--- title: "Role-based access control for Fleet Management | Grafana Cloud documentation" description: "Learn how to use RBAC to control access to Grafana Fleet Management" --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Role-based access control for Fleet Management Grafana Fleet Management supports role-based access control (RBAC). RBAC provides a way of granting and revoking access to viewing and modifying Fleet Management resources, such as collectors and configuration pipelines. Refer to the [Grafana Cloud RBAC documentation](https://grafana.com/docs/grafana-cloud/security-and-account-management/authentication-and-permissions/access-control/) to learn more about controlling access to Cloud with RBAC. ## Fine-grained app access Fleet Management offers custom `plugin` roles that help reduce security risks by giving users only the permissions they actually need. You can assign specific roles to users who need only to view or make changes to Fleet Management, instead of granting them broad administrator access in Grafana Cloud. ## Grafana Cloud `basic` roles You can assign [Grafana Cloud `basic` roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/#basic-role-assignments) to users to allow them to perform certain actions within Grafana Cloud. In addition to other Cloud permissions, the following roles provide users the ability to view or edit Fleet Management collectors, attributes, and configuration pipelines. Expand table | Basic role | Access in Fleet Management | |---------------|-----------------------------------------------------------------------------------| | Grafana Admin | Read and write access to all collectors, attributes, and configuration pipelines. | | Admin | Read and write access to all collectors, attributes, and configuration pipelines. | | Editor | None. | | Viewer | Read access to Fleet Management. | ## Fleet Management `plugin` roles Fleet Management offers three custom roles to control access to the application and your Grafana Cloud stack: `Collector App Reader`, `Collector App Pipelines Viewer`, and `Collector App Admin`. The `Collector App Reader` role enforces read-only access for assigned users who have a `basic` role. All editing controls are disabled. The `Collector App Pipelines Viewer` role gives the same read-only access to users who *don’t* have a basic role. It isn’t assigned by default. Granting a user the `Collector App Admin` role gives them full edit access to the Fleet Management application. > Note > > The `Collector App Reader` and `Collector App Pipelines Viewer` roles do not grant permission to view dashboards. If you want to grant a user read access that includes permission to view collector health dashboards in Fleet Management, you must also assign the [`Viewer` basic role](https://grafana.com/docs/grafana-cloud/security-and-account-management/authentication-and-permissions/access-control/rbac-fixed-basic-role-definitions/#basic-role-assignments) for all of Grafana Cloud. Expand table | Fleet Management role | Access | |--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------| | Collector App Reader | Read access to Fleet Management. Read access includes viewing collectors, attributes, configuration pipelines. | | Collector App Pipelines Viewer | Read access to Fleet Management, including the same access as Reader for users without a basic role. | | Collector App Admin | Read and write access to Fleet Management. Write access includes registering, modifying, assigning, or deleting collectors, attributes, and pipelines. | ## Assign a Fleet Management `plugin` role in the UI To assign a role to an existing user or team, follow these steps: 1. In your Grafana Cloud stack, click **Administration** > **Users and access** in the left-side menu. 2. Click **Users** to find an individual or **Teams** to find a team. 3. Search for the user or team. 4. Click in the box in the **Role** column. 5. Scroll through the list to reach the **Plugin roles** section. 6. In the **Collector** menu, select the checkbox for **Collector App Admin**, **Collector App Pipelines Viewer**, or **Collector App Reader**. 7. Click **Apply**. After a browser refresh, the newly authorized user has role-based access to Fleet Management. If you want to assign a role to users not yet in your stack, you can add new users from your Grafana Cloud Portal on grafana.com. ## RBAC permissions You can [assign](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/) and [manage](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/manage-rbac-roles/) RBAC roles with API calls or provisioning. Fleet Management supports the following RBAC permissions: Expand table | Action | Description | Included in roles | Scopes | |--------------------------------------------------------|-------------------------------------------------|------------------------------------------------------|------------------------------------| | `grafana-collector-app:read` | Read access to Fleet Management | Collector App Reader, Collector App Pipelines Viewer | `plugins:id:grafana-collector-app` | | `grafana-collector-app:admin` | Read and write access to Fleet Management | Collector App Admin | None | | `grafana-collector-app.page_remote_configuration:read` | Read access to the **Remote configuration** tab | Collector App Admin, Collector App Pipelines Viewer | None |