Users and roles

To prevent unauthorized access to your Elastic resources, you need a way to identify users and validate that a user is who they claim to be (authentication), and control what data users can access and what tasks they can perform (authorization).

The methods that you use to authenticate users and control access depends on the way Elastic is deployed.

Note

Preventing unauthorized access is only one element of a complete security strategy. To secure your Elastic environment, you can also do the following:

Restrict the nodes and clients that can connect to the cluster using network security policies.
Take steps to maintain your data integrity and confidentiality by encrypting HTTP and inter-node communications, as well as encrypting your data at rest.
Maintain an audit trail for security-related events.
Control access to dashboards and other saved objects in your UI using Kibana spaces.
Connect your cluster to a remote cluster to enable cross-cluster replication and search.
Manage API keys used for programmatic access to Elastic.
Manage application connections for external access to Serverless projects. Currently, only MCP clients for the Elastic Agent Builder MCP server are supported. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Cloud organization level

If you’re using Elastic Cloud, then you can perform the following tasks to control access to your Cloud organization, your Cloud Hosted deployments, and your Cloud Serverless projects:

Invite users to join your organization
Assign user roles and privileges:
- Manage organization-level roles and high-level access to deployments and projects.
- Assign project-level roles and create custom roles. Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Hosted.
Configure SAML single sign-on for your organization

Tip

For Elastic Cloud Hosted deployments, you can configure SSO at the organization level, the deployment level, or both. Refer to Cloud organization users for more information.

Elastic Cloud Hosted deployments can also use cluster-level authentication and authorization. Cluster-level auth features are not available for Elastic Cloud Serverless.

Granular data access control in Serverless

Elastic Cloud Serverless centralizes user management with Cloud organization-level roles. You can configure document- and field-level access control in Elastic Cloud Serverless projects as a part of a project-level custom role.

Orchestrator level

Control access to your Elastic Cloud Enterprise orchestrator and deployments.

Manage passwords for default users
Manage orchestrator users and roles:
- Using native users
- By integrating with external authentication providers:
Configure single sign-on to deployments for orchestrator users

Tip

For Elastic Cloud Enterprise deployments, you can configure SSO at the orchestrator level, the deployment level, or both.

Elastic Cloud Enterprise deployments can also use cluster-level authentication and authorization.

Note

You can't manage users and roles for Elastic Cloud on Kubernetes clusters at the orchestrator level. Elastic Cloud on Kubernetes deployments use cluster-level authentication and authorization only.

Project level

As an extension of the predefined cloud resource access roles offered for Serverless projects, you can create custom roles at the project level to provide more granular control, and provide users with only the access they need within specific projects. You can also use custom roles to apply document and field-level security at the project level.

Learn more about custom roles for Elastic Cloud Serverless projects.

Cluster or deployment level

Set up authentication and authorization at the cluster or deployment level, and learn about the underlying security technologies that Elasticsearch uses to authenticate and authorize requests internally and across services.

User authentication

Set up methods to identify users to the Elasticsearch cluster.

Key tasks for managing user authentication include:

You can also learn the basics of Elasticsearch authentication, learn about accounts used to communicate within an Elasticsearch cluster and across services, and perform advanced tasks.

View all user authentication docs

User authorization

After a user is authenticated, use role-based access control to determine whether the user behind an incoming request is allowed to execute the request.

Key tasks for managing user authorization include:

You can also learn the basics of Elasticsearch authorization, and perform advanced tasks.

Tip

User roles are also used to control access to Kibana spaces.

View all user authorization docs