---
title: "Managing Administrative Roles in VAST Web UI"
slug: "managing-administrative-roles-in-vast-web-ui-tg"
tags: ["5.4"]
updated: 2026-10-28T01:54:33Z
published: 2026-10-28T01:54:33Z
canonical: "docs.vastdata.com/managing-administrative-roles-in-vast-web-ui-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Administrative Roles in VAST Web UI

You can manage permissions through administrative roles. Managers can belong to any number of roles. Managers inherit all permissions enabled for any roles they belong to.

VAST Cluster includes several default roles that are created during cluster deployment to cover some specific use cases, such as the `read-only` or `csi` role. Do not modify these roles. If you'd like to alter a default role, create a copy of the default role and modify the copy as needed.

- [Viewing Administrative Roles](/docs-5-4/docs/en/managing-administrative-roles-in-vast-web-ui-tg#viewing-administrative-roles)
- [Adding Administrative Roles](/docs-5-4/docs/en/managing-administrative-roles-in-vast-web-ui-tg#adding-administrative-roles)
- [Modifying Administrative Roles](/docs-5-4/docs/en/managing-administrative-roles-in-vast-web-ui-tg#modifying-administrative-roles)
- [Deleting Administrative Roles](/docs-5-4/docs/en/managing-administrative-roles-in-vast-web-ui-tg#deleting-administrative-roles)

## Viewing Administrative Roles

1. From the left navigation menu, select Administrators and then Administrative Roles.

The following information can be displayed for each role:

> [!TIP]
> **Tip**
> 
> To display or hide fields, click ![column_menu.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-7f1bcc5ffaeed9cbf182efe768970783(6).png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A32Z&se=2026-11-08T10%3A27%3A32Z&sr=c&sp=r&sig=fG2R7Jzt3DyVpZEc96YZMALpTGYG7f8pNzBFEPtN1yM%3D) to the right of a column title, and then click ![columns.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-918b4797fca5961ded0a6026c39d1bb1(6).png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A32Z&se=2026-11-08T10%3A27%3A32Z&sr=c&sp=r&sig=fG2R7Jzt3DyVpZEc96YZMALpTGYG7f8pNzBFEPtN1yM%3D) to open a dropdown where you can select or unselect fields.

| ID | The ID of the role. |
| --- | --- |
| Name | The name of the role. |
| Managers | Names of managers who have this role. |
| Managers Count | The number of managers who have this role. |
| LDAP Groups | LDAP groups associated with this role. |
| Default | Indicates whether this role is default. |
2. To review permissions granted by a role, right-click the role and select View.

## Adding Administrative Roles

1. From the left navigation menu, select Administrators and then Administrative Roles.
2. Click Create Administrative Role to open the Create Administrative Role dialog.
3. In the Name field, enter a name for the role .
4. Select the permissions you want to include in the role.
5. If you want to associate authentication provider group(s) with the role, enter each group in the format *<groupname>@<domain>* in the Active Directory/LDAP groups field.

Users who belong to groups that are associated with the role will be able to log into VMS using their LDAP user name and password. They will be authorized based on the role(s) associated with their group.

To enter a group, start typing the initial characters and then select an auto-complete option. **NOTE**: If the group is on a provider that is not configured as a VMS authentication provider, enter the group name manually.

To enter more than one group, enter the first group, then enter a comma and then enter another group. Each group is entered into the field with a removal button (![removebutton.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-3835b88cde83f336bf529ac85cb53148.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A32Z&se=2026-11-08T10%3A27%3A32Z&sr=c&sp=r&sig=fG2R7Jzt3DyVpZEc96YZMALpTGYG7f8pNzBFEPtN1yM%3D)). You can use the remove button to remove any group.

Each group can be any group on any connected LDAP-based provider, including Active Directory. Groups can be associated with multiple roles and vice versa.
6. When you're done, click Create.

The role is added.

> [!TIP]
> **Tip**
> 
> To assign the role to a manager, [update the manager](/docs-5-4/docs/en/managing-managers-via-vast-web-ui-tg#modifying-managers).

## Modifying Administrative Roles

Whenever you modify a role and change the permission set enabled for the role, you automatically update the inherited permissions of all the managers who have the role.

Do not modify default roles. If you'd like to alter a default role, create a copy of the default role and modify the copy as needed.

1. From the left navigation menu, select Administrators and then Administrative Roles.
2. Right-click the role you want to modify, and select Edit.
3. Make changes as needed (see [Adding Administrative Roles](/docs-5-4/docs/en/managing-administrative-roles-in-vast-web-ui-tg#adding-administrative-roles)).
4. Click **Update**.

The role is modified.

## Deleting Administrative Roles

> **Caution**
> 
> Deleting a role can remove permissions from managers who have the role.

1. From the left navigation menu, select Administrators and then Administrative Roles.
2. Right-click the role you want to delete, and then select Remove.
3. Click Yes to confirm the removal.

The role is deleted.