# Hierarchy level access

**URL:** <https://discuss.elastic.co/t/hierarchy-level-access/79156>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 19, 2017, 1:25am UTC](https://discuss.elastic.co/t/hierarchy-level-access/79156 "2017-03-19T01:25:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anja98](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anja98/32/16471_2.png) [@anja98](https://discuss.elastic.co/u/anja98)\
**Post date:** [March 19, 2017, 1:25am UTC](https://discuss.elastic.co/t/hierarchy-level-access/79156/1 "2017-03-19T01:25:42Z")

</div>

Hi,

I'd like to find out if Kibana support hierarchy level access.

For example, if an organisation has sub organisation and each sub has departments under it.

How can I create a department user login with access to only the department view the user belongs to?

How can I create a sub organisation user login with access its sub organisation view including all department under it?

How can I create an organisation user login with access to its organisation view including all sub organisation and all department under it?

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [March 27, 2017, 6:55am UTC](https://discuss.elastic.co/t/hierarchy-level-access/79156/2 "2017-03-27T06:55:13Z")

</div>

Hi @anja98,

Security in Kibana is currently divided into two parts:

1. The Kibana system user account is used to access the saved objects (visualization definitions, dashboards definitions, etc). All users that can log into Kibana have access to those.
2. The logged in user account is used to access the data shown in the visualizations and dashboards.

While it is therefore not yet possible to segregate the visualizations and dashboards by user, the full suite Elasticsearch Security features is available to secure the data themselves. Hierarchical groups as described can be implemented using the Active Directory Realm, which supports transitive group membership discovery.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2017, 6:55am UTC](https://discuss.elastic.co/t/hierarchy-level-access/79156/3 "2017-04-24T06:55:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.