection, and advanced policy features.                                                                                                                                                                                                |
| **Response Actions History**Response Actions History                        | Access the [response actions history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions/response-actions-history)response actions history for endpoints.                                                                                                                                                                                                                                                    |
| **Host Isolation**Host Isolation                                            | Allow users to [isolate and release hosts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions/isolate-host)isolate and release hosts.                                                                                                                                                                                                                                                                        |
| **Process Operations**Process Operations                                    | Perform host process-related [response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions)response actions, including `processes`, `kill-process`, and `suspend-process`.                                                                                                                                                                                                                           |
| **File Operations**File Operations                                          | Perform file-related [response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions)response actions in the response console.                                                                                                                                                                                                                                                                         |
| **Execute Operations**Execute Operations                                    | Perform shell commands and script-related [response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions)response actions in the response console.The commands are run on the host using the same user account running the Elastic Defend integration, which normally has full control over the system. Only grant this feature privilege to Elastic Security users who require this level of access. |
| **Scan Operations**Scan Operations                                          | Perform folder scan [response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/solutions/security/endpoint-response-actions)response actions in the response console.                                                                                                                                                                                                                                                                          |


## Upgrade considerations

```yaml
stack:
```

After upgrading from Elastic Security 8.6 or earlier, existing user roles will be assigned **None** by default for any new endpoint management feature privileges, and you’ll need to explicitly assign them. However, many features previously required the built-in `superuser` role, and users who previously had this role will still have it after upgrading.
You’ll probably want to replace the broadly permissive `superuser` role with more focused feature-based privileges to ensure that users have access to only the specific features that they need. Refer to [Kibana role management](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4236/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles) for more details on assigning roles and privileges.