Administrators are users or service accounts who have permission to manage resources within ZITADEL.

Administrator permissions can be assigned to different levels in ZITADEL:

• IAM Administrators: This is the highest level. Users with IAM Administrator roles are able to manage the whole Instance.
• Organization Administrators: Administrators at the Organization level are able to view or manage everything, according to their permissions, within the granted Organization.
• Project Administrators: In this level the user is able to manage a project.
• Project Grant Administrators: The project grant administrator manages projects granted by another organization.

The scope of the administrators is restricted based on their level. Which means that an administrator, assigned to one organization, will have access only to the resources and configurations of that organization. Only the Administrators on the instance level can view resources, such as users, across all organizations.

To configure administrators in ZITADEL, go to the resource where you like to add it (e.g., Instance, Organization, Project, GrantedProject). In the right part of the management console you can find ADMINISTRATORS in the details part. Here you have a list of the current administrators and can add a new one.

When adding a new administrator, you can select multiple roles, some of which are only allowed to read data. This can be especially useful if you add service users for one of your projects where you only need read access.

By default, you will only search for users within the selected organization. If you like to give a role to a user outside the organization, you need to switch to the global search and type the exact loginname of the users. This will prevent users from guessing users from other organizations.

Roles

Configure roles

If you run a self-hosted ZITADEL instance, you can define your custom roles by overwriting the defaults.yaml In the InternalAuthZ section you will find all the roles and which permissions they have.

Example:

InternalAuthZ:
  RolePermissionMappings:
    - Role: "IAM_OWNER"
      Permissions:
        - "iam.read"
        - "iam.write"

Administrator Permission Matrix

This table is generated dynamically from our configuration file.