> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Atlas User Roles

Atlas user roles define the actions Atlas users can perform in organizations, projects, or both. Organization and project `Owners` can manage Atlas users and their roles within their respective organizations and projects.

You can apply these permissions **only** on the [the organization level](https://www.mongodb.com/docs/atlas/production-notes.md#std-label-org-level-best-practices) or [the project level](https://www.mongodb.com/docs/atlas/production-notes.md#std-label-project-level-best-practices). So, you should carefully plan the hierarchy of your organizations and projects. To learn more, see [Cluster Management.](https://www.mongodb.com/docs/atlas/production-notes.md#std-label-db-deployment-best-practices)

## Organization Roles

| Atlas Organization Role (UI) | Atlas Organization Role (API, CLI) | Description |
| --- | --- | --- |
|  | `ORG_OWNER` | Grants root access to the organization, including: [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) access to all projects in the organization, which grants database access, even if added to a project with a non-Owner role. This access is inherited from the Atlas Organization Owner role, so users with this role are not listed on the project access list.; Privileges to administer organization settings.; Privileges to add, modify, or delete Atlas users and [database users](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) within the organization.; Privileges to delete the organization.; Privileges to add, modify, or delete [resource tags.](https://www.mongodb.com/docs/atlas/tags.md#std-label-configure-resource-tags); All the privileges granted by the other organization roles combined. |
|  | `ORG_GROUP_CREATOR` | Grants the following access: Privileges to create projects in the organization.; Privileges granted by the [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member) role. |
|  | `ORG_BILLING_ADMIN` | Grants the following access: Privileges to administer billing information for the organization.; Privileges granted by the [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member) role.; Privileges to create, edit, delete, acknowledge, and unacknowledge billing alerts. |
|  | `ORG_STREAM_PROCESSING_ADMIN` | Grants the following access: Privileges granted by the [`Project Stream Processing Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Stream-Processing-Owner) role, for all projects within the organization.; Privileges to create, modify, and delete private endpoints and VPC peering connections.; Privileges granted by the [`Organization Read Only`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Read-Only) role. |
|  | `ORG_BILLING_READ_ONLY` | Grants the following access: Privileges to view billing information for the organization.; Privileges granted by the [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member) role. |
|  | `ORG_READ_ONLY` | Provides read-only access to the settings, users, and projects in the organization. |
|  | `ORG_MEMBER` | Provides read-only access to the settings and users in the organization and the projects they belong to. Unlike [`Organization Read Only`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Read-Only), an [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member) can only access projects they have been explicitly added to. For an [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member), within a project, the user has the privileges as determined by the user's [project role](https://www.mongodb.com/docs/atlas/reference/user-roles.md#std-label-project-roles). If a user's project role is [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner), then the user can add a new user to the project, which results in adding the newly-added user to the organization as well (if the newly added user is not already in the organization). |

## Project Roles

The following roles grant privileges within a project. All the project roles also grant all the privileges included with the [`Project Read Only`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Read-Only) role.

| Atlas Project Role (UI) | Atlas Project Role (API, CLI) | Description |
| --- | --- | --- |
|  | `GROUP_OWNER` | This role inherits the permissions of all other project roles. Grants the privileges to perform the following actions: [Create a new cluster.](https://www.mongodb.com/docs/atlas/create-database-deployment.md#std-label-create-new-database-deployment); Manage [project access](https://www.mongodb.com/docs/atlas/access/manage-project-access.md#std-label-manage-project-access) and [project settings.](https://www.mongodb.com/docs/atlas/tutorial/manage-project-settings.md#std-label-project-settings); Manage [IP Access List](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) entries.; [Manage programmatic access to a project.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-about-project-api-keys)You can grant API (Application Programming Interface) Keys access to a project with either an organization or a project role. If your key has both the [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) and [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) roles, it can access all projects in the organization.; Manage [database access](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) for clusters within the project.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs for all clusters in the project.; [Manage backups for and restore data to](https://www.mongodb.com/docs/atlas/backup-restore-cluster.md#std-label-restore-archive-snapshots) all clusters in the project.; Access the Data Explorer.; [Launch MongoDB Charts.](https://www.mongodb.com/docs/charts/launch-charts/); [Connect or disconnect Charts data sources.](https://www.mongodb.com/docs/charts/connect-disconnect-data-source/); Add, modify, or delete [resource tags.](https://www.mongodb.com/docs/atlas/tags.md#std-label-configure-resource-tags); [Create, view, edit and delete stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor); [Create, view, edit, and delete connections in connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connections); Create, modify, or delete [Triggers](https://www.mongodb.com/docs/atlas/atlas-ui/triggers.md#std-label-atlas-triggers) |
|  | `GROUP_REPLICA_SET_MANAGER` | Grants the privileges to perform the following actions: Edit the following:Global cluster configuration; Zone configuration; Replication specs; Cluster tier; Test resilience.; Pause and resume clusters. This role *doesn't* grant permissions to perform the following actions: Edit the following:Advanced cluster configurations; Tags; Major version; Cloud backup setting; Termination protection; Grant access to MongoDB support. |
|  | `GROUP_CLUSTER_MANAGER` | Grants the privileges to perform the following actions: Grants access to edit, [pause](https://www.mongodb.com/docs/atlas/pause-terminate-cluster.md#std-label-pause-terminate-cluster), and resume Atlas clusters.; [Test failover.](https://www.mongodb.com/docs/atlas/tutorial/test-resilience/test-primary-failover.md#std-label-test-failover) The [`Project Cluster Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Cluster-Manager) role doesn't allow users to: Create and terminate Atlas clusters.; Access the [Data Explorer.](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui); Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs. |
|  | `GROUP_CLUSTER_CREATOR` | Grants the privileges to create clusters. |
|  | `GROUP_CLUSTER_LOG_VIEWER` | Grants the privileges to perform the following actions: View and download system and audit logs.; View and download database access history. |
|  | `GROUP_CLUSTER_RESILIENCE_TESTER` | Grants the privileges to [test cluster resilience](https://www.mongodb.com/docs/atlas/tutorial/test-resilience/test-primary-failover.md#std-label-test-failover) and [reconfigure replica sets to respond to a regional outage.](https://www.mongodb.com/docs/atlas/reconfigure-replica-set-during-regional-outage.md#std-label-reconfigure-rs-during-regional-outage) |
|  | `GROUP_STREAM_PROCESSING_OWNER` | DEPRECATED: To grant the same privileges, assign the [`Project Stream Processing Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Stream-Processing-Manager) and [`Project Data Access Admin`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Admin) roles together. Grants the privileges to perform the following actions: Manage [database access](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) for clusters within the project.; [Test failover.](https://www.mongodb.com/docs/atlas/tutorial/test-resilience/test-primary-failover.md#std-label-test-failover); Access the [Data Explorer.](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui); Download stream processing workspace audit logs.; [Create, view, edit and delete stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor); [Create, view, edit, and delete connections in connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connections); [Create, view, edit, and delete stream processors](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor) The [`Project Stream Processing Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Stream-Processing-Owner) role doesn't allow users to: Create Atlas clusters.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [database audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs. |
|  | `GROUP_STREAM_PROCESSING_MANAGER` | Grants the privileges to perform the following actions: Download stream processing workspace audit logs.; [Create, view, edit, and delete stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor); [Create, view, edit, and delete connections in connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connections); [Create, view, edit, start, stop, and delete stream processors](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor), including managing [regional failover.](https://www.mongodb.com/docs/atlas/atlas-stream-processing/architecture.md#std-label-atlas-sp-architecture-failover); Create, update, and delete Atlas Stream Processing Private Link connections. The [`Project Stream Processing Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Stream-Processing-Manager) role doesn't allow users to: Manage [database access](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) for clusters within the project.; Manage [custom database roles](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md#std-label-mongodb-roles) or revoke user X.509 certificates.; Create, edit, [pause](https://www.mongodb.com/docs/atlas/pause-terminate-cluster.md#std-label-pause-terminate-cluster), resume, or delete Atlas clusters.; Manage Cloud Provider Access IAM (Identity and Access Management) roles, [VPC peering connections](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-vpc-peering-connections.md#std-label-atlas-sp-manage-vpc-peering), or Transit Gateway resources. |
|  | `GROUP_ACCESS_MANAGER` | Grants privileges to perform the following actions: Invite users to project.; Add or remove existing [teams](https://www.mongodb.com/docs/atlas/access/manage-teams-in-orgs.md#std-label-manage-teams) and manage team roles within the project.; Create and update API keys within the project.; Create and update [service accounts](https://www.mongodb.com/docs/atlas/api/api-authentication.md#std-label-service-accounts-overview) within the project. IMPORTANT: Users with this role can edit their own role or create an API key or service account to raise their privileges to [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner). This role exists to manage all project access, so the ability to grant any role is inherent. |
|  | `GROUP_DATA_ACCESS_ADMIN` | This role inherits the permissions of [`Project Search Index Editor`.](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Search-Index-Editor) Grants access to the [Data Explorer](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui), with the privileges to perform the following actions through the [Atlas UI:](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui) View, create, and drop databases, collections, and indexes, and hide indexes.; **UI only**: View, modify, and delete documents. You can't read or write data using the Atlas Administration API.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs for all clusters in the project.; View the sample query field values in the [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-performance-advisor); View collection-level query latency with [Namespace Insights.](https://www.mongodb.com/docs/atlas/namespace-insights.md#std-label-namespace-insights); View collection-level query shape performance with [Query Shape Insights.](https://www.mongodb.com/docs/atlas/query-shape-insights.md#std-label-query-shape-insights); View query performance, including raw queries, in the [Query Profiler.](https://www.mongodb.com/docs/atlas/tutorial/query-profiler.md#std-label-query-profiler); View real-time performance in the [Real-Time Performance Panel.](https://www.mongodb.com/docs/atlas/real-time-performance-panel.md#std-label-real-time-metrics-status-tab); View documents using the Search Tester.; [Launch MongoDB Charts.](https://www.mongodb.com/docs/charts/launch-charts/); Download stream processing workspace audit logs.; [Create, view, edit and delete stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-stream-processor.md#std-label-atlas-sp-manage-processor); [View connections in the connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connection-view) This role doesn't grant privileges to initiate backup or restore jobs. When you access data in Data Explorer, Atlas connects you with the system-generated `atlasDataAccessAdmin` role on the `admin` database. To identify your Data Explorer operations in your [database audit logs](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing), filter for this role. |
|  | `GROUP_DATA_ACCESS_READ_WRITE` | Grants access to the [Data Explorer](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui), with the privileges to perform the following actions through the [Atlas UI:](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui) View and create databases and collections.; **UI only**: View, modify, and delete documents.  You can't read or write data using the Atlas Administration API.; View indexes. When combined with [`Project Index Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Index-Manager), also grants privileges to manage indexes.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs for all clusters in the project.; View the sample query field values in the [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-performance-advisor); View collection-level query latency with [Namespace Insights.](https://www.mongodb.com/docs/atlas/namespace-insights.md#std-label-namespace-insights); View collection-level query shape performance with [Query Shape Insights.](https://www.mongodb.com/docs/atlas/query-shape-insights.md#std-label-query-shape-insights); View query performance, including raw queries, in the [Query Profiler.](https://www.mongodb.com/docs/atlas/tutorial/query-profiler.md#std-label-query-profiler); View real-time performance in the [Real-Time Performance Panel.](https://www.mongodb.com/docs/atlas/real-time-performance-panel.md#std-label-real-time-metrics-status-tab); View documents using the Search Tester.; [Launch MongoDB Charts.](https://www.mongodb.com/docs/charts/launch-charts/); Download stream processing workspace audit logs.; [View stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-processing-instance.md#std-label-atlas-sp-manage-spi-view); [View connections in the connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connection-view) When you access data in Data Explorer, Atlas connects you with the system-generated `atlasDataAccessReadWrite` role on the `admin` database. To identify your Data Explorer operations in your [database audit logs](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing), filter for this role. |
|  | `GROUP_DATA_ACCESS_READ_ONLY` | Grants access to the [Data Explorer](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui), with the privileges to perform the following actions through the [Atlas UI:](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui) View databases and collections.; **UI only**: View documents. You can't read or write data using the Atlas Administration API.; View indexes. When combined with [`Project Index Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Index-Manager), also grants privileges to manage indexes.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs for all clusters in the project.; View the sample query field values in the [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-performance-advisor); View collection-level query latency with [Namespace Insights.](https://www.mongodb.com/docs/atlas/namespace-insights.md#std-label-namespace-insights); View collection-level query shape performance with [Query Shape Insights.](https://www.mongodb.com/docs/atlas/query-shape-insights.md#std-label-query-shape-insights); View query performance in the [Query Profiler.](https://www.mongodb.com/docs/atlas/tutorial/query-profiler.md#std-label-query-profiler); View real-time performance in the [Real-Time Performance Panel.](https://www.mongodb.com/docs/atlas/real-time-performance-panel.md#std-label-real-time-metrics-status-tab); View documents using the Search Tester.; [Launch MongoDB Charts.](https://www.mongodb.com/docs/charts/launch-charts/); Download stream processing workspace audit logs.; [View stream processing workspaces](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-processing-instance.md#std-label-atlas-sp-manage-spi-view); [View connections in the connection registry](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-connection-registry.md#std-label-atlas-sp-manage-connection-view) When you access data in Data Explorer, Atlas connects you with the system-generated `atlasDataAccessReadOnly` role on the `admin` database. To identify your Data Explorer operations in your [database audit logs](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing), filter for this role. |
|  | `GROUP_DATABASE_ACCESS_ADMIN` | Grants the privileges to perform the following actions: Manage [database access](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) for the clusters in a project.; Manage [custom database roles](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md#std-label-mongodb-roles) for the clusters in a project.; Retrieve the [database access logs](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) for the clusters in a project. This role doesn't grant access to do the following tasks: Create Atlas clusters.; Access the Data Explorer.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs. This role doesn't grant privileges to export snapshots. |
|  | `GROUP_BACKUP_MANAGER` | This role inherits the permissions of [`Project Backup Creator`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Backup-Creator), [`Project Backup Recovery Operator`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Backup-Recovery-Operator), and [`Project Backup Export Operator`.](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Backup-Export-Operator) Grants the privileges to perform the following actions: [Manage backups and restore data](https://www.mongodb.com/docs/atlas/backup-restore-cluster.md#std-label-backup-restore-cluster) to all clusters in a project.; Download and [export backups.](https://www.mongodb.com/docs/atlas/backup/cloud-backup/export.md#std-label-cloud-provider-snapshot-export); Manage cluster [backup policies.](https://www.mongodb.com/docs/atlas/backup/cloud-backup/configure-backup-policy.md#std-label-configure-backup-policy) This role doesn't grant access to do the following tasks: Create Atlas clusters.; Access the Data Explorer.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs.; Edit a [Backup Compliance Policy.](https://www.mongodb.com/docs/atlas/backup/cloud-backup/backup-compliance-policy.md#std-label-backup-compliance-policy) |
|  | `GROUP_BACKUP_CREATOR` | Grants privileges to perform the following actions on clusters that support backups: List backup snapshots.; Create on demand snapshots. |
|  | `GROUP_BACKUP_RECOVERY_OPERATOR` | Grants privileges to perform the following actions on clusters that support restoring from backups: List backup snapshots.; Recover clusters from backup snapshots. This role doesn't grant privileges to download or export backups. |
|  | `GROUP_BACKUP_EXPORT_OPERATOR` | Grants privileges to perform the following actions on clusters that support exporting backups: List backup snapshots.; Download or export backups. |
|  | `GROUP_NETWORK_ACCESS_MANAGER` | Grants privileges to update project network settings for the following: Access lists; [VPC peering](https://www.mongodb.com/docs/atlas/security-vpc-peering.md#std-label-vpc-peering); Private Link |
|  | `GROUP_OBSERVABILITY_VIEWER` | Grants the privileges to perform the following actions: View the sample query field values in the [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-pa-slow-queries); View collection-level query latency with [Namespace Insights.](https://www.mongodb.com/docs/atlas/namespace-insights.md#std-label-namespace-insights); View collection-level query shape performance with [Query Shape Insights.](https://www.mongodb.com/docs/atlas/query-shape-insights.md#std-label-query-shape-insights); View query performance, including raw queries, in the [Query Profiler.](https://www.mongodb.com/docs/atlas/tutorial/query-profiler.md#std-label-query-profiler); View real-time performance in the [Real-Time Performance Panel.](https://www.mongodb.com/docs/atlas/real-time-performance-panel.md#std-label-real-time-metrics-status-tab) This role doesn't grant access to do the following tasks: Create Atlas clusters.; Access the Data Explorer.; Retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs. |
|  | `GROUP_TRIGGER_MANAGER` | Grants privileges to create, update, and delete [triggers.](https://www.mongodb.com/docs/atlas/atlas-ui/triggers/database-triggers.md#std-label-atlas-database-trigger) |
|  | `GROUP_READ_ONLY` | Grants view-only access to the project control plane metadata. The user can view all activity, operational data, users, and user roles. The user, however, cannot access the [Data Explorer](https://www.mongodb.com/docs/atlas/atlas-ui.md#std-label-atlas-ui) or retrieve [process](https://www.mongodb.com/docs/atlas/mongodb-logs.md#std-label-mongodb-logs) and [audit](https://www.mongodb.com/docs/atlas/database-auditing.md#std-label-set-up-database-auditing) logs. The user can view cluster [metric charts.](https://www.mongodb.com/docs/atlas/monitor-cluster-metrics.md#std-label-monitor-cluster-metrics) Grants access to view connection details for [Stream Processing Workspaces.](https://www.mongodb.com/docs/atlas/atlas-stream-processing/manage-processing-instance.md#std-label-atlas-sp-manage-spi) Grants access to MongoDB Charts only if [invited](https://www.mongodb.com/docs/atlas/invitations.md#std-label-view-invitations) to the project by a [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner). The user, however, cannot access data from Charts, unless the [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) also grants them [data source access.](https://www.mongodb.com/docs/charts/manage-data-sources/#modify-role-permissions-for-data-sources) |
|  | `GROUP_INDEX_MANAGER` | Grants privileges to perform the following actions: View [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-performance-advisor); Create rolling indexes using [Performance Advisor.](https://www.mongodb.com/docs/atlas/performance-advisor.md#std-label-performance-advisor) When combined with [`Project Data Access Read Only`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Read-Only) or [`Project Data Access Read/Write`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Read-Write), also grants privileges to manage indexes in Data Explorer. This role alone doesn't grant privileges to access data through Data Explorer or MongoDB Charts. |
|  | `GROUP_SEARCH_INDEX_EDITOR` | Grants the privileges to perform the following actions: [Create Search Index.](https://www.mongodb.com/docs/search/indexes/manage-indexes.md#std-label-ref-create-index); [View Search Index.](https://www.mongodb.com/docs/search/indexes/manage-indexes.md#std-label-ref-view-index); [Edit Search Index.](https://www.mongodb.com/docs/search/indexes/manage-indexes.md#std-label-ref-edit-index); [Delete Search Index.](https://www.mongodb.com/docs/search/indexes/manage-indexes.md#std-label-ref-delete-index) |
|  | `GROUP_SHARDING_MANAGER` | Grants privileges to perform the following actions: View Sharding Insights metrics in the UI and API.; View sharding recommendations in the UI and API.; Start and stop query sampling and run the shard key analyzer.; [Create indexes.](https://www.mongodb.com/docs/atlas/atlas-ui/indexes.md#std-label-atlas-ui-create-index); Shard a replica set and add shards to sharded clusters. This role doesn't grant privileges to modify documents or access data through the Data Explorer. This role is available as part of the Sharding Insights and Sharding Advisor private preview. Access is limited to invited participants. |
|  | `GROUP_REAL_TIME_PERFORMANCE_OPERATOR` | Grants privileges to run the database [`killop`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killop). This role doesn't grant privilege to read or write data. |
|  | `GROUP_SUPPORT_ACCESS_MANAGER` | Grants users the ability to provide MongoDB support access to clusters and cluster logs. This doesn't include privileges to support access settings at the organization level. |
|  | `GROUP_ALERTS_MANAGER` | Grants privileges to perform the following actions: Create, view, update, and delete project alert settings.; View and update project alerts. |
|  | `GROUP_MODEL_OWNER` | Grants privileges to create and delete [Model API keys](https://www.mongodb.com/docs/voyageai/management/api-keys.md#std-label-voyage-api-keys) for the project. |