Skip To Content

Levels, roles, and privileges

Organizations can use, create, and share a wide range of geographic content, including maps, scenes, apps, layers, and analytics. The ability of individual organization members to access and work with content in different ways depends on the privileges they have in the organization. Levels allow organizations to control the scope of privileges that can be assigned to members through roles.

Levels

Organizations use levels to allocate accounts based on the privileges that members need. Members are assigned a level when they are added to the organization. The level determines which privileges are available to the member. ArcGIS offers two levels of membership.

Level 1 membership is for members who only need privileges to view content, such as maps and apps, that has been shared with them through the organization, as well as join groups within the organization. Level 2 membership is for members who need to view, create, and share content and own groups, in addition to other tasks.

For example, a content creator assigned a level 2 account can create and share a site selection app with a group of users in their organization. This app allows users to select a specific site and view attribute information about the site that should only be available to internal employees. A member with a level 1 account can join the group and view and interact with the app.

Roles

A role defines the set of privileges assigned to a member. Privileges are assigned to members through a default role or a custom role. Members are assigned a role when they are added to the organization.

Note:

Once the member joins, their role can be changed by administrators and those with privileges to change member roles. Changing roles to or from administrator can be done only by administrators.

Default roles

ArcGIS Enterprise defines a set of privileges for the following four default roles:

  • Viewer—View items such as maps, apps, scenes, and layers that have been shared with the public, the organization, or a group to which the member belongs. Join groups owned by the organization. Drag CSV, text, or GPX files into Map Viewer to geocode addresses or place names. Get directions in Map Viewer and apps.

    Members assigned the Viewer role cannot create, own, or share content, or perform analysis. The Viewer role can be assigned to level 1 or level 2 accounts.

  • UserViewer privileges plus the ability to see a customized view of the site, use the organization's maps, apps, layers, and tools, and join groups that allow members to update all items in the group. Members assigned the User role can also create maps and apps, edit features, add items to the portal, share content, and create groups. The User role can be assigned to level 2 accounts.
  • PublisherUser privileges plus the ability to publish hosted web layers and perform feature and raster analysis. The Publisher role can be assigned to level 2 accounts.
  • AdministratorPublisher privileges plus privileges to manage the organization and other users.

    An organization must have at least one administrator, though two is recommended. There is no limit to the number of members who can be assigned to the Administrator role within an organization; however, for security reasons, you should only assign this role to those who require the additional privileges associated with it. The Administrator role can be assigned to level 2 accounts.

By default, all new members added to the portal are assigned the User role, but you can choose a different role to apply to new members. Go to Organization > Edit Settings > Roles and choose a role from the Default role for new members drop-down menu. Click Save to apply this new setting.

The following table shows the privileges defined for each of the default roles.

PrivilegeDefault role

Viewer

User

Publisher

Administrator

Use maps, apps, and scenes

Yes

Yes

Yes

Yes

Use geosearch (search for places and addresses)

Yes

Yes

Yes

Yes

Use elevation analysis (used by some of the analysis tools in Map Viewer)

Yes

Yes

Yes

Yes

Use routing and get directions (the portal must be configured for network analysis)

Yes

YesYesYes

Geocode addresses and place names

Yes

YesYesYes

Join groups that do not have the item update capability enabled

Yes

Yes

Yes

Yes

Join groups that do have item update capability

Yes

Yes

Yes

Create groups

Yes

Yes

Yes

Create content

Yes

Yes

Yes

Share portal items

Yes

Yes

Yes

Edit features

Yes

Yes

Yes

Use standard feature analysis tools

Yes

Yes

Use GeoAnalytics Tools (the portal must be configured for GeoAnalytics)

Yes

Yes

Use raster analysis tools (the portal must be configured for raster analysis)

Yes

Yes

Publish hosted web layers

Yes

Yes

Publish server-based layers

Yes

Yes

Publish web tools

Yes

Manage organization resources

Yes

Configure website

Yes

Set up enterprise logins

Yes

Create custom roles

Yes

Change member role to or from administrator

Yes

Remove other members of the default administrator role from the organization

Yes

Share content with public when organization does not allow members to share outside the organization

Yes

Create and own groups that allow members to update all items in the group

Yes

Make ArcGIS Marketplace content available (subscription and premium content access requires an ArcGIS Online organizational account)

Yes

Note:

Most of the privileges listed above can also be assigned as part of a custom role; however, some administrative privileges are not available for custom roles as they are reserved for default administrators.

Note:

When you federate a server with your portal, the portal's security store controls all access to the server. This provides a convenient sign in experience but also impacts how you access and administer the federated server. For example, when you federate, any users, roles, and permissions that you previously configured on ArcGIS Server services are no longer valid. Access to services is instead determined by portal members, roles, and sharing permissions. Review the information in Administer a federated server to learn more about how federating will impact your existing site.

Custom roles

Organizations may want to refine the default roles into a more fine-grained set of privileges by creating custom roles. For example, your organization may want to assign some members the same privileges as a default User but without allowing them to edit feature data. This could be achieved by creating a custom role based on the default User role, turning off the editing privileges, and calling the custom role User without Editing or something similar.

Only default administrators—that is, those who have been assigned the Administrator role—can create, configure, and assign custom roles. Default administrators configure custom roles based on any combination of available general and administrative privileges.

A custom role that has any publishing privilege (for features, tiles, or scenes) will also be able to create other types of ArcGIS Server services on servers federated with your portal. This functionality may be further restricted in a future release to prevent such workflows. Esri recommends that if users need the ability to publish ArcGIS Server services, add them to the default Publisher role.

The privileges that can be granted to a member through a custom role cannot exceed those associated with their assigned member level. For example, if a level 1 member is assigned a custom role that has more privileges than a level 1 account allows, the additional privileges will be disabled for that member.

Privileges

Privileges allow organization members to perform different tasks and workflows in an organization. For example, some members have privileges to create and publish content, while others have privileges to view content but cannot create their own.

General privileges

Members who perform specific tasks within the organization—create maps or edit features, for example—can be assigned the general privileges they need to work and share with groups, content, and features.

General privileges

Members

View

When checked, the View privilege allows members of the role to view the Organization page. If unchecked, members cannot see this page.

Groups

Create, update, and delete

Join organizational groups

View groups shared with portal

Content

Create, update, and delete

Publish hosted feature layers

Publish hosted tile layers

Publish hosted scene layers

Publish server-based layers

View content shared with portal

Sharing

Share with groups

Share with portal

Share with public

Make groups visible to portal

Make groups visible to public

Content and Analysis

Geocoding: Use Esri World Geocoding Service from ArcGIS Online to convert addresses or places to map points (geocoding) such as when publishing a Microsoft Excel file of addresses as a hosted feature layer or adding a CSV file of addresses to a map (does not apply to your own locators configured for the organization)

Network Analysis: Perform network analysis tasks such as create drive-time areas

Standard Feature Analysis : Perform spatial analysis tasks such as create buffers

GeoEnrichment: Use the GeoEnrichment service to access demographic information.

Elevation Analysis: Perform elevation and hydrology analysis tasks on elevation data

GeoAnalytics Feature Analysis: Use GeoAnalytics Tools.

Raster Analysis: Use raster analysis tools.

Features

Edit: Edit features based on permissions set on the layer

Edit with full control: No matter what level of editing is enabled on hosted feature layers, members of roles with this privilege can add, update, and delete features

Administrative privileges

The privileges listed below allow custom roles to assist the default administrators with managing members, groups, and content in the organization. These custom administrative roles do not include the full set of privileges reserved for default administrators—that is, those assigned the Administrator role.

Administrative privileges

Members

View all: View all member account information

Update: Update member account information

Delete: Remove member accounts from the portal organization

Disable: Make member accounts inactive

Change roles: Change the role assigned to portal members

Note:

Only members of the default administrator role can add members to or remove members from the default Administrator role.

Manage licenses: Manage licenses for portal members

Groups

View all: View groups owned by portal members

Update: Update groups owned by portal members

Delete: Delete groups owned by portal members

Reassign ownership: Reassign ownership of groups

Assign members: Add members to groups

Link to enterprise group: Link groups to enterprise groups

Create with update capabilities: Create a group that allows all members of the group to update all items shared to the group regardless of item ownership or editor settings.

Content

View all: View content owned by members

Update: Update content owned by members

Delete: Delete content owned by members

Reassign ownership: Reassign ownership of content

Publish web tools: Publish web tools created in ArcGIS Pro to a federated server. See What is a web tool? in the ArcGIS Pro help for more information on web tools.

Privileges reserved for default administrators

Certain administrative privileges are reserved for default administrators and are not available for custom roles. For example, only default administrators can configure the website and remove other administrators from the organization. The following is a list of privileges reserved for default administrators:

  • Configure website
  • Configure custom roles
  • Set up enterprise logins
  • Change member role to or from administrator
  • Remove other administrators from the organization
  • Share content with the public when the organization does not allow members to share outside the organization
  • Reset passwords

Privileges for common workflows

Some workflows require a combination of privileges. If you cannot perform a function that you think your role should allow you to perform, verify that your administrator has enabled the full set of privileges required for the function.

WorkflowRequired privileges

Use the standard feature analysis tools

  • Create, update, and delete (Content)
  • Publish hosted feature layers
  • Standard Feature Analysis
Note:

Some tools require additional privileges to use GeoEnrichment, elevation analysis, or network analysis. See Perform analysis for requirements per tool.

Use GeoAnalytics Tools

  • Create, update, and delete (Content)
  • Publish hosted feature layers
  • GeoAnalytics Feature Analysis

Use raster analysis tools

  • Create, update, and delete (Content)
  • Publish hosted feature layers
  • Raster Analysis

Publish hosted feature and WFS layers

  • Create, update, and delete (Content)
  • Publish hosted feature layers

Publish hosted tile layers

  • Create, update, and delete (Content)
  • Publish hosted tile layers

Publish hosted scene layers

  • Create, update, and delete (Content)
  • Publish hosted feature layers
  • Publish hosted scene layers

Publish apps from Map Viewer or group page

  • Create, update, and delete (Content)
  • Share with groups, Share with portal, or Share with public

Embed maps or groups

  • Create, update, and delete (Content)
  • Share with public

Manage content owned by members

  • View all (Members)
  • View all (Content)
  • Update (Content)
  • Delete (Content)
  • Reassign ownership (Content)

Manage groups owned by members

  • View all (Members)
  • View all (Groups)
  • Update (Groups)
  • Delete (Groups)
  • Reassign ownership (Groups)
  • Assign members (Groups)

Manage member profiles

  • View all (Members)
  • Update (Members)

Add, update, and delete features on editable hosted feature layers even if the hosted feature layer is only configured to Only update feature attributes or Only add new features

  • Edit features
  • Edit with full control

In this topic
  1. Levels
  2. Roles
  3. Privileges