Managing roles

Roles overview

In the context of Tanium™ role-based access control (RBAC), a role assigns allow permissions to specify allowed activities or deny permissions to specify prohibited activities. You assign roles to users, user groups, and personas to control what users can see and do in the Tanium Core Platform. For details on permissions, see permissions.

If you plan to import users and user groups from a Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server, do so before configuring or assigning roles. For details, see Integrating with LDAP servers.

The following figure shows the configurable components of the different role categories, and the order in which you assign the components:

For an overview of how roles relate to other RBAC configuration objects such as content sets, personas, users, user groups, and computer groups, see Tanium RBAC implementation and concepts.

Roles have a many-to-many relationship with users and user groups. For example, all Tanium Interact users can have the Interact Show module role, and each of those users can have additional custom roles that provide access to the sensors and questions that they use in Interact. Similarly, you can configure permissions for the same content set across multiple roles, and each role can specify permissions across multiple content sets.

As a best practice when configuring roles, take full advantage of their modularity and cumulative effect on user permissions. For example, instead of creating a single role with all the permissions that a particular user needs, and creating another role with only slightly different permissions for another user, create several roles with smaller but unique permissions sets. You can then mix and match these minimalistic roles among various users to achieve the same effective permissions as individual roles that have comprehensive permissions. For details, see Effective role permissions.

Some permissions that you assign to a role automatically provide additional permissions. For example, if you assign Package write permission, it implicitly provides Package read permission. For details, see Provided role permissions.

Users inherit roles from the user groups to which you assign those users. For details, see Inherited roles.

For a given Tanium Console session, only the permissions of the currently selected persona are available to a user, even if multiple personas are assigned to that user. For details, see Managing personas.

Allow and deny roles

On the Roles page, the Type column indicates if a role allows or denies permissions. You can assign multiple allow and deny roles to a user or user group. TaaSThe Tanium Server bases the effective permissions of a user or group on the cumulative effect of all the roles that are assigned to that user or group: all explicitly granted or implicitly provided allow permissions minus explicit deny permissions.

You can view the effective permissions of a user or user group in the Tanium Console: see Effective role permissions.

In custom roles, a permission and content set in the deny role must match a permission and content set in the allow role to negate the allow permission. In the following example, the deny Package write permission on Content Set A matches the allow Package write permission on Content Set A, so the allow permission is negated.

In the following example, the deny Package write permission on Content Set D does not match any allow permissions. Therefore, the deny permission has no impact on the effective permissions of the user.

When you assign content sets to permissions in custom roles, the Add all Content Sets that exist or will exist to the permissions option is equivalent to listing every content set. The following figure illustrates an example where the deny Package write permission on Content Set D has an effect.

Allow and deny matching also applies to administration permissions. In the following example, the user has one allow role and two deny roles that specify administration permissions. TaaSThe Tanium Server factors out exact matches between allow and deny permissions. The user has all of the capabilities that the allow role specifies, minus the capabilities that the deny roles specify.

Provided role permissions

Some permissions automatically provide additional permissions because of dependencies. For example, the Package write permission that enables creating packages depends on the Package read permission that enables accessing the Packages page. Similarly, the Interact Execute action permission that enables action deployment depends on the Action write permission that enables action configuration.

In allow roles, every write permission implicitly provides the associated read permission. In the following example, the custom role that is assigned to Eric and Grace has the Package write permission on the specified content sets, and therefore the configuration does not need to specify the Package read permission. A role that has only the Package read permission on the same content set is created for users who must have read-only permissions, like Bob in this example.

Deny roles do not implicitly provide associated permissions. For deny roles to have an effect, they must explicitly specify permissions and those permissions must exactly match the permissions that an allow role specifies. For example, if a deny role specifies that Package write permission is denied on a content set, the role does not also deny Package read permission. In the following example, the deny role permissions do not exactly match any allow role permissions. Therefore, the deny role is disregarded and Bob still has Package read permission on the specified content sets.

Some module permissions and platform content permissions implicitly provide additional permissions because of dependencies that are unrelated to read-write associations. For example, the Interact Execute action permission provides several additional permissions that are required to deploy and configure actions.

Provided permission automatically apply to content set assignments. For example, if you assign the Action write permission to the Base content set, it automatically provides Package read permission for the Base content set. If you assign Sensor write permission to the Default content set, it automatically provides Sensor read permission for the Default content set.

The configuration pages for roles, users, user groups, and personas use different icons to distinguish between explicitly assigned and implicitly provided permissions. See Effective role permissions.

Inherited roles

Users inherit role permissions from their user groups. In the following example, Eric inherits permissions from the roles that are assigned to the NOC user group. He also has permissions that are assigned directly to his user account. TaaSThe Tanium Server enforces the net effect. In this example, even though Eric inherits the Isolated Subnets write permission and Separated Subnets write permission from the user group, the deny role that is assigned directly to his user account negates those permissions. Because no deny roles are assigned to the accounts of Bob and Grace, they have all the permissions that are inherited from the user group, including Isolated Subnets and Separated Subnets write permissions.

Reserved roles

The predefined reserved roles assign permissions for a range of tasks that, in many organizations, are commonly exclusive to a few users. For example, organizations typically have a small set of users who oversee all Tanium operations and require the full administrative permissions that the Administrator reserved role provides. Reserved roles can include special permissions, such as managing the Tanium license, that are not available to non-reserved roles.ReservedIn addition to the special permissions, reserved roles can have some or all of the platform content, administration, and module permissions that are associated with other roles. You cannot edit or delete reserved roles. Special logic applies when you assign both a reserved role and non-reserved role to a user or user group, as described in the following sections.

Admin reserved role

Assign the Admin reserved role to users who manage all Tanium content, modules, shared services, and administrative functionality.

This role can perform the following tasks:

• Use all Tanium solutions and content

• Configure all Tanium Core Platform settings (such as bandwidth throttles) and customize the Tanium Console

• View, create, edit, delete, and export all RBAC configurations, including users, user groups, personas, roles, computer groups, and API tokens

• View, create, edit, delete, and export all content configurations such as sensors, packages, and scheduled actions

When you assign the Admin role, other allow roles are superfluous and deny roles are ineffective, with the following exceptions:

• Bypass Action Approval: A custom role with the Bypass Action Approval permission does have effect when it is assigned to a user who has the Admin reserved role. The Admin reserved role does not have this permission by default. Due to the sensitive nature of bypassing approval, you must explicitly assign this permission in all cases.
• Deny All: The Deny All reserved role negates all the permissions of the Admin reserved role.

During the setup of your Tanium as a Service (TaaS) deployment, an initial administrator account is created with the Admin role. You can use this account to configure RBAC for all other users, including other users who might need the Admin role.

Administrator reserved role

Assign the Administrator reserved role to users who manage all Tanium content, modules, shared services, and administrative functionality.

This role can perform the following tasks:

• Import, export, update, uninstall, and use all Tanium solutions and content

• Configure all Tanium Core Platform settings (such as bandwidth throttles) and customize the Tanium Console

• Manage the Tanium license and manage trust among platform components (such as Tanium Servers and Zone Servers)

• View, create, edit, delete, import, and export all RBAC configurations, including users, user groups, personas, roles, computer groups, LDAP connections, SAML IdP connections, and API tokens

• View, create, edit, delete, import, and export all content configurations such as sensors, packages, and scheduled actions

When you assign the Administrator role, other allow roles are superfluous and deny roles are ineffective, with the following exceptions:

• Bypass Action Approval: An advanced role with the Bypass Action Approval permission does have effect when it is assigned to a user who has the Administrator reserved role. The Administrator reserved role does not have this permission by default. Due to the sensitive nature of bypassing approval, you must explicitly assign this permission in all cases.
• Deny All: The Deny All reserved role negates all the permissions of the Administrator reserved role.

Content Set Administrator reserved role

Assign the Content Set Administrator reserved role to users who manage content set and role configurations.

This role can perform the following tasks:

• View, create, edit, delete, import, or export content set configurations

• Manage content assignments to content sets

• View, create, edit, delete, import, or export user role configurations

• Manage role assignments to users, user groups, and personas

The Content Set Administrator role makes all other allow roles superfluous. The Deny All reserved role is the only role that can affect a user who has the Content Set Administrator role.

Notice the result when both the Content Set Administrator and Administrator roles are assigned. Only the Content Set Administrator role remains effective. Be careful not to assign the Content Set Administrator role to users who must have other roles. Be careful not to assign (directly or by user group inheritance) the Content Set Administrator role to users who are assigned the Administrator role.

Content Administrator reserved role

Assign the Content Administrator reserved role to users who manage content and actions.

This role can perform the following tasks:

• View, create, edit, and delete all content configurations (such as sensors, packages, and saved questions) across all content sets

• View, create, edit, deploy, and delete actions

When the Tanium Server evaluates effective permissions for a user who has the Content Administrator role, the server disregards the content permissions in other roles but evaluates other types of permissions.

Deny All reserved role

Assign the Deny All reserved role to user accounts that must be disabled even though they are not yet deleted.

Users who have the Deny All role cannot access anything in the Tanium Core Platform, regardless of any other role that you assign to them, including the Administrator reserved role. In the following example, the only role assigned to Frank that has any effect is Deny All.

Tasks that require reserved roles

To perform the following tasks, a user must have a reserved role because the tasks are not associated with administration permissions that you can assign to custom roles.

 Table 1: Tasks requiring a reserved role

Task	Administrator	Content Administrator	Content Set Administrator
Manage content sets Create, edit, or delete content set configurations.
Manage role configurations and assignments Edit roles and edit the role assignments of users, user groups, and personas.
Manage Tanium solutions Manage Tanium solutions (modules, shared services, and content packs) on the Administration > Configuration > Solutions page. Users can still import solutions if they have a role with the Import Signed Content permission and export solutions if they have a role with the Export Content permission.
Manage Tanium Core Platform configuration View or manage many of the Administration > Configuration pages, including those for proxy settings, logging levels, plugins, plugin schedules, sensor threshold indicators, package file repository, Tanium licenses, Tanium root keys, trust among Tanium Core Platform servers, LDAP servers, SAML, and Tanium Console customizations.

Effective role permissions

The effective permissions of a user are based on the cumulative effect of all the assigned and inherited roles, including the following:

• Permissions specified in allow roles minus permissions specified in deny roles
• Implied permissions in allow roles
• Roles that are assigned to the persona that a user selects for a Tanium Console session
• Roles inherited from a persona that is assigned to user groups, after the user selects that persona for a Tanium Console session

In the user and user group configuration pages, the Permissions section uses the following icons to indicate effective permissions:

	Allow permission that you must explicitly assign.
	Allow permission that you must explicitly assign and that automatically provides additional permissions because of dependencies. For example, when you assign the Interact Module write permission, it automatically provides the Ask Dynamic Questions permission. See Provided role permissions.
	Deny permission.

The user and user group configuration pages list the Admin reserved roleAdministrator, Content Administrator, and Content Set Administrator reserved roles under Global Permissions if you assign that role. However, when you view the configuration page for a custom role in Edit Mode, the Global Permissions are hidden because you cannot assign them.

You can expand each of the module content permissions, Platform Content Permissions, and Global Permissions to list the content sets to which the permission applies:

	Content set that is explicitly assigned to the permission.
	Content set that is assigned because another permission implicitly provides it.

The configuration pages for users, user groups, and personas also list the assigned Content Sets by content type. For implicitly provided permissions , hover over the icon to show a tool tip that indicates how the permission was derived from an explicit permission .

To review effective permissions:

• View effective permissions for a user
• View effective permissions for a user group
• View effective permissions for a persona

View role details

1. From the Main menu, go to Administration > Permissions > Roles.

   The page displays each role name and category, and the number of users, user groups, and personas to which each role is assigned. The Total Users column indicates the sum of all the users who are assigned the role through their user accounts or who inherit the role from user groups.

2. (Optional) To display attributes that the grid hides by default, click Customize Columns and select the attributes.
3. (Optional) Use the filters to find specific roles:
   • Filter by text: To filter the grid by column values, enter a text string in the Filter items field.
   • Filter by attribute: Filter the grid by one or more attributes, such as the Role Name. Expand the Filters section, click Add, select an attribute and operator, enter a text string that contains all or part of the attribute value, and click Apply. If you add multiple attribute filters, the Boolean AND operator applies. After you finish specifying attributes, click Apply All to filter the grid.
   • Filter by category: By default, the grid shows roles of All categories but you can click a Category button to show only System roles or Custom roles.
   • Filter by type: By default, the grid shows roles of All types but you can click a Type button to show only Allow or Deny roles. See Allow and deny roles.
4. (Optional) To see the permissions, personas, users, and user groups that are assigned to a role, click the Role Name.

   To view or edit the configuration of an assigned user or user group, click the user or group name.

Configure a custom role

Create or edit a custom role that assigns administration, platform content, and module permissions.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Perform one of the following steps:
   • To create a role, click New Role.
   • To edit a role, click a Role Name and click Edit Mode.
3. Specify a Role Name to identify the role.
4. Set the Permission Type to Allow or Deny.

   The Permissions section lists all the permissions that you can assign by clicking an icon in the Special, Read, Write, Execute, or Delete column. You can click an icon in a column header to select all the permissions of that type. For example, in the Administration permissions header, click the Special icon to assign all the available special administration permissions. The lists use gray icons to indicate unassigned permissions and the following colored icons to indicate assigned permissions:

   	Permission that you must explicitly assign.
   	Permission that you must explicitly assign and that automatically provides additional permissions because of dependencies. See Provided role permissions.
   	Permission that is automatically enabled because another permission provides it.

   A later step in this procedure explains how to assign content sets to permissions that are associated with content.

   To assign roles to personas, see Manage role assignments for a persona.

5. (Optional) To manage user assignments, expand the Users section, click Manage Users, select or deselect users, and click Select.
   If you are editing a role that already has users assigned, click the number above the Users field in the Role Details section to scroll to the Users section and expand it.

   To view or edit the configuration of a particular user, click the user Name in the Users section. The Edit User page opens in a new tab.

6. (Optional) To manage user groups assignments, expand the User Groups section, click Manage User Groups, select the groups, and click Select.
   If you are editing a role that already has user groups assigned, click the number above the User Groups field in the Role Details section to scroll to the User Groups section and expand it.

   To view or edit the configuration of a particular group, click the group Name in the User Groups section. The Edit User Group page opens in a new tab.

7. Expand the Administration section and select any of the following permissions that the role requires.

   To create a role that can perform all administrative tasks in the Tanium Console, assign the Permission Administrator permission and the write permissions for User, User Group, Computer Group, and Persona. The Admin reserved role has all these permissions.

    Table 2: Administration permissions

   Permission	Description
   Permission Administrator	Provides the following administration permissions as a bundle: Read permissions for User, User Group, Role, Persona, and Content Set Write permissions for Role and Content Set Grant permission for Role
   Action Group	Read permission enables users to view and export action group configurations in the Scheduled Actions page. Write permission enables users to create, edit, and delete action group configurations. Write permission provides the Action Group read permission.
   Allowed URLs	Read permission enables users to view allowed URL configurations on the Allowed URLs page and to export the configurations in CSV format. The Export Content administrationmicro admin permission is required to export in JSON format. Write permission enables users to create, edit, and delete allowed URL configurations. Write permission provides Allowed URLs read permission.
   Audit	Read permission enables users to view: Last Sign In information on the Users page Last Modified information on the user configuration page Last Modification information on the Platform Settings page
   Computer Group	Read permission enables users to view computer management groups and export them in CSV format. The Export Content permission is required to export in JSON format. Additional permissions are required to view the user group, user, and persona assignments of computer management groups: see Manage computer management groups. Write permission enables users to create, edit, and delete computer management groups. Write permission provides the Computer Group read permission. To create a computer management group in which membership is based on a sensor filter, users require the following permissions in addition Computer Group write: Sensor (platform content): Read permission on the Reserved content set, which includes content that is used to ask preview questions Interact Module (module): Write permission Computer groups with manually defined membership do not require the Sensor read or Interact Module write permissions.
   Export Content	Enables users to export the following content types in JSON format: Allowed URLs Computer management groups Content sets Filter groups Packages Roles Saved questions Scheduled actions Sensors Only the Administrator reserved role can export categories and dashboards.
   Import Signed Content	Enables users to import digitally signed content files into the Tanium Server.
   Global bandwidth throttles	Read permission enables users to view global bandwidth throttles on the Bandwidth Throttles page. Write permission enables users to create, edit, and delete global bandwidth throttles.
   Global Settings	Read permission enables users to view the global settings of Tanium Core Platform servers and Tanium Clients on the Platform Settings page. Write permission enables you to edit, create, or delete platformglobal settings. Write permission provides the Global Settings read permission.
   Isolated Subnets	Read permission enables users to view and export isolated client subnet configurations on the Administration > Configuration > Subnets page. Write permission enables users to create, edit, and delete isolated client subnet configurations. Write permission provides Isolated Subnets read permission.
   Persona	Read permission enables users to view and export persona configurations. The Permission Administrator permission provides the Persona read permission. Write permission enables users to create, edit, and delete personas when combined with the Permission Administrator permission. Write permission provides the Persona read permission. Users require additional permissions to edit the assignment of other RBAC objects (such as users) to personas: see Manage personas.
   Public Key	Read permission enables Tanium REST API users to download the Tanium public key (tanium.pub) or initialization file (tanium-init.dat). Only the Administrator reserved role can access the Infrastructure page to download those files through the Tanium Console.
   Question History	Read permission enables users to view the Question History page. To issue a question from the Question History page, users also require the following permissions: Interact module permissions: Interact show Interact Module read Platform Content Permissions: Saved Question read permission on the content sets that contain the questions that the user is allowed to issue. Sensor read permission on the content sets that contain the sensors that are used in the questions that the user is allowed to issue.
   Separated Subnets	Read permission enables users to view and export separated client subnet configurations on the Subnets page. Write permission enables users to create, edit, and delete isolated client subnet configurations. Write permission provides Separated Subnets red permission.
   Server Status	Read permission enables users to view the https://<Tanium_Server>/info page. For details, see View the info page.
   Subnet bandwidth throttles	Read permission enables users to view site-specific bandwidth throttles on the Bandwidth Throttles page. Write permission enables users to create, edit, and delete site-specific bandwidth throttles.
   Client Status	Read permission enables users to view the Client Status page.
   Token - Revoke	Enables users to create or revoke API tokens that are used to access TaaSthe Tanium Server.
   Token - Use	Enables users to send requests to the TaaSthe Tanium Server for new API tokens.
   Token - View	Enables users to view the API Tokens page.
   User	Read permission enables users to view and export user configurations on the Users page. Write permission enables users to create, edit, and delete user configurations. Write permission provides User read permission. Additional permissions are required to view and edit the role, user group, and persona assignments of users: see Manage users.
   User Group	Read permission enables users to view and export user group configurations on the User Groups page. Write permission enables users to create, edit, and delete user group configurations. Write permission provides User Group read permission. Additional permissions are required to view and edit the role, user, and persona assignments of user groups: see Manage user groups.
   Management Rights	Read permission enables users to view the computer management group assignments of users, user groups, and personas when combined with the Read Computer Group permission. Management Rights write permission is one of the permissions that are required to edit the computer management group assignments of users, user groups, and personas. For additional required permissions, see Manage computer management groups. Management Rights read and write are not explicit permissions; the Permission Administrator permission provides them.
   Content Set	Read permission enables users to view content set configurations. Write permission enables users to: Create, edit, and delete content sets Move content between content sets Export content sets in CSV format. The Export Content administration permission is required to export in JSON format. These are not explicit permissions; the Permission Administrator permission provides them.
   Role	Read permission enables users to view role configurations and export them in CSV format. The Export Content permission is required to export in JSON format. Write permission enables users to create, edit, and delete role configurations. Grant permission is one of the permissions that are required to edit the role assignments of users, user groups, and personas. These are not an explicit permissions; the Permission Administrator permission provides them. Users require the following combined permissions to manage role assignments: Permission Administrator and User write permissions are required to edit the role assignments of users. Permission Administrator and User Group write permissions are required to edit the role assignments of user groups. Permission Administrator and Persona write permissions are required to edit the role assignments of personas.

8. For each module that has permissions you want to assign, expand the <module name> section and select the permissions.

   See the module user guides for information about the required permissions for module-specific roles:

   • Asset
   • Client Management
   • Comply
   • Connect
   • Deploy
   • Direct Connect
   • Discover
   • Endpoint Configuration
   • End-User Notifications
   • Enforce
   • Health Check
   • Impact
   • Integrity Monitor
   • Interact
   • Map
   • Network Quarantine
   • Patch
   • Performance
   • Reputation
   • Reveal
   • Threat Response
   • Trends
9. Expand the Platform Content Permissions section and select any permissions that the role requires:

    Table 3: Platform content permissions

   Permission	Description
   Action	Action read permission enables users to perform the following tasks on the Scheduled Actions, All Pending Approvals, and Action History pages: View actions. The visibility of specific actions (grid rows) depends on Action read permission on the content set for the associated packages. Export the actions in CSV format. The Export Content administration permission is required to export actions in JSON format. Copy the actions to the clipboard. View action status, when combined with other content permissions: see View action status. Action read and write permissions enable users to perform the following tasks on the Scheduled Actions, All Pending Approvals, and Action History pages: Reissue or edit actions, when combined with Sensor read permissions on the Reserved content set. The Reserved content set includes content that is used to ask preview questions. View the status of, and re-download, packages that are associated with actions. Disable or enable actions. Change the action groups that actions target. Create copies of action configurations. Delete actions. Stop actions. Action read permission provides Own Action read permission. Action write permission provides Own Action read, Package read, and Show Preview permissions.
   Action for Saved Question	Write permission enables users to: Access the Scheduled Actions page and see the actions they have deployed. See and use the Deploy Action button on the Question Results grid for saved questions that have associated packages. The Package read permission is not required for the associated packages. If the saved question does not have associated packages, the Deploy Action button does not appear. Write permission provides Own Action read and Show Preview permissions. Use the Action for Saved Question write permission instead of the Action write permission to limit use by action users who use Tanium products to execute standard operating procedures that someone else created.
   Approve Action	Enables users to perform the following tasks on the Actions I Can Approve page: View actions that require approval. Users cannot view their own actions on this page. Approve actions that other users own, when combined with Sensor read permission. Users cannot approve their own actions. Export the actions in CSV format. Export Content (administration) permission is required to export actions in JSON format. Copy the actions to the clipboard.
   Bypass Action Approval	Actions created by a user with this permission are not subject to approval requirements. No role, including the Administrator reserved role, includes this permission by default. This is the one platform content permission that has effect when granted to a user with the Administrator role.
   Dashboard	Read permission enables users to view dashboards in the Interact Content page, if those users also have Interact show permission. The users also require read permissions for Saved Question and Sensor on related content to use the dashboard. Write permission enables users to create, edit, and delete dashboard configurations. Write permission providesDashboard read permission.
   Dashboard Group	Read permission enables users to view categories in the Interact Content page, if those users also have Interact show permission. Users also require read permissions for Dashboard, Saved Question, and Sensor on the related content to use the category. Write permission enables users to create, modify, and delete category configurations. Write permission provides the Category read permission.
   Filter Group	Read permission enables users to: View the Filter Groups page Use filter groups for filtering questions, question results, and various lists in the Tanium Console Export filter groups in CSV format. The Export Content administration permission is required to export in JSON format. Write permission enables users to create, edit, and delete filter group configurations. Write permission provides the Filter Group read permission.
   Own Action	Enables users to perform the following tasks on their own actions (not those of other users) on the Scheduled Actions, All Pending Approvals, and Action History pages: View the actions. Export the actions in CSV format. The Export Content administration permission is required to export actions in JSON format. Copy the actions to the clipboard. View action status, when combined with other content permissions: see View action status. The following permissions provide Own Action read permission: Action read Action write Action for Saved Question write User cannot create their own actions unless they have Action write and Interact Module read permissions.
   Package	Read permission enables users to: View packages in the Deployment Package list of the Action Deployment page. View packages in the Packages page. Export packages in CSV format. The Export Content administration permission is required to export in JSON format. Write permission enables users to create, edit, and delete package configurations. Write permission provides Package read and Show Preview permissions.
   Associated Packages	Associated Packages read permission is not an explicit permission; the Action for Saved Question write permission provides Associated Packages read permission.
   Plugin	Reserved for future use.
   Saved Question	Read permission enables users to: View saved questions in the Question Results grid drill-down and similar user interfaces. View saved questions in the Interact Overview page, if the user also has Interact show permission. Issue saved questions, if the user also has Sensor read permission on the content sets that contain the sensors in those questions. View the Saved Questions page. Export saved questions in CSV format. The Export Content administration permission is required to export in JSON format. Write permission enables users to create, edit, and delete saved question configurations. Write permission provides Saved Question read permission but does not provide Ask Dynamic Questions permission.
   Sensor	Read permission enables users to: View sensor configurations. View sensors in the Question Builder and similar user interfaces throughout the Tanium Console. Use sensors in questions if the user also has the ability to ask questions. Write permission enables users to create, edit, and delete sensor configurations. Write permission providesSensor read and Show Preview permissions.
   Show Preview	Show Preview is not an explicit permission. The write permissions for Action, Action for Saved Question, Sensor, and Package provide Show Preview. Show Preview enables users to ask questions that are necessary to preview the impact of new and changed action, sensor, and package configurations. To ask preview questions, the user also needs Sensor read permission on the Reserved content set, which includes content that is used to ask the preview questions.

10. (Optional) Review all the permissions that you selected.

    At the top right of the page, click Preview to display only the permissions that you selected. When you finish reviewing, click Edit Mode to continue configuring the role.

11. Assign Content Sets to the pertinent module content permissions and Platform Content Permissions that you selected:
    • To assign all existing and future content sets to all the pertinent content permissions that you selected, select Add all Content Sets that exist or will exist to the permissions selected above. This option is useful, for example, when you want a user to always be able to read sensors or never be able to write actions, regardless of content set assignments.
    • To assign specific content sets to all the pertinent content permissions that you selected, click Apply Content SetsAdd Content Sets, select the sets, and click Select. The Content Sets selection dialog shows a check mark for any contents sets that are already assigned to all the selected permissions and shows a dash — for content sets that are applied to some (but not all) of the selected permissions.

      Content sets that you assign through the Content Sets selection dialog override content set assignments for individual permissions. For example, if you previously assigned the Interact content set specifically to the Sensor read permission but then deselect that content set during the Apply Content Sets workflow, the Sensor read permission does not apply to the Interact content set.

    • To assign specific content sets to a specific permission:

      1. Scroll to the Permissions section and click the number beside the permission icon, such as:

         

      2. Select the content sets and click Select.

         Content sets that you assign to specific permissions are added to any previous assignments. For example, if you assigned the Base content set to all pertinent content permissions (Apply Content Sets workflow) and subsequently assigned the Interact content set specifically to the Sensor read permission, then both the Base and Interact content sets are assigned to the Sensor read permission.

    To review the content set assignments for a specific permission, expand it in the Permissions section. The following icons indicate how a content set permission is derived:

    	Content set that is explicitly assigned to the permission.
    	Content set that is assigned because another permission implies or provides it.

    To review the content set assignments for all permissions, see the Content Sets grid. The following grid icons indicate how a content set permission is derived:

    	Content set that you explicitly assigned.
    	Content set that you explicitly assigned and that is associated with a permission that automatically provides or implies additional permissions because of dependencies.
    	Content set that is automatically assigned because it has a dependency with another permission.

    To create a custom content set without leaving the role configuration page, click New Content Set, enter a Name to identify the set, and click Save.

12. Click Save.

Manage user and user group assignments for a role

To assign roles to personas, see Manage role assignments for a persona.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Click the Role Name and click Edit Mode.
3. Expand the Users section, click Manage Users, select or deselect users, and click Select.
   If you are editing a role that already has users assigned, click the number above the Users field in the Role Details section to scroll to the Users section and expand it.

   To view or edit the configuration of a particular user, click the user Name in the Users section. The Edit User page opens in a new tab.

4. Expand the User Groups section, click Manage User Groups, select or deselect groups, and click Select.
   If you are editing a role that already has user groups assigned, click the number above the User Groups field in the Role Details section to scroll to the User Groups section and expand it.

   To view or edit the configuration of a particular user group, click the group Name in the User Groups section. The Edit User Group page opens in a new tab.

5. Review the user and user group assignments, and then click Save.

Clone a role

To add a role that has many settings in common with an existing role, cloning the existing role and then modifying the clone is often a quicker method than configuring a new role. You can clone any role except the reserved roles.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Select a role and click Clone.
3. Enter a Role Name to identify the role, update the permissions as needed (see Configure a custom role), and click Save.
4. Assign users and user groups to the role (see Manage user and user group assignments for a role).

Export and import roles

Export roles as a CSV file to view their settings in an application that supports that format. If your user account has a role with the Export Content permission, you can also export roles as a JSON file to import them into another Tanium Server. The Administrator reserved role has that permission.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Select rows in the grid to export only specific roles. If you want to export all roles, skip this step.
3. Click Export .
4. (Optional) Edit the default export File Name.

   The file suffix (.csv or .json) changes automatically based on the Format selection.

5. Select an Export Data option: All roles in the grid or just the Selected roles.
6. Select the file Format: JSON or CSV.
7. Click Export.

   TaaSThe Tanium Server exports the file to the downloads folder on the system that you used to access the Tanium Console.

Copy role configuration details

Copy information from the Roles page to your clipboard to paste the information into a message, text file, or spreadsheet. Each row in the grid is a comma-separated value string.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Perform one of the following steps:
   • Copy row information: Select one or more rows and click Copy .
   • Copy cell information: Hover over the cell, click Options , and click Copy .

Delete a role

Deleting a role removes it from any user, user group, and persona to which it was assigned.

To delete a role:

1. From the Main menu, go to Administration > Permissions > Roles.
2. Select the role and click Delete .