---
version: "Latest"
language: "en"
---
# Manage Roles in the Mend Platform

## Overview

System Admins are responsible for managing user roles within the Mend Platform. This document provides a technical guide for System Admins to control and configure user roles effectively.

After assigning all relevant users to a particular group, you can assign a role to the group which will apply the required permissions to all its users.

## Mend Platform Roles and Permissions

|       **Role**       |                                                                                                                                                                                                                                                                                                                                                       **Permissions**                                                                                                                                                                                                                                                                                                                                                       |
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Admin**            | **Organization Admins** have full access to all features and configurations within the organizational scope. This includes user and group management, labels, scan configurations, applications, and projects. They can: * [Create and manage **organization-level workflows**](https://docs.mend.io/platform/latest/create-an-automation-workflow-in-the-mend-platform.md) that apply across all applications. * Execute scans and modify scan results. **Application Admins** can also [create workflows](https://docs.mend.io/platform/latest/create-an-automation-workflow-in-the-mend-platform.md), but only within their assigned application(s). These workflows are application-scoped and separate from organization-wide workflows defined by Org Admins. |
| **Security Analyst** | **Security Analysts** are responsible for the triage process of all security findings. They can review scans \& findings data and take the needed actions to either resolve issues or suppress if needed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Scan Manager**     | **Scan Managers** can execute security scans using Mend CLI or through the Repository Integrations. They can configure and change the organization structure by adding new applications/projects and making the needed structure changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Member**           | **Members** have access to Mend Platform for viewing purposes. They can review all available data in dashboards and drill-down to visualize projects, scans, and security findings data. Members can't access administration or configuration capabilities and can't impact data with actions.                                                                                                                                                                                                                                                                                                                                                                                                                              |
| **Legal Analyst**    | **Legal Analysts** can manually override license and copyright assignments that were applied automatically during analysis.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| **Auditor**          | **Auditors** have read-only access to Mend data without the ability to modify data or change settings in the platform. Use for integrations (service users), automations, or users who only need visibility.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

## Understanding Application-Scoped Roles and Default Group Access

By default, the built-in **Admin** and **User** groups grant their members access to all applications in the organization. However, this default behavior changes when application-scoped roles are introduced.

### How Application-Scoped Roles Affect Default Access

When an application-scoped role is added to the **Admin** group, the default broad access for **all other groups** - including the default **User** group - is removed. After this point, users in those groups will no longer have access to any applications unless access is explicitly granted.

**What this means in practice:**

* Once any application-scoped role exists in the Admin group, users in the User group (and any other non-admin groups) lose access to all applications.

* To restore access, an application-scoped role must be explicitly added to each affected group for **every application** that group needs to access.

* This behavior applies to the default User group and to any other custom non-admin groups.

## Getting it done

### Assign a Role to group(s)

1. Log into the Mend Platform.

2. Click the settings gear in the top right corner of the page.

3. Click **Administration.**

![image-20231220-153011.png](https://docs.mend.io/__attachments/a_d6a603d0d102631cbc01d05eecb576db5b2c5ca4b2a29167a2c4083b22502ad3/image-20231220-153011.png?cb=81650a63dad76b64841b0037bb683df5)

4. Click **Groups** in the **Administration** menu on the left.

   ![image-20251113-170157.png](https://docs.mend.io/__attachments/a_5e2f5837d3b2257ced5793d0cf920454dbae96731358c37ad69e4c2095f2b06e/image-20251113-170157.png?cb=513454a7f39d0ef57fc7fa401725aacc)
5. Click on the group name you would like to assign roles for.

6. Click the **Roles** tab and then the **+ Add Role** button.

   ![image-20251120-154340.png](https://docs.mend.io/__attachments/a_a777264b6032ade265d9ee3abe96a5f47d411b3ebb682fa794fea951082ad862/image-20251120-154340.png?cb=7b6baf3dfe855cf44f97fc7812a12f29)
7. Select which roles to assign to the selected group. The roles can be assigned at the **Organization** level or a specific **Application** . Click the **Add** button to confirm your selection.

![image-20260305-103936.png](https://docs.mend.io/__attachments/a_d8bfa04392417c259bd2a50cc8ee14205aa575e6a179b2ea6c17dd5e9880e79c/image-20260305-103936.png?cb=781ed030bdf1738f5472d1106d92e5d0)
Example: Assigning the Auditor Role at the Organization Level

### Delete Group Role

1. Select the relevant group in the **Groups**table.

2. Click **Roles**.

3. Unselect the role you would like to delete from a specific group.

   ![image-20251120-155450.png](https://docs.mend.io/__attachments/a_8ae40b2610533bdf12ccc5800132af1ffc4e7d5447450f1e7cd71cb4b79bbfca/image-20251120-155450.png?cb=f7b4451c7ffb3fdb498928480576e9fd)
4. Click on the "**OK**" button in the pop-up message window to delete to Group Role.

![image-20231214-043242.png](https://docs.mend.io/__attachments/a_769a4889e163b935862c875abf79f4360d74568d53f46419cb82c6f6ddcb4a27/image-20231214-043242.png?cb=0f2cf5f4854fd7ca08294d1e8bff0fef)