Fleet and Integrations roles and privileges

Use Kibana roles and privileges to grant users access to Fleet and Integrations. For each of these features, select the type of access you want to allow:

• All: Users have full access to the feature, which includes performing all available actions and managing configuration.
• Read: Users can view the feature, but can't perform any actions or manage configuration.
• None: Users can't access or view the feature.

In Fleet, Read access for Agents also allows requesting agent diagnostics.

You can take advantage of these privilege settings by:

• Using an Elasticsearch built-in role
• Creating a new role.

To configure access at a more granular level, select a custom set of privileges for individual Fleet features:

• Customize sub-feature privileges for Fleet

Some actions, such as adding an integration to an agent policy, require privileges for both Fleet and Integrations. Refer to Privileges for integrations and integration policies.

Elasticsearch comes with built-in roles that include default privileges.

editor

The built-in editor role grants these privileges, supporting full read-write access to Fleet and Integrations:

• Fleet: all
• Integrations: all

viewer

The built-in viewer role grants these privileges, supporting read-only access to Fleet and Integrations:

• Fleet: read
• Integrations: read

You can also create a new role that can be assigned to a user to grant more specific levels of access to Fleet and Integrations.

To create a new role with access to Fleet and Integrations:

1. Go to the Roles management page in the navigation menu or use the global search field.

2. Select Create role, then enter a Role name.

3. Leave the Elasticsearch settings at their defaults, or refer to Security privileges for descriptions of the available settings.

4. In the Kibana section, select Assign to space. In the Select spaces field, select the spaces where the role needs access to Fleet and Integrations.

   • Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Stack 9.1+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. You can grant Fleet privileges in specific spaces. For how agent policies and integration assets behave across spaces, refer to Using Spaces with Fleet.
   • Stack 9.0 The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available in 9.0 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Fleet privileges apply to all spaces, so select All Spaces.

5. Expand the Management section, then choose the access level that you'd like the role to have with respect to Fleet and integrations:

   1. To grant the role full access to use and manage Fleet and integrations, set both the Fleet and Integrations privileges to All.

   2. To create a read-only user for Fleet and Integrations, set both the Fleet and Integrations privileges to Read.

   3. If you'd like to define more specialized access to Fleet based on individual components, set Fleet to All or Read, then expand the Fleet menu and enable Customize sub-feature privileges.

      The sub-feature privileges you select replace the general Fleet privilege and determine which Fleet UI features the role can access. For details, refer to Customize sub-feature privileges for Fleet.

      Customizing sub-feature privileges is a subscription feature.

      To let the role add integrations to agent policies or edit integration policies, also set Integrations to All. Refer to Privileges for integrations and integration policies.

6. Select Assign role, then select Create role.

After you've created a new role, you can assign it to any Elasticsearch user. You can edit the role at any time by returning to the Roles page in Kibana.

You have more granular control when creating a new role or editing it. This is useful when people in your organization access Fleet for different purposes, and you need to fine-tune the components that they can view and the actions that they can perform.

The Fleet UI varies depending on the privileges granted to the role.

Set Read access for Elastic Agents only:

• Agents: Read
• Agent policies: None
• Settings: None

With these privileges, the Fleet UI shows only the Agents and Data streams tabs. The Agent policies, Enrollment tokens, Uninstall tokens, and Settings tabs are unavailable.

The set of actions available for an agent are limited to viewing the agent and requesting a diagnostics bundle.

Change the Agents privilege to All to enable the role to perform the full set of available actions on Elastic Agents.

Set Read access for Elastic Agents, agent policies, and Fleet settings:

• Agents: Read
• Agent policies: Read
• Settings: Read

With these privileges, the Fleet UI shows the Agents, Agent policies, Data streams, and Settings tabs. The Enrollment tokens and Uninstall tokens tabs are unavailable.

The set of actions available for an agent are limited to viewing the agent and requesting a diagnostics bundle.

You can view agent policies, but you cannot create a new policy.

You can view Fleet settings, but they are not editable.

Set All access for Elastic Agents only:

• Agents: All
• Agent policies: Read
• Settings: Read

With these privileges, the Fleet UI shows all tabs.

All Elastic Agent actions can be performed and new agents can be created. Enrollment tokens and uninstall tokens are both available. Access to Fleet settings is still read-only.

To add a Fleet Server, also set the Agent policies and Settings privileges to All.

This table shows the set of available actions for the read or all privilege for each Fleet feature.

When you add an integration to an agent policy, Fleet creates an integration policy that stores the integration's settings. Viewing or managing integration policies, and installing integration packages, requires privileges for both Fleet Agent policies and Integrations. If you don't customize Fleet sub-feature privileges, the Fleet privilege sets the Agent policies access level.

The Integrations feature has no sub-feature privileges. A role that can edit integration policies can also install, upgrade, and uninstall integration packages.