From c4d4436727bc0c3e90019873518f4c04f7b6359e Mon Sep 17 00:00:00 2001 From: ubanerjeeNR Date: Mon, 17 Feb 2025 13:47:50 +0530 Subject: [PATCH 1/2] docs(update): updates to user management concepts --- .../user-management-concepts.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx b/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx index 4f703f84048..9bbc81413a4 100644 --- a/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx +++ b/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx @@ -84,8 +84,8 @@ Users and groups are located within an [authentication domain](/docs/accounts/ac We have two default user groups: -* **User**: A user in this group can use and configure our observability and monitoring features but **not** perform account-level tasks like managing billing or managing other users. It has access to the [**All product admin**](#standard-roles) role, which grants control over all observability platform tools, but doesn't have any [administration settings](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings), which grant access to the higher level account and user management capabilities. -* **Admin**: has the [**All product admin** role](#standard-roles) and in addition has all available [administration settings](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings). As a result, this group has access to all features, including the higher-level admin features. +* **User**: A user in this group can use and configure our observability and monitoring features but **not** perform account-level tasks like managing billing or managing other users. It has access to the [**All product admin**](#standard-roles) role, which grants control over all observability platform tools, and the [administrative setting](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings) Org Product Admin. It does not have access to any other administrative settings that grant access to the higher level account and user management capabilities. +* **Admin**: has the [**All product admin** role](#standard-roles) and in addition has all available [administrative settings](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings). As a result, this group has access to all features, including the higher-level admin features. To edit the group a user is in, you can go to either the **Access management** UI and edit a group, or go to the **User management** UI and edit the user. From 66a7c69e839e10d9423fb5c1f31f1414a08ad781 Mon Sep 17 00:00:00 2001 From: ubanerjeeNR Date: Mon, 17 Feb 2025 20:21:12 +0530 Subject: [PATCH 2/2] docs(update): remaining changes These changes are from Tori's PRs: https://github.com/newrelic/docs-website/pull/19926/files https://github.com/newrelic/docs-website/pull/19923/files --- .../user-management-concepts.mdx | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx b/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx index 9bbc81413a4..06d544c3e65 100644 --- a/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx +++ b/src/content/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts.mdx @@ -97,13 +97,13 @@ Important points about roles: * Roles are additive: users with multiple roles assigned have the total of all permissions granted by those roles. For example, if you're in a group that gives you the `All product admin` role in an account, and in another group that gives you a `Read only` role for the same account, you have both roles, and are not restricted by the `Read only` role. * A user's access is based on the access granted to them by their user type and their permissions ([learn more](/docs/accounts/accounts-billing/new-relic-one-user-management/user-type#user-type-and-roles)). -* Roles govern observability platform features, while access to organization- and user-related admin settings are governed by [administration settings](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings). +* Roles govern observability platform features, while access to organization- and user-related admin settings are governed by [administrative settings](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings). To view roles and their permissions, go to the [**Access management** UI](/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks#where) and click **Roles**. ### Our standard (default) roles [#standard-roles] -We have several **standard roles**, which are roles that are available by default and that satisfy some common user management use cases. +We have several account-scoped **standard roles**, which are roles that are available by default and that satisfy some common user management use cases. Note that some of our standard roles have permissions that we don't expose and that aren't available for adding to a custom role. The only standard roles that can be replicated with a custom role are **Standard user** and **Read only**; all others have some non-exposed permissions. @@ -137,7 +137,7 @@ Here's a table with our standard roles. To better understand these roles, go to - This role includes all New Relic platform permissions **except** the ability to manage organization-level settings, users, and billing. It's an admin role in the sense that it allows the configuration of our platform features (for example, the ability to configure settings), but it doesn't provide organization-level admin permissions (those require [the administration settings](#admin-settings)). + This role includes all New Relic platform permissions **except** the ability to manage organization-level settings, users, and billing. It's an admin role in the sense that it allows the configuration of our platform features (for example, the ability to configure settings), but it doesn't provide organization-level admin permissions (those require [the administrative settings](#admin-settings)). This role is essentially the **Standard user** role, below, with the added ability to configure observability features. @@ -185,20 +185,20 @@ Here's a table with our standard roles. To better understand these roles, go to For more about how you'd assign roles to groups and create custom roles, see the [user management tutorial](/docs/accounts/accounts-billing/new-relic-one-user-management/tutorial-add-new-user-groups-roles-new-relic-one-user-model). -### Administration settings [#admin-settings] +### Administrative settings [#admin-settings] -You can add various **Administration settings** to a group. Basic users will not be able to use these settings. +You can add various **Administrative settings** to a group, which are roles scoped to your organization. Basic users will not be able to use these settings. Settings include: -* **Organization settings**: Permissions related to organization settings, including adding accounts, and changing the name of the organization and accounts. -* **Authentication domain settings**: Permissions related to adding and managing users, including configuring authentication domains and customizing groups and roles. Options within this include: +* **Organization manager**: Permissions related to organization settings, including adding accounts, and changing the name of the organization and accounts. This also includes sensitive observability tasks, such as deleting certain entities. +* **Authentication domain manager**: Permissions related to adding and managing users, including configuring authentication domains and customizing groups and roles. Options within this include: * **Manage**: Can manage all aspects of authentication domains, including configuring domains and adding users. * **Read only**: Can view authentication domain and user information. * **Add users**: Can view user information, and add users to the organization, but lacks other auth domain configuration and mgmt abilities. * **Read users**: Can only view user information. * **Billing**: Lets a user view and manage billing and usage, and data retention. For organizations with multiple accounts, billing is aggregated in the **reporting account** (usually the first account created in an organization). - +* **Organization Product Admin**: Permissions related to organization-scoped observability features. It's an admin role in the sense that it allows the configuration of our platform features. This is the organization-scoped equivalent to All Product Admin. ### Group admin [#group-admin] You can add a **Group admin** role to a group. This role gives the group the ability to add and remove users for one or more groups you select.