Administrators can use Advanced Permissions to specify a user’s Team role, as well as their level of access to incidents and configuration objects such as services, escalation policies and schedules. Advanced permissions provide granular access control, allowing you to fully customize permissions according to your organization’s needs.

📘

User Role Tiers

PagerDuty has two tiers of user roles depending on your account's plan. To determine which tier your role belongs to, navigate to User Icon My Profile. If you see a tab that says Permissions & Teams, your account has Advanced Permissions and you should continue to use this article for reference. If you only see the User Settings tab, please visit our article on User Roles.

Benefits of Advanced Permissions

• Increased Control and Security: Teams can determine who is allowed to respond to incidents and manage their Team's configuration. Individual users can also create and manage personal API Access Keys.
• Prevent Human Error: By empowering Teams to control access to their incidents and configuration, accidents that might interfere with a Team’s process can be mitigated.
• Limit the Visibility of Sensitive Information: Teams can be set to private if their incidents or configuration contain sensitive information.

📘

Pricing Plans

• Advanced Permissions are available to customers on the following pricing plans: Business, Digital Operations (legacy) and Enterprise for Incident Management. Please contact our Sales Team if you would like to upgrade to a plan with this feature.
• If you are already on a Business, Digital Operations (legacy) or Enterprise for Incident Management, but do not yet have Advanced Permissions enabled, contact PagerDuty Support to request enablement.

Role Types

With Advanced Permissions, there are three different types of roles:

• Base roles
• Team roles
• Object roles

Each role is unique and dictates what a user has access to.

Base Roles

All users in an account have a base role, and when you add a new user, they must be assigned one. A user’s base role indicates the default level of access they have to incidents and configuration objects across the entire account. To find your own base role, navigate to User Icon My Profile Permissions & Teams tab.

Base roles can either be flexible or fixed:

• Fixed Base Roles: A fixed base role is one that you cannot grant more or fewer permissions via a Team role or an object role.
• Flexible Base Roles: A flexible base role is one that you can grant more or fewer permissions via a Team role or an object role.

Base Role Actions

Below are two general lists of actions each base role can take divided by flexible and fixed roles. For flexible base roles, the table indicates the level of access each role has by default on an account before an administrator configures more or fewer permissions via a Team or object role.

🚧

Feature Permissions

The lists below are not exhaustive. You can check the Required User Permissions callouts on each feature's article to find out what permissions are required.

Flexible Base Roles

Fixed Base Roles

* Limited Stakeholder and Full Stakeholder subscriptions to internal status pages are only available on the following pricing plans: Business, Digital Operations (legacy) and Enterprise for Incident Management. Please contact our Sales Team if you would like to upgrade to a plan with this feature. Note: These roles can only subscribe to prioritized incidents appearing on internal status pages.

📘

Team Responder Base Role (Legacy)

The Team Responder base role was deprecated on April 26, 2019. All users with this role have now been changed to an Observer base role and their Team roles will stay the same.

Full Stakeholder Users

Stakeholders can view objects in an account, but cannot make modifications. The intended use case for a Stakeholder is to add them as an incident Subscriber. Stakeholders will receive updates about incidents they have subscribed to, but cannot take any action.

Stakeholder users are available by default on our Digital Operations (legacy) and Enterprise for Incident Management plans, and can be purchased as add-on users on Professional and Business plans. Stakeholder licenses are not billed the same as full users. Please contact your account representative for more information.

Limited Stakeholder Users

Limited Stakeholders can view and subscribe to internal status pages, and view their user profile. Limited Stakeholders cannot view any other parts of PagerDuty, whether they are using the web app or the mobile app. This access level is great for users who don't need to see all of the alerts, schedules, and responder details in your account. Incident subscriptions are only available for Limited Stakeholders on our Business, Digital Operations (legacy) and Enterprise for Incident Management plans. Please contact our Sales Team if you would like to upgrade to a plan with this feature.

Team Roles

When you add a user to a Team, they will also be given a Team role. A user’s Team role indicates the level of access that they have to objects associated with that specific Team. Users may also have a primary Team, which some organizations may need for billing purposes. Please read our section Manage Primary Team for more information.

To find your own Team role, navigate to User Icon My Profile Permissions & Teams tab.

There are three types of Team roles:

When you add a user or assign them to a Team for the first time, their default Team role will depend on their base role. You can add users to a Team manually, or automatically when their escalation policy has an associated Team.

* Administrators can adjust users’ default Team roles to grant them more or fewer permissions on a specific Team.

Object Roles

Objects roles are levels of access given for specific configuration objects (a schedule, escalation policy, and/or service) to an individual user. To find your own object-level role(s), navigate to User Icon My Profile Permissions & Teams tab.

There are three types of object roles:

How Base, Team, and Object Roles Work Together

Base roles establish the level of access that a user has to everything across the entire account. In addition, Team and object roles give users more or less access to specific objects (i.e., schedules, escalation policies, services) and incidents than their base role alone would allow.

Manage Roles

Please see our Manage Users article for more information on managing Advanced Permissions user roles.

Team Privacy

With Advanced Permissions, Teams can be set to Private or Public. Please read our Teams article for more information on Team privacy.

Respond to Incidents From Other Teams

Please read our Teams article for more information on responding to incidents from other Teams.

Migration Role Mapping

When an account migrates from Basic to Advanced Permissions, most basic user roles are automatically mapped to Advanced Permissions base roles.

📘

Note

Please note that there is no Observer role with Basic Permissions.

Roles in the REST API and SAML

When you provision a user through the REST API or SAML, the user will have the Manager (i.e., user) role by default, unless specified in the user's role property. The value must be one of a set of fixed values that our internal APIs recognize. Invalid requests will receive a response with the status 400 Invalid Request.

Values for user records’ role field correspond with role types above:

* You cannot create this role through the REST API or SAML provisioning.