--- title: "Creating Roles" canonical: "https://docs.infoblox.com/space/BloxOneCloud/35366719/Creating%20Roles" format: markdown --- In addition to the predefined roles listed in *[Viewing Roles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35431123)*, you can create custom roles by choosing granular permissions based on your business needs. Depending on the Infoblox Platform license entitlements you currently have, you can select specific permissions to customize a user role. Unlike the predefined roles in which the permissions are restricted to a specific Infoblox service, a custom role gives you the flexibility to include granular permissions across different Infoblox services. Since you only get the permissions you explicitly select, Infoblox strongly recommends that you map out the permissions and follow the best practices to ensure that the selected permissions work properly together to deliver the expected results for the users. # Best Practices for Custom Roles To ensure that a custom role functions properly, consider the following: - When creating a custom role for Infoblox Portal users, you must include the following permissions: **Tag Update,** **Tag Read**, **Tag Delete**, and **On-Prem Host View**. Otherwise, certain tasks and pages might not function properly. To create custom roles with granular permissions, complete the following: 1. Log in to Infoblox Portal. 2. Go to** ****System** > **Administration** > **User Access** >** Roles.** 3. Click **Create Role**. 4. In the **Create Role** dialog, complete the following: - **Name**: Specify a name for the role. - **Description**: Specify a brief description for the role. - **FEATURES**: This section displays the available permissions for your Infoblox services. Select the check boxes of all applicable permissions you want to assign to this role. Depending on your license entitlement, the permissions you select in this section might or might not be applicable for the user role. You can click **All** to select all the permissions for a specific service or **None** to deselect the permissions. For any "**View**" permissions, the user role is granted read-only permission. For "**Manage**" permissions, the user role is granted read/write permission. 5. Click **Save & Close**. # Examples of Roles The following use cases provide examples on how to configure Role-Based Access Control: ## Example 1: Reports-Only User **Use Case: **A user who only needs access to reports and report outputs, without configuration or object-management permissions. Suitable for compliance officers, security analysts, or management personnel who need visibility into DNS, DHCP, and security activity data. *This role does not map to any single predefined role. The closest predefined roles are DDI DNS Auditor and DDI DHCP Auditor, but neither covers security reports. A custom role is required.* ### Recommended Permissions | | | | --- | --- | | **Permission** | **Description** | | **Scheduled Reports V2 Read** | Allows the user to view existing scheduled reports and their outputs. | | **Scheduled Reports V2 Manage** | Allows the user to create, edit, and delete scheduled reports. Add only if the user must author reports. | | **DNS Activity Reports** | Provides read access to DNS activity and query data reports. | | **B1DDI DHCP Reports** | Provides read access to DHCP lease and activity reports. | | **B1DDI DNS Reports** | Provides read access to DNS zone and record activity reports. | | **Security Activity Report** | Provides read access to threat intelligence and security event reports. | | **Tag Read** | Required base permission for all Infoblox Portal custom roles. | | **Tag Update** | Required base permission for all Infoblox Portal custom roles. | | **Tag Delete** | Required base permission for all Infoblox Portal custom roles. | | **On-Prem Host View** | Required base permission for all Infoblox Portal custom roles. | ### Configuration Steps 1. Log in to Infoblox Portal. 2. Go to **System > Administration > User Access > Roles.** 3. Click **Create Role**. 4. Name the role (for example: "Reports Only") and add a description. 5. In the **FEATURES** section, enable each permission listed in the table above. 6. Click **Save & Close**. 7. Assign the role to the appropriate users via **System > Administration > User Access > Users**. *Note: Scheduled Reports V2 Read is sufficient to view existing reports. Add Scheduled Reports V2 Manage only if the user also needs to create or modify scheduled reports.* ## Example 2: Endpoint and Endpoint Configuration User **Use Case: **A user who should work exclusively with endpoints and endpoint-specific configuration, without access to unrelated security areas. Suitable for endpoint security administrators or IT operations staff responsible for deploying and managing Threat Defense Endpoints. > 📝 This role does not map to any single predefined role. The TD Administrator predefined role grants full Threat Defense access, which is broader than required here. A custom role is required to limit scope to endpoints only. ### Recommended Permissions | | | | --- | --- | | **Permission** | **Description** | | **Endpoints View** | Grants read-only access to endpoint inventory and status. | | **Endpoints Manage** | Grants read/write access to endpoint configuration and management. | | **DFP Configuration View** | Grants read-only access to DNS Forwarding Proxy (DFP) configuration. | | **DFP Configuration Manage** | Grants read/write access to DNS Forwarding Proxy (DFP) configuration. | | **Downloads (Threat Defense Endpoint)** | Allows the user to download Threat Defense Endpoint installers and packages. | | **Tag Read** | Required base permission for all Infoblox Portal custom roles. | | **Tag Update** | Required base permission for all Infoblox Portal custom roles. | | **Tag Delete** | Required base permission for all Infoblox Portal custom roles. | | **On-Prem Host View** | Required base permission for all Infoblox Portal custom roles. | ### Configuration Steps 1. Log in to Infoblox Portal. 2. Go to **System > Administration > User Access > Roles**. 3. Click **Create Role**. 4. Name the role (for example: "Endpoint Admin") and add a description. 5. In the **FEATURES** section, enable each permission listed in the table above. 6. Click **Save & Close**. 7. Assign the role to the appropriate users via **System > Administration > User Access > Users**. *Note: Include DFP Configuration View and DFP Configuration Manage only if the user needs to manage DNS Forwarding Proxy settings in addition to endpoints. If download access is not required, the Downloads permission can be omitted.* ## Quick Reference Summary The table below provides a side-by-side comparison of both example roles, including the required base permissions. | | | | | --- | --- | --- | | **Permission** | **Reports-Only User** | **Endpoint & Config User** | | Scheduled Reports V2 Read | **✓** | — | | Scheduled Reports V2 Manage | **✓** | — | | DNS Activity Reports | **✓** | — | | B1DDI DHCP Reports | **✓** | — | | B1DDI DNS Reports | **✓** | — | | Security Activity Report | **✓** | — | | Endpoints View | — | **✓** | | Endpoints Manage | — | **✓** | | DFP Configuration View | — | **✓** | | DFP Configuration Manage | — | **✓** | | Downloads (Threat Defense Endpoint) | — | **✓** | | *Tag Read (required)* | **✓** | **✓** | | *Tag Update (required)* | **✓** | **✓** | | *Tag Delete (required)* | **✓** | **✓** | | *On-Prem Host View (required)* | **✓** | **✓** | For more information about role-based access, see the following: - [Configuring Users](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35398654) - [Configuring User Groups](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35464039) - [Configuring Access Policies](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35367585)