# Kibana Spaces Create Permissions

**URL:** <https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [December 7, 2018, 8:28pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978 "2018-12-07T20:28:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [December 7, 2018, 8:28pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/1 "2018-12-07T20:28:27Z")

</div>

In Kibana 6.5, is there any way to prevent kibana users from creating new spaces?  
I know once a space is created, you can set read/write permissions within it, but what is to prevent users from creating more spaces?

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [December 8, 2018, 11:57am UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/2 "2018-12-08T11:57:05Z")

</div>

Hey @Micah_Hunsberger,

It's possible! It's just a little confusing, and not well documented right now.

When configuring a user's roles, make sure you are not using roles that have the Kibana minimum privilege set to `all`. This setting allows users to create spaces:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/894ddfd1a0ea44ed57d28ea5d87d988cf588bbe3.jpeg)

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [December 10, 2018, 9:07pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/3 "2018-12-10T21:07:56Z")

</div>

Thank you, the built-in `kibana_user` role has this set to `all`.  
I assume that means you have to create a new role that is identical to the `kibana_user` role except have this setting set to read or none?

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [December 10, 2018, 9:40pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/4 "2018-12-10T21:40:00Z")

</div>

Okay so it looks like the Kibana ui for space privileges uses [Application Privileges](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/security-privileges.html#application-privileges) to manage access within Kibana.

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [December 10, 2018, 9:41pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/5 "2018-12-10T21:41:16Z")

</div>

Yes, the `kibana_user` role is a Kibana superuser of sorts, in that it grants access to all of Kibana. If you want to restrict access, then you'll want to create custom roles with either `none` or `read` as the minimum privilege.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2019, 9:41pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978/6 "2019-01-07T21:41:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.