# Granular Kibana permissions when creating users and roles

**URL:** <https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389>\
**Category:** Kibana\
**Created:** [February 24, 2021, 6:25pm UTC](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389 "2021-02-24T18:25:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhegarty](https://avatars.discourse-cdn.com/v4/letter/j/e495f1/32.png) [@jhegarty](https://discuss.elastic.co/u/jhegarty)\
**Post date:** [February 24, 2021, 6:25pm UTC](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389/1 "2021-02-24T18:25:27Z")

</div>

My team needs to set up specific user access to Kibana, and we haven't quite figured out the combination of roles and space privileges. We need a user that has all the permissions of a superuser, with the exception of acessing/updating snapshots and repositories, and updating users/roles security settings. Ideally, we'd like them to be able to manage snapshots without the ability to create new repositories, but that's a pretty extreme degree of granularity and not essential.

Is there a way to do this through the Kibana users and roles UI?

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [February 24, 2021, 6:52pm UTC](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389/2 "2021-02-24T18:52:52Z")

</div>

Hey @jhegarty,

This should get you pretty close on the Elasticsearch side, although I haven't tested this extensively:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba931495cdef02d636ae13c9dcd0529bf8b1e3fd.png)

And then for Kibana, you'll want to grant `All` access to every feature across all spaces:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/9/296f9ca6e16f7e52696af71ca4f28873cf149124.png)

You may also want to grant the `reporting_user` role as well as the `beats_admin` role in order to get access to Kibana reporting and Beats Central Management.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2021, 6:53pm UTC](https://discuss.elastic.co/t/granular-kibana-permissions-when-creating-users-and-roles/265389/3 "2021-03-24T18:53:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.