Manage users and roles
Camunda Hub controls access to the workspaces, projects, environments, and clusters of your organization through users and roles. Organization admins assign roles and manage users to decide who can use these resources.
Access is controlled on three levels:
- Organization: Users are assigned organization-level roles. They decide what a user can do in Camunda Hub across the organization.
- Workspace: Within a workspace, the role of a user decides what they can do with its projects and files. See workspace roles.
- Runtime environments: Access to the runtime of an environment, such as Operate, Tasklist, Admin, and Zeebe, is managed separately, with authorizations in Admin for each cluster, not by organization-level roles.
Where and how you manage users, and which roles are available, depends on the edition of Camunda that you use. Select your edition to see the details.
- SaaS
- Self-Managed
Manage users
You invite and manage users and groups in Camunda Hub, on the Organization > Manage organization page. This is where you configure organization access. The Organization Owner has all rights in the organization.
Use roles to control access to Camunda Hub.
Users are invited to a Camunda 8 organization via their email address, which must be accepted by the user. The user remains in the Pending state until the invitation is accepted.
People who do not yet have a Camunda 8 account can also be invited to an organization. To access the organization, the invited individual must first create a Camunda 8 account by following the instructions in the invitation email.
Groups (legacy)
Groups in Camunda Hub are a legacy feature for organizing users in SaaS. They apply only to clusters on version 8.7 or earlier, and they don't control access to Camunda Hub.
To manage groups, click Organization > Manage organization, and then open the Groups tab. See manage user groups.
For clusters on version 8.8 or later, manage groups and authorizations in Admin.
Roles and permissions
Users are assigned organization-level roles. The following table shows what each role can do.
| Role | Organization | Workspaces and projects | Clusters | Environments | Catalog | Optimize and business value |
|---|---|---|---|---|---|---|
| Organization Owner | Full access | Manage | Manage | Manage | Manage | Yes |
| Organization Admin | Manage | Manage | Manage | Manage | Manage | Yes |
| DevOps | None | Create and collaborate | Manage | Manage | Read-only | No |
| Analyst | Read-only | Create and collaborate | None | View all | Manage | Yes |
| Member | Read-only | Create and collaborate | None | View all | Read-only | No |
- Organization Owner: All rights in the organization, including settings, billing, and ownership transfer. Reserved for a single user per organization; transferred rather than assigned or removed like other roles.
- Organization Admin: Manages the organization, its members, and its workspaces, with full access to every workspace and project by default. No separate mode needs to be enabled.
- DevOps: A specialized role for infrastructure management, not people management. Grants cluster create and update, cluster clients, connector secrets, IP allowlisting, secure connectivity, encryption, and the connector-management view, plus Member-level modeling. Cannot manage or view organization members, billing, or organization settings.
- Analyst: Includes everything a Member can do, plus full access to Optimize to build process dashboards and reports. Access to specific dashboards and reports within Optimize is governed separately by Optimize collection roles.
- Member: Full access to create and collaborate on workspaces and projects, plus read-only visibility into the organization.
Additional roles
Beyond the roles above, an organization may show a few legacy roles depending on its history. They aren't recommended with Camunda Hub:
- Developer (deprecated): No longer offered for new assignment. Existing holders keep their current permissions unchanged; they are not automatically moved to another role.
- Task user and Visitor (legacy): Available only for organizations with at least one cluster on version 8.7 or older, alongside a user's organization-level roles. They govern access to the older cluster apps and disappear once no such clusters remain.
Access to organization resources
The organization-level roles of a user set the level of access to each of the following resources. The table above lists the level for each role. This section describes what each level means.
Workspace and project access
- Manage: Full access to every workspace and project in the organization. Organization Owner and Organization Admin have this level. See elevated workspace access.
- Create and collaborate: Create and collaborate on workspaces and projects. DevOps, Analyst, and Member have this level. What a user can do inside a workspace also depends on their workspace role.
Elevated workspace access
Organization admins and owners always have Workspace Admin access to every workspace in the organization, including workspaces they aren't explicitly a member of. This access is on by default and can't be changed.
The main purpose of this access is to assign members to workspaces that have no members. Ordinarily, these workspaces would not be accessible or visible to any other users.
The user must be assigned the organization Organization Owner or Organization Admin role.
Catalog access
- Manage: Browse and use catalog items, and also see usage statistics and adoption data. Analyst, Organization Admin, and Organization Owner have this level.
- Read-only: Browse and use catalog items. Member and DevOps have this level.
Business value access
Access to Optimize includes access to the business value dashboard, where users view metrics and set targets. The same roles that grant access to Optimize also grant access to business value: Analyst, Organization Admin, and Organization Owner.
Cluster visibility
- Manage: Create and update clusters, and manage cluster clients, connector secrets, IP allowlists, secure connectivity, and encryption. Organization Owner, Organization Admin, and DevOps have this level.
- None: No access to the cluster pages. Analyst and Member have this level.
Environment visibility
- Manage: View all environments and resume paused ones. Organization Owner, Organization Admin, and DevOps have this level. Organization Owner and Organization Admin can assign environments to any workspace. DevOps can assign environments to workspaces where the user is an editor or a workspace admin.
- View all: See every environment in the organization, and open its applications, such as Operate and Tasklist. The user can't assign or add environments, doesn't get the option to resume a paused environment, and sees the workspace assignments only of workspaces where they are an editor or a workspace admin. Analyst and Member have this level.
Access to runtime environments
Organization-level roles control what a user can do in Camunda Hub. They don't control what the user can do in the runtime of an environment, which includes Operate, Tasklist, Admin, and Zeebe. Starting with version 8.8, access to the runtime is managed independently of organization-level roles. To control what a user can access there, define their authorizations in Admin.
If authorizations are disabled in the runtime, the user has full access to the runtime and its components.
For clusters before version 8.8, access is controlled with resource-based authorizations and the legacy Task user and Visitor roles. See manage resource-based authorizations.