> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Built-In Roles MongoDB grants access to data and commands through [role-based authorization](https://www.mongodb.com/docs/manual/core/authorization.md#std-label-roles). MongoDB provides built-in roles that grant the different levels of access commonly needed in a database system. A role grants privileges to perform sets of [actions](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#std-label-security-user-actions) on defined [resources](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-document). A role applies to the database on which it is defined and can grant access down to a collection level of granularity. Each built-in role defines access at the database level for all non-system collections in the role's database and at the collection level for all system collections. *System collections* include those in: - `.system.*` namespace - `local.replset.*` replica set namespace *Non-system collections* are those not in namespaces in the previous list. MongoDB Atlas database users have different built-in roles than self-hosted deployment users. However, MongoDB builds the built-in roles for each type of deployment from the same set of [privilege actions.](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#std-label-security-user-actions) Use the selector at the top of the page to choose your deployment type and see the available built-in roles. ## MongoDB Atlas Built-In Roles This section describes the MongoDB Atlas built-in roles and the [MongoDB Roles](https://www.mongodb.com/docs/manual/core/security-built-in-roles/) they represent. Create database users and assign built-in roles in the MongoDB Atlas user interface. To learn more, see [Add Database Users.](https://www.mongodb.com/docs/atlas/security-add-mongodb-users/#add-database-users) To learn more about common commands that MongoDB Atlas does not support with the current MongoDB Atlas user privileges, see [Unsupported Commands.](https://www.mongodb.com/docs/atlas/unsupported-commands.md#std-label-paid-tier-command-limitations) ### Atlas-Only Roles The following roles are available only in MongoDB Atlas and have no corresponding self-managed MongoDB role. Provides the ability to view and kill active operations, and manage sessions. On the [cluster](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-cluster) as a whole, provides the following actions: - [`inprog`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-inprog) - [`killop`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killop) - [`killAnySession`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killAnySession) - [`listSessions`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSessions) Provides the ability to run the [`autoCompact`](https://www.mongodb.com/docs/manual/reference/command/autocompact.md#mongodb-dbcommand-dbcmd.autoCompact) command to enable background compaction. Background compaction periodically iterates through available files and releases unneeded disk space to the operating system. To learn more about authentication requirements for [`autoCompact`](https://www.mongodb.com/docs/manual/reference/command/autocompact.md#mongodb-dbcommand-dbcmd.autoCompact), see [Required Privileges.](https://www.mongodb.com/docs/manual/reference/command/autocompact.md#std-label-autocompact-authentication) On the [cluster](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-cluster) as a whole, provides the following action: - [`compact`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compact) Provides the ability to manage shard balancer settings, including range size and balancer status. To learn more about shard balancing, see [Sharded Cluster Balancer.](https://www.mongodb.com/docs/manual/core/sharding-balancer-administration.md#std-label-sharding-balancing) On the [`config.settings`](https://www.mongodb.com/docs/manual/reference/config-database.md#mongodb-data-config.settings) collection, provides the following actions: - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) ### Protected MongoDB Database Namespaces Avoid writing to the `admin`, `local`, and `config` databases, or any database prefixed with `__mdb_internal_`. MongoDB Atlas manages multiple collections in these databases. To learn more, see [Internal Databases](https://www.mongodb.com/docs/atlas/reference/internal-database.md#std-label-cloud-system-databases) and [System Collections.](https://www.mongodb.com/docs/manual/reference/system-collections.md#std-label-metadata-system-collections) [`atlasAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-atlasrole-atlasAdmin) has the [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) privilege on the `config.settings` collection to manage the balancer. ### Built-in Roles and Inherited Privileges In the following table, indicates that the operation also supports timeseries collections. | MongoDB Atlas Built-in Role | MongoDB Role | Inherited Roles or Privilege Actions | | --- | --- | --- | | | | This role allows you to use [`setQuerySettings`](https://www.mongodb.com/docs/manual/reference/command/setquerysettings.md#mongodb-dbcommand-dbcmd.setQuerySettings), [`removeQuerySettings`](https://www.mongodb.com/docs/manual/reference/command/removequerysettings.md#mongodb-dbcommand-dbcmd.removeQuerySettings), and [`$querySettings`.](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querysettings.md#mongodb-pipeline-pipe.-querySettings) [`analyzeShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-analyzeShardKey) [`autoCompact`](https://www.mongodb.com/docs/manual/reference/command/autocompact.md#mongodb-dbcommand-dbcmd.autoCompact)[backup](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-backup)[`checkMetadataConsistency`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-checkMetadataConsistency)[`cleanupOrphaned`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-cleanupOrphaned)[`clearJumboFlag`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-clearJumboFlag) [clusterMonitor](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-clusterMonitor)[`compact`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compact)[dbAdminAnyDatabase](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-dbAdminAnyDatabase)[enableSharding](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-enableSharding) [`flushRouterConfig`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-flushRouterConfig) [`killAnyCursor`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killAnyCursor)[`moveChunk`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveChunk) [`querySettings`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-querySettings)[readWriteAnyDatabase](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-readWriteAnyDatabase)[`refineCollectionShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-refineCollectionShardKey) [`reshardCollection`](https://www.mongodb.com/docs/manual/reference/change-events/reshardcollection.md#mongodb-data-reshardCollection) [`shardedDataDistribution`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-shardedDataDistribution) `splitChunk` [`viewRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-viewRole) | | | `backup` | [backup](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-backup) | | | `clusterMonitor` | [clusterMonitor](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-clusterMonitor) | | | `dbAdmin` | [dbAdmin](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-dbAdmin) | | | `dbAdminAnyDatabase` | [dbAdminAnyDatabase](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-dbAdminAnyDatabase) | | | `enableSharding` | [enableSharding](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-enableSharding) | | | `read` | [read](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-read) | | | `readWrite` | [readWrite](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-readWrite) | | | `readWriteAnyDatabase` | [readWriteAnyDatabase](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-readWriteAnyDatabase) | | | `readAnyDatabase` | [readAnyDatabase](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-atlas-readAnyDatabase) | | | | [`killOpSession`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-killOpSession) | | | | [`autoCompact`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-atlasrole-autoCompact) | | | | [`manageShardBalancer`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-manageShardBalancer) | ### MongoDB Built-In Role Descriptions The following are the MongoDB built-in roles used by MongoDB Atlas built-in roles. | MongoDB Role | Description | | --- | --- | | `backup` | Provides minimal privileges needed for backing up data. This role provides sufficient privileges to use the [MongoDB Cloud Manager](https://www.mongodb.com/products/tools/cloud-manager) backup agent, [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/) backup agent, or to use [`mongodump`](https://www.mongodb.com/docs/database-tools/mongodump.md#mongodb-binary-bin.mongodump) to back up an entire [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) instance. | | `clusterMonitor` | Provides read-only access to monitoring tools, such as the [MongoDB Cloud Manager](https://www.mongodb.com/products/tools/cloud-manager) and [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/) monitoring agent. | | `dbAdmin` | Provides the ability to perform administrative tasks such as schema-related tasks, indexing, and gathering statistics. This role does not grant privileges for user and role management. | | `dbAdminAnyDatabase` | Provides the same privileges as [`dbAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdmin) on all databases except `local` and `config`. The role also provides the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole. | | `enableSharding` | Provides the ability to enable sharding for a collection and modify existing shard keys. | | `read` | Provides read access to all *non*-system collections and the [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection. | | `readAnyDatabase` | Provides the same read-only privileges as [`read`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-read) on all databases except `local` and `config`. The role also provides the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole. This role grants permissions on database resources, not cluster administrative resources. | | `readWrite` | Provides all privileges of the [`read`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-read) role plus the ability to modify data on all *non*-system collections and the [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection. | | `readWriteAnyDatabase` | Provides the same privileges as [`readWrite`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWrite) on all databases except `local` and `config`. The role also provides: the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole; the [`compactStructuredEncryptionData`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compactStructuredEncryptionData) action This role grants permissions on database resources, not cluster administrative resources. | ## Learn More If built-in roles do not meet your requirements, create user-defined roles. For more information, see [Configure Custom Database Roles.](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md#std-label-mongodb-roles) ## Self-Managed Deployment Built-In Roles MongoDB provides the following built-in roles in self-managed deployments. To view the privileges for a built-in role, run the [`rolesInfo`](https://www.mongodb.com/docs/manual/reference/command/rolesinfo.md#mongodb-dbcommand-dbcmd.rolesInfo) command with the `showPrivileges` and `showBuiltinRoles` fields both set to `true`. The following command shows the privileges for the `readWrite` role: ```javascript db.getRole("readWrite", { showPrivileges: true, showBuiltinRoles: true } ) ``` **Output:** ```javascript { db: 'test', role: 'readWrite', roles: [], privileges: [ { resource: { db: 'test', collection: '' }, actions: [ 'changeStream', 'cleanupStructuredEncryptionData', 'collStats', 'compactStructuredEncryptionData', 'convertToCapped', 'createCollection', 'createIndex', 'createSearchIndexes', 'dbHash', 'dbStats', 'dropCollection', 'dropIndex', 'dropSearchIndex', 'find', 'insert', 'killCursors', 'listCollections', 'listIndexes', 'listSearchIndexes', 'updateSearchIndex', 'planCacheRead', 'performRawDataOperations', 'remove', 'renameCollectionSameDB', 'update' ] }, { resource: { db: 'test', collection: 'system.js' }, actions: [ 'changeStream', 'cleanupStructuredEncryptionData', 'collStats', 'compactStructuredEncryptionData', 'convertToCapped', 'createCollection', 'createIndex', 'createSearchIndexes', 'dbHash', 'dbStats', 'dropCollection', 'dropIndex', 'dropSearchIndex', 'find', 'insert', 'killCursors', 'listCollections', 'listIndexes', 'listSearchIndexes', 'updateSearchIndex', 'planCacheRead', 'performRawDataOperations', 'remove', 'renameCollectionSameDB', 'update' ] } ], inheritedRoles: [], inheritedPrivileges: [ { resource: { db: 'test', collection: '' }, actions: [ 'changeStream', 'cleanupStructuredEncryptionData', 'collStats', 'compactStructuredEncryptionData', 'convertToCapped', 'createCollection', 'createIndex', 'createSearchIndexes', 'dbHash', 'dbStats', 'dropCollection', 'dropIndex', 'dropSearchIndex', 'find', 'insert', 'killCursors', 'listCollections', 'listIndexes', 'listSearchIndexes', 'updateSearchIndex', 'planCacheRead', 'performRawDataOperations', 'remove', 'renameCollectionSameDB', 'update' ] }, { resource: { db: 'test', collection: 'system.js' }, actions: [ 'changeStream', 'cleanupStructuredEncryptionData', 'collStats', 'compactStructuredEncryptionData', 'convertToCapped', 'createCollection', 'createIndex', 'createSearchIndexes', 'dbHash', 'dbStats', 'dropCollection', 'dropIndex', 'dropSearchIndex', 'find', 'insert', 'killCursors', 'listCollections', 'listIndexes', 'listSearchIndexes', 'updateSearchIndex', 'planCacheRead', 'performRawDataOperations', 'remove', 'renameCollectionSameDB', 'update' ] } ], isBuiltin: true } ``` ### Database User Roles Every database includes the following client roles: Provides read access to all *non*-system collections and the [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection. **Note:** This role does not provide privileges to directly access the `system.namespaces` collection. The role provides read access by granting the following [actions:](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#std-label-security-user-actions) - [`changeStream`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changeStream) - [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats) - [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash) - [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats) - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors) - [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections) - [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes) - [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes) Users without the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) privilege action can run the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/command/listdatabases.md#mongodb-dbcommand-dbcmd.listDatabases) command to return a list of databases for which they have privileges. This includes databases where the user has privileges on specific collections. Run the command with the `authorizedDatabases` option unspecified or set to `true`. Provides all privileges of the [`read`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-read) role plus the ability to modify data on all *non*-system collections and the [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection. The role provides the following actions on those collections: - [`changeStream`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changeStream) - [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats) - [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`createSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createSearchIndexes) - [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash) - [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`dropIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropIndex) - [`dropSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropSearchIndex) - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors) - [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections) - [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes) - [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes) - [`remove`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-remove) - [`renameCollectionSameDB`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-renameCollectionSameDB) - [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) ### Database Administration Roles Every database includes the following database administration roles: Provides the ability to perform administrative tasks such as schema-related tasks, indexing, and gathering statistics. This role does not grant privileges for user and role management. The role provides the following privileges: | Resource | Permitted Actions | | --- | --- | | [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) | [`changeStream`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changeStream); [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats); [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped); [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection); [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash); [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats); [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection); [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find); [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors); [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections); [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes); [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes); [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | | All *non*-system collections([database resource)](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-specific-db) | [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation); [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod); [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats); [`compact`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compact); [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped); [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection); [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex); [`createSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createSearchIndexes); [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats); [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection); [`dropDatabase`](https://www.mongodb.com/docs/manual/reference/change-events/dropdatabase.md#mongodb-data-dropDatabase); [`dropIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropIndex); [`dropSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropSearchIndex); [`enableProfiler`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-enableProfiler); [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections); [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes); [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes); [`planCacheIndexFilter`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheIndexFilter); [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead); [`planCacheWrite`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheWrite); [`reIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-reIndex); [`renameCollectionSameDB`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-renameCollectionSameDB); [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex); [`validate`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-validate) For these collections, [`dbAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdmin) does not include full read access such as [`find`.](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) | The database owner can perform any administrative action on the database. This role combines the privileges granted by the [`readWrite`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWrite), [`dbAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdmin) and [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) roles. Provides the ability to create and modify roles and users on the current database. The [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role allows users to grant any privilege to any user, including themselves. This role also indirectly provides [superuser](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-superuser) access to either the database or, if scoped to the `admin` database, the cluster. The [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role explicitly provides the following actions: - [`changeCustomData`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changeCustomData) - [`changePassword`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changePassword) - [`createRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createRole) - [`createUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createUser) - [`dropRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropRole) - [`dropUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropUser) - [`grantRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-grantRole) - [`revokeRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-revokeRole) - [`setAuthenticationRestriction`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-setAuthenticationRestriction) - [`viewRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-viewRole) - [`viewUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-viewUser) **Warning:** Understand the security implications of granting the [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role. A user with this role for a database can assign themselves any privilege on that database. Granting the [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role on the `admin` database has further security implications as this indirectly provides [superuser](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-superuser) access to a cluster. With `admin` scope, a user with the [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role can grant cluster-wide roles or privileges including [`userAdminAnyDatabase`.](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) ### Cluster Administration Roles The `admin` database includes the following roles for administering the whole system rather than just a single database. These roles include but are not limited to [replica set](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-replica-set) and [sharded cluster](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-sharded-cluster) administrative functions. Provides the greatest cluster-management access. This role combines the privileges granted by the [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager), [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor), and [`hostManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-hostManager) roles. The role also provides these additional permissions: - [`dropDatabase`](https://www.mongodb.com/docs/manual/reference/change-events/dropdatabase.md#mongodb-data-dropDatabase) action - [`setQuerySettings`](https://www.mongodb.com/docs/manual/reference/command/setquerysettings.md#mongodb-dbcommand-dbcmd.setQuerySettings) and [`removeQuerySettings`](https://www.mongodb.com/docs/manual/reference/command/removequerysettings.md#mongodb-dbcommand-dbcmd.removeQuerySettings) database commands - [`$querySettings`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/querysettings.md#mongodb-pipeline-pipe.-querySettings) aggregation stage Provides management and monitoring actions on the cluster. Users with this role can access the `config` and `local` databases, which are used in sharding and replication, respectively. Additionally, the role provides the [`querySettings`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-querySettings) action. | Resource | Actions | | --- | --- | | [cluster](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-cluster) | [`addShard`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-addShard); [`appendOplogNote`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-appendOplogNote); [`applicationMessage`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-applicationMessage); [`checkMetadataConsistency`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-checkMetadataConsistency) (New in version 7.0); [`cleanupOrphaned`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-cleanupOrphaned); [`flushRouterConfig`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-flushRouterConfig); [`getClusterParameter`](https://www.mongodb.com/docs/manual/reference/command/getclusterparameter.md#mongodb-dbcommand-dbcmd.getClusterParameter); [`getDefaultRWConcern`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getDefaultRWConcern); [`listSessions`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSessions); [`listShards`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listShards); [`moveCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveCollection) (MongoDB 8.0 and later); [`removeShard`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-removeShard); [`replSetConfigure`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetConfigure); [`replSetGetConfig`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetGetConfig); [`replSetGetStatus`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetGetStatus); [`replSetStateChange`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetStateChange); [`resync`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-resync); [`rewriteCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-rewriteCollection) (MongoDB 8.3 and later); [`setClusterParameter`](https://www.mongodb.com/docs/manual/reference/command/setclusterparameter.md#mongodb-dbcommand-dbcmd.setClusterParameter); [`setDefaultRWConcern`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-setDefaultRWConcern); [`setFeatureCompatibilityVersion`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-setFeatureCompatibilityVersion); [`transitionFromDedicatedConfigServer`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-transitionFromDedicatedConfigServer); [`transitionToDedicatedConfigServer`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-transitionToDedicatedConfigServer); [`unshardCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-unshardCollection) (MongoDB 8.0 and later) | | *All* [databases](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-specific-db) | [`analyzeShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-analyzeShardKey) (New in version 7.0); [`clearJumboFlag`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-clearJumboFlag); [`configureQueryAnalyzer`](https://www.mongodb.com/docs/manual/reference/command/configurequeryanalyzer.md#mongodb-dbcommand-dbcmd.configureQueryAnalyzer); [`enableSharding`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-enableSharding); [`moveChunk`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveChunk); [`refineCollectionShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-refineCollectionShardKey); [`reshardCollection`](https://www.mongodb.com/docs/manual/reference/change-events/reshardcollection.md#mongodb-data-reshardCollection); [`rewriteCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-rewriteCollection) (MongoDB 8.3 and later) [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager) provides additional privileges for the `config` and `local` databases. | On the `config` database, permits the following actions: | Resource | Actions | | --- | --- | | All non-system collections in the `config` database | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats); [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash); [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats); [`enableSharding`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-enableSharding); [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find); [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert); [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors); [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections); [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes); [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes); [`moveChunk`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveChunk); [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead); [`remove`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-remove); [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) | | [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats); [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash); [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats); [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find); [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors); [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections); [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes); [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes); [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | On the `local` database, permits the following actions: | Resource | Actions | | --- | --- | | All non-system collections in the `local` database | [`enableSharding`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-enableSharding); [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert); [`moveChunk`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveChunk); [`remove`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-remove); [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) | | [`system.replset`](https://www.mongodb.com/docs/manual/reference/local-database.md#mongodb-data-local.system.replset) collection | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats); [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash); [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats); [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find); [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors); [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections); [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes); [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes); [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | Provides read-only access to monitoring tools, such as the [MongoDB Cloud Manager](https://www.mongodb.com/products/tools/cloud-manager) and [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/) monitoring agent. Permits the following actions on the cluster as a whole: - [`connPoolStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-connPoolStats) - [`getCmdLineOpts`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getCmdLineOpts) - [`getDefaultRWConcern`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getDefaultRWConcern) - [`getLog`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getLog) - [`getParameter`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getParameter) - [`getShardMap`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getShardMap) - [`hostInfo`](https://www.mongodb.com/docs/manual/reference/command/hostinfo.md#mongodb-data-hostInfo) - [`inprog`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-inprog) - [`listClusterCatalog`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listClusterCatalog) - [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) - [`listSessions`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSessions) - [`listShards`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listShards) - [`replSetGetConfig`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetGetConfig) - [`replSetGetStatus`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-replSetGetStatus) - [`serverStatus`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-serverStatus) - [`shardingState`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-shardingState) - [`top`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-top) Permits the following actions on *all* databases in the cluster: - [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats) - [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats) - [`indexStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-indexStats) - [`useUUID`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-useUUID) Permits the [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) action on all [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collections in the cluster. On the `config` database, permits the following actions: | Resource | Actions | | --- | --- | | All non-system collections in the `config` database | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats)[`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash)[`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats)[`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find)[`indexStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-indexStats)[`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors)[`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections)[`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes)[`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes)[`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | | [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats)[`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash)[`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats)[`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find)[`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors)[`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections)[`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes)[`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | On the `local` database, permits the following actions: | Resource | Actions | | --- | --- | | All non-system collections in the `local` database | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats)[`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash)[`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats)[`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find)[`indexStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-indexStats)[`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors)[`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections)[`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes)[`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes)[`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | | [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection | [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats)[`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash)[`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats)[`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find)[`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors)[`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections)[`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes)[`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes)[`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) | | [`system.replset`](https://www.mongodb.com/docs/manual/reference/local-database.md#mongodb-data-local.system.replset),[`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile), | [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) | Starting in MongoDB 8.0, you can use the [`directShardOperations`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-directShardOperations) role to perform maintenance operations that require you to execute commands directly against a shard. **Warning:** Running commands using the `directShardOperations` role can cause your cluster to stop working correctly and may cause data corruption. Only use the `directShardOperations` role for maintenance purposes or under the guidance of MongoDB support. Stop using the `directShardOperations` role when you finish performing maintenance operations. Provides the ability to enable sharding for a collection and modify existing shard keys. Provides the following actions on all non-system collections: - [`analyzeShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-analyzeShardKey) - [`enableSharding`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-enableSharding) - [`moveCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-moveCollection) (MongoDB 8.0 and later) - [`refineCollectionShardKey`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-refineCollectionShardKey) - [`reshardCollection`](https://www.mongodb.com/docs/manual/reference/change-events/reshardcollection.md#mongodb-data-reshardCollection) - [`rewriteCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-rewriteCollection) (MongoDB 8.3 and later) - [`unshardCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-unshardCollection) (MongoDB 8.0 and later) Provides the ability to monitor and manage servers. On the cluster as a whole, provides the following actions: - [`applicationMessage`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-applicationMessage) - [`closeAllDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-closeAllDatabases) - [`compact`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compact) (New in version 7.3) - [`connPoolSync`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-connPoolSync) - [`flushRouterConfig`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-flushRouterConfig) - [`fsync`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-fsync) - [`invalidateUserCache`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-invalidateUserCache) - [`killAnyCursor`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killAnyCursor) - [`killAnySession`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killAnySession) - [`killop`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killop) - [`logRotate`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-logRotate) - [`oidReset`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-oidReset) - [`resync`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-resync) - [`rotateCertificates`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-rotateCertificates) (New in version 5.0) - [`setParameter`](https://www.mongodb.com/docs/manual/reference/configuration-options.md#mongodb-setting-setParameter) - [`shutdown`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-shutdown) - [`touch`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-touch) - [`unlock`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-unlock) On *all* databases in the cluster, provides the following actions: - [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors) Provides [`readAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readAnyDatabase) privileges and write permissions on the `__mdb_internal_search` database. **Important:** Do not modify the contents of the `__mdb_internal_search` database. On the cluster as a whole, provides the following action: - [`bypassDefaultMaxTimeMS`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDefaultMaxTimeMS) ### Backup and Restoration Roles The `admin` database includes the following roles for backing up and restoring data: Provides minimal privileges needed for backing up data. This role provides sufficient privileges to use the [MongoDB Cloud Manager](https://www.mongodb.com/products/tools/cloud-manager) backup agent, [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/) backup agent, or to use [`mongodump`](https://www.mongodb.com/docs/database-tools/mongodump.md#mongodb-binary-bin.mongodump) to back up an entire [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) instance. Provides the [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) and [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) actions on the [`settings`](https://www.mongodb.com/docs/manual/reference/config-database.md#mongodb-data-config.settings) collection in the `config` database. On [`anyResource`](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-anyResource), provides the following actions: - [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) - [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections) - [`listIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listIndexes) - [`listSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listSearchIndexes) On the [cluster](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-cluster) as a whole, provides the following actions: - [`appendOplogNote`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-appendOplogNote) - [`getParameter`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getParameter) - [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) - [`serverStatus`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-serverStatus) - [`setUserWriteBlockMode`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-setUserWriteBlockMode) (Starting in MongoDB 6.0) Provides the [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) action on the following: - All *non*-system collections in the cluster, including those in the `config` and `local` databases - The following system collections in the cluster: [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) and [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) - The [`admin.system.users`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.users) and [`admin.system.roles`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.roles) collections - The [`config.settings`](https://www.mongodb.com/docs/manual/reference/config-database.md#mongodb-data-config.settings) collection - Legacy `system.users` collections from versions of MongoDB prior to 2.6 Provides the [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) and [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) actions on the [`config.settings`](https://www.mongodb.com/docs/manual/reference/config-database.md#mongodb-data-config.settings) collection. The [`backup`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-backup) role provides additional privileges to back up the [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection that exists when running with [database profiling.](https://www.mongodb.com/docs/manual/tutorial/manage-the-database-profiler.md#std-label-database-profiling) Provides [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped) on non-system collections. Provides the necessary privileges to restore data from backups if the data does not include [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection data and you run [`mongorestore`](https://www.mongodb.com/docs/database-tools/mongorestore.md#mongodb-binary-bin.mongorestore) without the [`--oplogReplay`](https://www.mongodb.com/docs/database-tools/mongorestore.md#std-option-mongorestore.--oplogReplay) option. You need additional privileges if the backup data includes [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection data or you run with [`--oplogReplay`:](https://www.mongodb.com/docs/database-tools/mongorestore.md#std-option-mongorestore.--oplogReplay) | `system.profile` | If the backup data includes [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection data and the target database does not contain the [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection, [`mongorestore`](https://www.mongodb.com/docs/database-tools/mongorestore.md#mongodb-binary-bin.mongorestore) attempts to create the collection even though the program does not actually restore `system.profile` documents. The user requires additional privileges to perform [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) and [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped) actions on the [`system.profile`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.profile) collection for a database. Both the built-in roles [`dbAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdmin) and [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) provide the additional privileges. | | --- | --- | | `--oplogReplay` | To run with [`--oplogReplay`](https://www.mongodb.com/docs/database-tools/mongorestore.md#std-option-mongorestore.--oplogReplay), create a [user-defined role](https://www.mongodb.com/docs/manual/tutorial/manage-users-and-roles.md#std-label-create-user-defined-role) that has [`anyAction`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-anyAction) on [`anyResource`.](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-anyresource) Grant only to users who must run [`mongorestore`](https://www.mongodb.com/docs/database-tools/mongorestore.md#mongodb-binary-bin.mongorestore) with [`--oplogReplay`.](https://www.mongodb.com/docs/database-tools/mongorestore.md#std-option-mongorestore.--oplogReplay) | Provides the following action on the cluster as a whole: - [`getParameter`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-getParameter) Provides the following actions on all *non*-system collections: - [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation) - [`changeCustomData`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changeCustomData) - [`changePassword`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-changePassword) - [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod) - [`convertToCapped`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-convertToCapped) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`createRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createRole) - [`createSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createSearchIndexes) - [`createUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createUser) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`dropRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropRole) - [`dropUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropUser) - [`grantRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-grantRole) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`revokeRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-revokeRole) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) - [`viewRole`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-viewRole) - [`viewUser`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-viewUser) Provides the following actions on [`system.js`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.js) collection: - [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation) - [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) Provides the following action on [`anyResource`:](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-anyResource) - [`listCollections`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listCollections) Provides the following actions on all non-system collections on the `config` and the `local` databases: - [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation) - [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) Provides the following actions on [`admin.system.version`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.version) - [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation) - [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) Provides the following action on [`admin.system.roles`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.roles) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) Provides the following actions on [`admin.system.users`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.users) and legacy `system.users` collections: - [`bypassDocumentValidation`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDocumentValidation) - [`collMod`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collMod) - [`createCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createCollection) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`insert`](https://www.mongodb.com/docs/manual/reference/change-events/insert.md#mongodb-data-insert) - [`remove`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-remove) - [`update`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-update) - [`updateSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-updateSearchIndex) [`restore`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-restore) includes the ability to modify the documents in the [`admin.system.users`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.users) collection using normal modification operations. However, only modify these data using the [user management methods.](https://www.mongodb.com/docs/manual/reference/method.md#std-label-user-management-methods) Provides the following action on the [`.system.views`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data--database-.system.views) collection: - [`dropCollection`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropCollection) (Starting in MongoDB 6.0) On the [cluster](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-cluster) as a whole, provides the following actions: - [`bypassWriteBlockingMode`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassWriteBlockingMode) (Staring in MongoDB 6.0) - [`setUserWriteBlockMode`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-setUserWriteBlockMode) (Starting in MongoDB 6.0) ### All-Database Roles The following roles are available on the `admin` database and provide privileges that apply to all databases except `local` and `config`: Provides the same read-only privileges as [`read`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-read) on all databases except `local` and `config`. The role also provides the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole. This role grants permissions on database resources, not cluster administrative resources. See also the [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager) and [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) roles for access to the `config` and `local` databases. Provides the same privileges as [`readWrite`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWrite) on all databases except `local` and `config`. The role also provides: - the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole - the [`compactStructuredEncryptionData`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-compactStructuredEncryptionData) action This role grants permissions on database resources, not cluster administrative resources. See also the [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager) and [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) roles for access to the `config` and `local` databases. Provides the same access to user administration operations as [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) on all databases except `local` and `config`. [`userAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) also provides the following privilege actions on the cluster: - [`authSchemaUpgrade`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-authSchemaUpgrade) - [`invalidateUserCache`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-invalidateUserCache) - [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) The role provides the following privilege actions on the [`system.users`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.users) and [`system.roles`](https://www.mongodb.com/docs/manual/reference/system-collections.md#mongodb-data-admin.system.roles) collections on the `admin` database, and on legacy `system.users` collections from versions of MongoDB prior to 2.6: - [`collStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-collStats) - [`createIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createIndex) - [`createSearchIndexes`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-createSearchIndexes) - [`dbHash`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbHash) - [`dbStats`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dbStats) - [`dropIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropIndex) - [`dropSearchIndex`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-dropSearchIndex) - [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) - [`killCursors`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-killCursors) - [`planCacheRead`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-planCacheRead) The [`userAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) role does not restrict the privileges that a user can grant. As a result, [`userAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) users can grant themselves privileges in excess of their current privileges and even can grant themselves *all privileges*, even though the role does not explicitly authorize privileges beyond user administration. This role is effectively a MongoDB system [superuser.](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#std-label-superuser) See also the [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager) and [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) roles for access to the `config` and `local` databases. Provides the same privileges as [`dbAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdmin) on all databases except `local` and `config`. The role also provides the [`listDatabases`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-listDatabases) action on the cluster as a whole. See also the [`clusterManager`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterManager) and [`clusterMonitor`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterMonitor) roles for access to the `config` and `local` databases. Starting in MongoDB 5.0, [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) includes the [applyOps](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#std-label-internal-actions) privilege action. ### Superuser Roles Several roles provide either indirect or direct system-wide superuser access. The following roles provide the ability to assign any user any privilege on any database. Users with one of these roles can assign *themselves* any privilege on any database: - [`dbOwner`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbOwner) role, when scoped to the `admin` database - [`userAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdmin) role, when scoped to the `admin` database - [`userAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) role The following role provides full privileges on all resources: Provides access to the operations and all the resources of the following combined roles: - [`readWriteAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-readWriteAnyDatabase) - [`dbAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-dbAdminAnyDatabase) - [`userAdminAnyDatabase`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-userAdminAnyDatabase) - [`clusterAdmin`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-clusterAdmin) - [`restore`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-restore) - [`backup`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-backup) Also provides the following privilege actions: - [`validate`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-validate) on `system.` collections. - On MongoDB 8.0 and later, [`bypassDefaultMaxTimeMS`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-bypassDefaultMaxTimeMS), which causes all queries run by the user to ignore the value of [`defaultMaxTimeMS`.](https://www.mongodb.com/docs/manual/reference/cluster-parameters/defaultmaxtimems.md#mongodb-parameter-param.defaultMaxTimeMS) **Changed in version 6.0** The [`root`](https://www.mongodb.com/docs/manual/reference/built-in-roles.md#mongodb-authrole-root) role includes [`find`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-find) and [`remove`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-remove) privileges on the `system.preimages` collection in the `config` database. ### Internal Role MongoDB assigns this role to user objects that represent cluster members, such as replica set members and [`mongos`](https://www.mongodb.com/docs/manual/reference/program/mongos.md#mongodb-binary-bin.mongos) instances. The role entitles its holder to take any action against any object in the database. **Do not** assign this role to user objects representing applications or human administrators, other than in exceptional circumstances. If you need access to all actions on all resources, for example to run [`applyOps`](https://www.mongodb.com/docs/manual/reference/command/applyops.md#mongodb-dbcommand-dbcmd.applyOps) commands, do not assign this role. Instead, [create a user-defined role](https://www.mongodb.com/docs/manual/tutorial/manage-users-and-roles.md#std-label-create-user-defined-role) that grants [`anyAction`](https://www.mongodb.com/docs/manual/reference/privilege-actions.md#mongodb-authaction-anyAction) on [`anyResource`](https://www.mongodb.com/docs/manual/reference/resource-document.md#std-label-resource-anyresource) and ensure that only the users who need access to these operations have this access. ## Learn More If built-in roles do not meet your requirements, create user-defined roles. For more information, see [User-Defined Roles on Self-Managed Deployments.](https://www.mongodb.com/docs/manual/core/security-user-defined-roles.md#std-label-user-defined-roles)