---
title: "Authorization - User"
slug: "fortanix-dsm-authorization-user"
updated: 2026-03-20T15:49:23Z
published: 2026-03-20T15:49:23Z
canonical: "support.fortanix.com/fortanix-dsm-authorization-user"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization - User

## 1.0 Administrators, Auditors, and Members

Fortanix-Data-Security-Manager (DSM) defines four roles that may be assigned to users: administrator, auditor, and member, custom role. These roles may be assigned at either the account or group level.

When the administrator (or auditor) role is assigned to a user at the account level, that user automatically becomes an administrator (or auditor) of every group in the account, including groups added subsequently.

When the administrator (or auditor) role is assigned to a user at the group level, the user has administrator (or auditor) permissions on that group, but not on any other group unless also assigned the role on the other group.

An auditor of a group can perform the following operations:

- View applications in the group
- View users in the group
- View security objects in the group
- View and search logs of Fortanix DSM activity for the group itself, and for users, applications, and security objects assigned to the group.

An administrator of a group can perform all of the auditor operations and the following additional operations:

- Create, modify, or delete applications in the group
- Retrieve the authentication credential for applications in the group
- Change the authentication method (API key or certificate) for applications in the group, regenerate the API key, or configure a new certificate
- Create, modify, or delete security objects in the group (but not perform cryptographic operations; only applications may perform cryptographic operations)
- Add or remove users from the group
- Modify group properties or delete the group

A regular member has no permission to view or modify any object until granted either auditor or administrator permission in some group.

A custom user role can have an arbitrary set of permissions at the account or group level. *For more* *information* *on how to create and manage Custom user roles, refer to the* [*User’s Guide: Custom Roles*](/v1/docs/users-guide-custom-role)*.*

*For more information on authorization, refer to the* [*User's Guide: Authorization*.](/v1/docs/users-guide-authorization)

## 2.0 Account Administration

Administrative operations on the account can only be performed by an account administrator. These operations include:

- Changing billing information or subscription level
- Inviting new users to the account
- Enabling or disabling users
- Creating new groups
- Deleting the account

*For a tabular view of the* *actions allowed for every role, refer to the* [*User's Guide: Authorization*](/v1/docs/users-guide-authorization).

An Account Administrator can also create external roles for the account using LDAP integrations in account authentication settings. Account administrators can import group objects from an LDAP directory and add them as external roles into Fortanix DSM.

*For more information, refer to* [*LDAP Authorizations for Users*](/v1/docs/users-guide-authorization#ldap-authorization-for-users) *and* [*LDAP Authorization for Applications*](/v1/docs/users-guide-authorization#ldap-authorization-for-applications)*.*

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [DSM REST APIs](/dsm-rest-apis.md)
- [Authorization](/dsm-authorization.md)
- [Account Quorum Policy](/fortanix-dsm-account-quorum-policy.md)
- [Fortanix DSM as a KMS to Secure VMware Virtual Environments](/fortanix-dsm-as-a-kms-to-secure-vmware-virtual-environments.md)