Permissions

The Group Permission section of the portal allows you to customize the permissions that users within an assigned group have. Because users can be a part of multiple groups, their permissions are based on the highest allowable permission granted to them.

For example, if a user is in Group A with Read, Write, and Create permissions, and in Group B with only Read permission, that user will maintain Read, Write, and Create permissions across the portal even though their Group B permissions are only for Read access.

The three system created Default Groups cannot have their permissions changed, not even by an account Administrator.

Configure Permissions

  1. Click on Groups from the Accounts page.

  2. Click on a Group Name from the list of available groups.

  3. Click the View Permissions button.

  4. Use the slider bar to increase or decrease the permissions for a specific Type, and then click Save when you are done setting the permission level.

 

 

  1. Select the Inherit option to apply the permission settings from the parent-level in the hierarchy to the selected feature.

    1. For example, HINFO Records is a child of Resource Records. If Inherit is enabled for HINFO Records, it uses the permission configuration defined for Resource Records. Any changes made to the Resource Records permission automatically changes the HINFO Records while Inherit remains enabled.

  2. Click Save when you are done applying permissions.

 

The following are the different permission levels you can apply (permission types cannot be customized):

  1. Read

  2. Read Write

  3. Read Write Create

  4. Read Write Create Delete

  5. Read Write Create Grant

  6. Reports can have either None or Read.

    1. Reports can have either None or Read.

    2. Reports permission cannot be configured for Custom groups.

    3. The Grant permission type cannot be configured for Custom groups. It is restricted to only the Owner and Administrative groups.

 

The Domain Services and Domain configurations control most of the same functions and behavior. The main difference is that the Domain configuration provides more granular control over the various records and pools (especially if utilizing the Inherit option.

Some features controlled by Domain Services/Domain include enabling DNSSEC for a domain, configuring Zone Transfer Settings, and the ability to create or edit pools and records within a domain.

As a note, the following default (created by the UI) Groups cannot have their permissions changed:

  • Administrative - Users will have access to all account functions including being able to change the Primary user for the account. The Primary user and Administrative users are the only users that can invite new users to the account.

  • Reporting - Users will have Read-only access for the entire account, meaning they cannot edit any account level or domain level details.

  • Technical - Users will have access to all account functions except for the following:

    • Cannot add new users.

    • Cannot move users to and from groups.

    • Cannot change any of the Account Notification Settings.

    • Cannot access Account level Zone Transfer Settings.

    • Cannot initiate a DNS Health Check.

Multi-Level Account Groups and Permissions

Permissions and access for users associated to a Multi-Level account will differ from those listed above. A key difference is users that are assigned to the Technical Group in a Sub Account will only have basic reporting access, and will have limited access to various features on the portal (they will not be able to view several of the features on the Accounts.

To access Permissions for Users not in a Group (standalone):

  1. Click on Groups from the Accounts page.

  2. Click on the Not in a Group group name.

  3. Click the Permissions button next to the desired user.

  4. Select the desired permission level per Type, and then click Save.