Atlas User Roles¶

Organization Owner¶

Grants root access to the organization, including:

• Project Owner access to all projects in the organization, even if added to a project with a non-Owner role.
• Privileges to administer organization settings.
• Privileges to add/remove/edit users to the organization.
• Privileges to delete the organization.
• All the privileges granted by the other organization roles combined.

Organization Project Creator¶

Grants the following access:

• Privileges to create projects in the organization.
• Privileges granted by the Organization Member role.

Organization Billing Admin¶

Grants the following access:

• Privileges to administer billing information for the organization.
• Privileges granted by the Organization Member role.

Organization Read Only¶

Provides read-only access to everything in the organization, including all projects in the organization.

For an Organization Member, within a project, the user has the privileges as determined by the user's project role. If a user's project role is Project Owner, then the user can add a new user to the project, which results in adding the newly-added user to the organization as well (if the newly added user is not already in the organization).

Organization Member¶

Provides read-only access to the organization (settings, users, and billing) and the projects to which they belong.

For an Organization Member, within a project, the user has the privileges as determined by the user's project role. If a user's project role is Project Owner, then the user can add a new user to the project, which results in adding the newly-added user to the organization as well (if the newly added user is not already in the organization).

Project Owner¶

Grants the privileges to perform the following actions:

• Manage project access and project settings.

• Manage programmatic access to a project.

  You can grant API Keys access to a project with either an organization or a project role. If your key has both the Organization Owner and Project Owner roles, it can access all projects in the organization.

• Retrieve process and audit logs for all clusters in the project.

  To retrieve logs, you must have the Project Data Access Read Only role or higher in the project that the cluster belongs to.

• Manage backups for and restore data to all clusters in the project.
• Create MongoDB Realm apps.

Project Cluster Manager¶

A user with the Project Cluster Manager role can perform the following tasks:

• Grants access to edit, pause, and resume Atlas clusters.

The Project Cluster Manager role doesn't allow users to:

• Access the Data Explorer.
• Retrieve process and audit logs.

Project Data Access Admin¶

Grants access to Data Explorer. This role also grants privileges of Project Read Only.

Allows the user to perform the following Data Explorer actions:

• View, create, and drop databases, collections, and indexes.
• View, modify, and delete documents.
• Retrieve process and audit logs for all clusters in the project.
• View the sample query field values in the Monitor and Improve Slow Queries.

The Project Data Access Admin role does not grant privileges to initiate backup or restore jobs.

Project Data Access Read/Write¶

Grants access to Data Explorer; specifically, the privileges to perform the following through Data Explorer:

• View and create databases and collections.
• View, modify, and delete documents.
• View indexes.
• Retrieve process and audit logs for all clusters in the project.
• View the sample query field values in the Monitor and Improve Slow Queries.

Project Data Access Read Only¶

Grants access to Data Explorer; specifically, to perform the following actions through Data Explorer:

• View databases and collections.
• View documents.
• View indexes.
• Retrieve process and audit logs for all clusters in the project.
• View the sample query field values in the Monitor and Improve Slow Queries.

Project Read Only¶