---
title: Control access to cases
description: Create custom roles and configure Kibana feature privileges to control access to cases.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/explore-analyze/cases/control-case-access
products:
  - Elastic Cloud Serverless
  - Elastic Observability
  - Elastic Security
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Control access to cases
To manage cases, users need the appropriate Kibana feature privileges. You can grant different levels of access depending on what users need to do, from full control over cases to view-only access.

## Quick reference

The following table shows the minimum privileges required for each activity. Higher privilege levels include the access shown here. Set **Cases** privileges under your solution (**Stack Management**, **Security**, or **Observability**). Refer to the following sections for the full breakdown.

| To...                                                                                                                                                              | Minimum required                                                                                                    |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------|
| View cases                                                                                                                                                         | **Cases: Read**                                                                                                     |
| Create and manage cases                                                                                                                                            | **Cases: All**                                                                                                      |
| Be assigned to cases                                                                                                                                               | **Cases: All** (user must also log in at least once)                                                                |
| Manage connectors and push cases externally                                                                                                                        | **Cases: All** + **Actions and Connectors: All** (under **Management**)                                             |
| Manage case templates and the field library <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | **Cases: All** + **Manage templates** sub-feature privilege                                                         |
| Add alerts to cases                                                                                                                                                | **Cases: All** + alert privileges for your solution (see [Give access to add alerts to cases](#give-alerts-access)) |


## Create custom roles for cases

<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    [Create or update a role](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management), then set **Cases** privileges under your solution (**Stack Management**, **Security**, or **Observability**). To grant individual privileges, turn on **Customize sub-feature privileges**. For details about feature and sub-feature privileges, refer to [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges).
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    [Create a custom role](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/deploy-manage/users-roles/serverless-custom-roles), then set **Cases** privileges under your solution (**Security** or **Observability**). To grant individual privileges, turn on **Customize sub-feature privileges**.
  </applies-item>
</applies-switch>


## Customize sub-feature privileges for cases

When **Customize sub-feature privileges** is on for **Cases**, you can grant these privileges individually:

| Privilege                                                                                                                                   | Description                |
|---------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|
| **Delete**                                                                                                                                  | Delete cases and comments. |
| **Case settings**                                                                                                                           | Edit case settings.        |
| **Create comments & attachments**                                                                                                           | Add comments to cases.     |
| **Re-open**                                                                                                                                 | Re-open closed cases.      |
| **Assign users**                                                                                                                            | Assign users to cases.     |
| **Manage templates** <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | Manage case templates.     |


## Give full access to manage cases and settings

<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    - `All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**). This grants full control over cases, including creating, deleting, and editing case settings. You can turn on **Customize sub-feature privileges** to limit access.
    - `All` for the **Actions and Connectors** feature under **Management**. This is required to create, add, delete, and modify connectors that push cases to external systems.
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    - `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
    - `All` for the **Actions and Connectors** feature under **Management**. This is required to create, add, delete, and modify case connectors and send updates to external systems.
  </applies-item>
</applies-switch>


## Give assignee access to cases

<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    `All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).Users must log in to their deployment at least once before they can be assigned to cases. Logging in creates the required user profile.
  </applies-item>
</applies-switch>


## Give view-only access to cases

<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    `Read` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    `Read` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
  </applies-item>
</applies-switch>


## Give access to manage case templates

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
</applies-to>

To create, edit, delete, import, and export [case templates](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/explore-analyze/cases/create-case-templates) and [field library entries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7410/explore-analyze/cases/create-case-field-library), grant the following privileges. Users without **Manage templates** can still select and apply enabled templates when creating or updating a case.
<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    1. Set `All` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
    2. Turn on **Customize sub-feature privileges**.
    3. Enable **Manage templates**.
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    1. Set `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
    2. Turn on **Customize sub-feature privileges**.
    3. Enable **Manage templates**.
  </applies-item>
</applies-switch>


## Give access to add alerts to cases

<applies-switch>
  <applies-item title="{ stack: ga 9.4+, serverless: ga }" applies-to="Elastic Cloud Serverless: Generally available, Elastic Stack: Generally available since 9.4">
    - `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
    - To work with alerts in cases:
      - **Security**: `Read` or `All` for the **Security > Alerts** feature. For what each level allows, refer to [Detections privileges](/elastic/docs-content/pull/7410/solutions/security/detect-and-alert/detections-privileges#manage-alerts).
    - **Observability**: `Read` for **Observability**
  </applies-item>

  <applies-item title="stack: ga 9.0-9.3" applies-to="Elastic Stack: Generally available from 9.0 to 9.3">
    - `All` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
    - `Read` for a solution that has alerts (for example, **Observability** or **Security**).
  </applies-item>
</applies-switch>


## Revoke all access to cases

<applies-switch>
  <applies-item title="stack: ga" applies-to="Elastic Stack: Generally available">
    `None` for the **Cases** feature under the appropriate solution (**Stack Management**, **Security**, or **Observability**).
  </applies-item>

  <applies-item title="serverless: ga" applies-to="Elastic Cloud Serverless: Generally available">
    `None` for the **Cases** feature under the appropriate solution (**Security** or **Observability**).
  </applies-item>
</applies-switch>