> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Ops Manager Roles

Ops Manager roles allow you to grant users different levels of access to Ops Manager. You can grant a user the privileges needed to perform a specific set of tasks and no more.

If you use LDAP (Lightweight Directory Access Protocol) authentication for Ops Manager, you must:

1. Create LDAP (Lightweight Directory Access Protocol) groups for each available role that follows.

2. Assign users to these LDAP (Lightweight Directory Access Protocol) groups.

Neither the LDAP (Lightweight Directory Access Protocol) server nor Ops Manager synchronizes the groups and roles without user intervention.

To assign user roles, see [Edit a User's or Team's Role in a Project](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-users.md#std-label-assign-roles-to-users). You can't assign your own roles.

## Organization Roles

| Ops Manager Organization Role | Privileges |
| --- | --- |
|  | An Ops Manager user with this organization role can: Grants root access to the organization.; Grants [`Project Owner`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Owner) access to all projects in the organization, even if added to a project with a non-Owner role.; Use any privilege granted to any organization role.; Administer organization settings.; Add, edit, or delete users to the organization.; Delete the organization. |
|  | An Ops Manager user with this organization role can: Create projects in the organization.; Use any privilege granted to the [`Organization Member`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Organization-Member) role. |
|  | An Ops Manager user with this organization role can grant read-only access to everything in the organization, including all projects in the organization. |
|  | An Ops Manager user with this organization role can grant read-only access to the organization (settings, users, and billing) and the projects to which they belong. Within a project, an  [`Organization Member`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Organization-Member)'s project role sets their project privileges. A [`Project User Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-User-Admin) or [`Owner`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Owner) can add a new Ops Manager user to a project. This also adds this new Ops Manager user to that project's organization. |

## Project Roles

The following roles grant privileges within a project.

| Ops Manager Project Role | Privileges |
| --- | --- |
|  | An Ops Manager user with this project role can view most project components, including all: Activity; Operational data; Ops Manager Users; Ops Manager User roles. This user can't modify or delete anything. |
|  | An Ops Manager user with this project role can: Add an existing Ops Manager user to a project. If the added user does not currently belong to the organization, the user will be added to the organization as well.; Invite a new Ops Manager user to a project. After the Ops Manager user accepts the invite, Ops Manager also adds this user to the organization.; Remove an existing project invitation.; Deny a user's request to join a project. This can deny the user access to the project depending on the user's role in the organization.; Remove a user from a project.; Modify a user's role within a project. |
|  | An Ops Manager user with this project role can: Use the [Data Explorer.](https://www.mongodb.com/docs/ops-manager/current/data-explorer.md)With the [Data Explorer](https://www.mongodb.com/docs/ops-manager/current/data-explorer.md), the Ops Manager user with this role can:View, create, and drop databases, collections, and indexes.; View, modify, and delete documents.; Use any privilege granted to the [`Project Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Read-Only) role.; Kill an operation in the [Real Time Performance Panel.](https://www.mongodb.com/docs/ops-manager/current/view-real-time-metrics.md#std-label-real-time-metrics-status-tab); View the sample query field values in the [Monitor and Improve Slow Queries.](https://www.mongodb.com/docs/ops-manager/current/tutorial/performance-advisor.md) |
|  | An Ops Manager user with this project role can: Use the [Data Explorer](https://www.mongodb.com/docs/ops-manager/current/data-explorer.md). With the [Data Explorer](https://www.mongodb.com/docs/ops-manager/current/data-explorer.md), the Ops Manager user with this role can:View and create databases and collections.; View, modify, and delete documents.; View indexes.; View the sample query field values in the [Monitor and Improve Slow Queries.](https://www.mongodb.com/docs/ops-manager/current/tutorial/performance-advisor.md) |
|  | An Ops Manager user with this project role can: View databases, collections, and indexes in the [Data Explorer](https://www.mongodb.com/docs/ops-manager/current/data-explorer.md); View the sample query field values in the [Monitor and Improve Slow Queries.](https://www.mongodb.com/docs/ops-manager/current/tutorial/performance-advisor.md) |
|  | An Ops Manager user with this project role can: Use any privilege granted to the [`Project Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Read-Only) role.; Administer alerts (create, modify, delete, enable/disable, acknowledge/unacknowledge).; Manage hosts (add, edit, delete).; Download Monitoring. |
|  | An Ops Manager user with this project role can: Use any privilege granted to the [`Project Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Read-Only) role.; Manage [backups](https://www.mongodb.com/docs/ops-manager/current/tutorial/nav/backup-deployments.md#std-label-back-up-mdb), including:Starting, stopping, and terminating backups.; Requesting restores.; Viewing and editing the namespaces filter.; Viewing and editing host passwords.; Modifying backup settings.; Generating SSH keys.; Downloading the MongoDB Agent. |
|  | An Ops Manager user with this project role can: Use any privilege granted to the [`Project Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Read-Only) role.; View deployments.; Provision machines.; Edit configuration files.; Download the MongoDB Agent. |
|  | An Ops Manager user with this project role can: Use any privilege granted to any of the other project roles.; Configure the [Backup](https://www.mongodb.com/docs/ops-manager/current/tutorial/nav/backup-deployments.md#std-label-back-up-mdb) service.A user with [`Organization Owner`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Organization-Owner) role has [`Project Owner`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Owner) access for all projects in the organization, even if added to a project with a non-Owner role. |

## Global Roles

Global roles have all the same privileges as the equivalent Organization and Project roles, except that they have these privileges for all projects and organizations. They also have some additional privileges as noted in the following table.

The following roles grant privileges for all projects and organizations.

| Ops Manager Global Role | Description |
| --- | --- |
|  | Grants [`Project Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Read-Only) access to all projects and [`Organization Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Organization-Read-Only) for all organizations. The role additionally grants access to do the following: View [backups](https://www.mongodb.com/docs/ops-manager/current/tutorial/nav/backup-deployments.md#std-label-back-up-mdb) and other statistics through the admin console.; Global user search. |
|  | Grants [`Project User Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-User-Admin) access to all projects and all organizations. The role additionally grants access to do the following: Manage console messages.; Send test emails, SMS messages, and voice calls.; Edit user accounts.; Manage LDAP group mappings for organization and project roles. |
|  | Grants [`Project Monitoring Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Monitoring-Admin) access to all projects. The role additionally grants access to do the following: View system statistics through the admin console. |
|  | Grants [`Project Backup Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Backup-Admin) access to all projects. The role additionally grants access to do the following: View system statistics through the admin console.; Manage blockstore, daemon, and oplog store configurations.; Move jobs between daemons.; Approve backups in awaiting provisioning state. |
|  | Grants [`Project Automation Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Automation-Admin) access to all projects. The role additionally grants access to view system statistics through the admin console. |
|  | Grants privileges from all roles combined except those required to access Data Explorer: [`Project Data Access Admin`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Admin); [`Project Data Access Read/Write`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Read-Write); [`Project Data Access Read Only`](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles.md#mongodb-authrole-Project-Data-Access-Read-Only) |