---
title: Observability Kibana privileges
description: Lists Kibana privileges in the Observability group of Assign role to spaces, with privilege levels and links to sub-feature catalogs.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/get-started/observability-kibana-privileges
products:
- Elastic Cloud Serverless
- Elastic Documentation
- Elastic Observability
applies_to:
- Serverless Observability projects: Generally available
- Elastic Stack: Generally available
---
# Observability Kibana privileges
Roles control what users can access and what actions they can perform. When you create or edit a role, you grant it [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges), which give access to individual features within one or more spaces.
When you add Kibana privileges to a role, the **Assign role to spaces** flyout opens. Access to Observability features is controlled by the privileges in the **Observability** group, described on this page.
For more details on creating a role, refer to [Role management using Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for Elastic Stack, or to [Serverless project custom roles](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/deploy-manage/users-roles/serverless-custom-roles) for Serverless.
Kibana feature privileges do not grant Elasticsearch cluster or index privileges. Users still need the matching index privileges for the data they query.
## Access levels
For each of the feature privileges, select the type of access you want to allow:
- **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
- **Read**: Users can view the feature, but can't perform any actions or manage configuration.
- **None**: Users can't access or view the feature.
Some features don't have a **Read** privilege.
## Privileges in the Observability group
Each of the following privileges controls access to a different part of Observability.
| Privilege | What it allows |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Logs** | Access [Logs](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/logs) and related apps, including Logs Explorer. Create and manage logs alert rules and alerts. |
| **Infrastructure** | Access [Infrastructure](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/infra-and-hosts/analyze-infrastructure-host-metrics) and related metrics apps. Create and manage infrastructure alert rules and alerts. |
| **APM and User Experience** | Access [Applications (APM)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/apm) and [User Experience](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/applications/user-experience). Create and manage APM alert rules and alerts. Turn on **Customize sub-feature privileges** to grant individual privileges. Refer to [APM and User Experience sub-feature privileges](#apm-and-user-experience-sub-feature-privileges). Elastic Cloud Serverless: Generally available In Serverless, this privilege is called **Applications**. |
| **Synthetics and Uptime** | Access [Synthetics](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/synthetics) and [Uptime](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/uptime). Create and manage monitors, settings, and Synthetics and Uptime alert rules and alerts. Turn on **Customize sub-feature privileges** to grant individual privileges. Refer to [Synthetics and Uptime sub-feature privileges](#synthetics-and-uptime-sub-feature-privileges). Elastic Cloud Serverless: Generally available In Serverless, this privilege is called **Synthetics**. |
| **Cases** | Access [cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/explore-analyze/cases). Turn on **Customize sub-feature privileges** to grant individual case privileges. For the full list, refer to [Customize sub-feature privileges for cases](/elastic/docs-content/pull/9065/explore-analyze/cases/control-case-access#cases-sub-feature-privileges). |
| **SLOs** | Access [service-level objectives (SLOs)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/incident-management/service-level-objectives-slos). Create and manage SLOs and burn rate rules and alerts. For the matching Elasticsearch index privileges, refer to [Configure SLO access](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/incident-management/configure-service-level-objective-slo-access). |
| **Universal Profiling** | Access [Universal Profiling](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/infra-and-hosts/universal-profiling). **All** and **Read** grant the same Universal Profiling access. |
| **Observability Alerts** Elastic Stack: Generally available since 9.5 Elastic Cloud Serverless: Generally available | Read Observability alerts and perform per-alert actions such as snooze, unsnooze, and acknowledge, without managing rules. For details, refer to [Give access to triage alerts without managing rules](/elastic/docs-content/pull/9065/explore-analyze/alerting/alerts/alerting-setup#_give_access_to_triage_alerts_without_managing_rules). |
| **Observability AI Assistant** | Access the [Observability AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/ai/observability-ai-assistant). This privilege has no **Read** level. |
| **Streams** Elastic Stack: Removed in 9.2, Elastic Stack: Generally available in 9.1 | Access [Streams](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/streams/streams). Elastic Stack: Generally available since 9.2 This privilege is in the [**Management** group](/elastic/docs-content/pull/9065/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-management). |
| **Inventory** Elastic Stack: Removed in 9.1, Elastic Stack: Generally available in 9.0 | Access Inventory. Roles that use this privilege keep working only on 9.0. |
In Serverless, the **Observability** group also includes privileges that belong to the [**Analytics** group](/elastic/docs-content/pull/9065/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-analytics) or [**Management** group](/elastic/docs-content/pull/9065/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges#kibana-privileges-management) in Elastic Stack, such as Dashboards, Discover, Machine Learning, Workflows Management, Agent Builder, and Context Engine. Which ones appear depends on your [project feature tier](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/deploy-manage/deploy/elastic-cloud/project-settings).
## APM and User Experience sub-feature privileges
These privileges control specific Applications (APM) settings. Selecting **All** for **APM and User Experience** (or **Applications** in Serverless) includes everything in the following table.
| Privilege | What it allows |
|--------------------------------|-------------------------------------|
| **Ability to modify settings** | Change Applications (APM) settings. |
## Synthetics and Uptime sub-feature privileges
These privileges control specific Synthetics actions. Selecting **All** for **Synthetics and Uptime** (or **Synthetics** in Serverless) includes **Enabled** and **Can manage**. **Can run tests manually** and **Can manage rules** appear cleared under **All**, but an **All** role can already do both, so select them only on a **Read** role. **Can read global parameter values** is always opt-in: grant it separately even when the feature privilege is **All**.
| Privilege | What it allows |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Can run tests manually** Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available | Trigger a manual test run of an existing monitor without creating, editing, or deleting monitors. In Elastic Stack, available starting with versions 9.4.8 and 9.5.5. To add this to a read-only role, refer to [the reader role](/elastic/docs-content/pull/9065/solutions/observability/synthetics/reader-role#synthetics-read-sub-feature-privileges). |
| **Enabled** | Under **Elastic managed locations**, create monitors that run from Elastic managed locations. There is an additional charge to use Elastic managed testing locations. Turning this off is how you [restrict a writer role from using managed locations](/elastic/docs-content/pull/9065/solutions/observability/synthetics/writer-role#disable-managed-locations). |
| **Can manage** | Under **Private locations**, add and delete private locations. Setting up a new private location also requires the Fleet privileges listed in the [writer role](/elastic/docs-content/pull/9065/solutions/observability/synthetics/writer-role#synthetics-role-write-private-locations). |
| **Can read global parameter values** Elastic Stack: Generally available since 9.1 Elastic Cloud Serverless: Generally available | View unredacted [global parameter](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9065/solutions/observability/synthetics/work-with-params-secrets) values. |
| **Can manage rules** Elastic Stack: Generally available since 9.4 Elastic Cloud Serverless: Generally available | Create, update, delete, enable, disable, run, and backfill Synthetics and Uptime alert rules, including the default status and TLS rules, without granting permission to create or edit monitors. In Elastic Stack, available starting with versions 9.4.8 and 9.5.5. To add this to a read-only role, refer to [the reader role](/elastic/docs-content/pull/9065/solutions/observability/synthetics/reader-role#synthetics-read-sub-feature-privileges). |