Manage roles and access control

Overview

F5 Insight uses role-based access control (RBAC) to manage what users can see and do in the product. Each user is assigned a role, and each role defines a set of permissions that control access to specific features and actions.

You can use the built-in roles (Admin, Operator, Viewer) or create custom roles with granular permissions tailored to your organization’s needs. When you use an external identity provider (LDAP or SAML), you can map directory groups to roles so that users are automatically assigned the correct role when they sign in.

Note

  • Custom roles and access control is an early access feature.
  • The feature is disabled by default in new installations.
  • To enable or disable it, go to Settings > User Administration > Roles. You need administrator access to change this setting.

Before you begin

Permissions required

Access to role management is controlled by RBAC under the User Management resource. By default, only the built-in Admin role has this permission, but any custom role that includes User Management permissions can also manage roles.

Action Permission required
View roles User Management — Read
Create a role User Management — Create
Edit a role User Management — Update
Delete a role User Management — Delete

Note

Creating, cloning, and editing custom roles requires a full (non-Light) license tier. Viewing roles and assigning built-in roles are available on all license tiers.

Understand the permission model

Every role (built-in or custom) is made up of permissions. A permission pairs a resource (a feature area of the product) with an action (what you’re allowed to do with it).

Actions

Action Meaning
Read View or retrieve information
Create Create a resource or trigger an operation
Replace Replace an entire existing resource
Partial update Update part of an existing resource
Delete Remove a resource

Resources

Resources map to functional areas of F5 Insight:

Resource Covers
User Management Roles, local users, identity providers
Device Management BIG-IP and F5OS device inventory and onboarding
Telemetry Telemetry data, App Insight, iRule telemetry
Dashboards Built-in and custom dashboards
AI Integrations AI Data Fabric (AIDF) and assistant integrations
Provisioning Cloud and instance provisioning workflows
Autoscale Auto Scale groups and configuration
Autoscale Alerts Auto Scale alerting configuration
System Management Platform and system-level settings and OpenTelemetry (OTel) collector management
Disaster Recovery Disaster recovery and high availability (HA) configuration and failover
License Management License activation and assignment
Fleet License Management Fleet-wide managed-device licensing
Fleet Backup and Restore Managed-device backup and restore operations
Fleet Backup Download Downloading managed-device backup artifacts
Audit Console Access to the audit log viewer
Export Management Data export destinations and jobs
OTel OpenTelemetry collector configuration

A role can be granted any combination of resource and action pairs. For example, a “NOC Read-Write” role might get Read on everything plus Create and Partial update on Telemetry and Dashboards only.

Note

Every custom role automatically includes Read access to Device Management and System Management, regardless of what you select. This baseline ensures the UI renders correctly for anyone holding the role.

Built-in roles

F5 Insight includes three built-in roles. Built-in roles can’t be edited, renamed, or deleted, but you can clone them as a starting point for a custom role.

Role Description
Admin Full access to every resource and action. Admins can manage users, roles, licensing, and all product features. This is the only built-in role with User Management permissions.
Operator Read and write access to operational features such as device configuration, telemetry, and troubleshooting. Operators can’t manage users, roles, or licensing.
Viewer Read-only access to all product features. Viewers can see information throughout F5 Insight but can’t create, modify, or delete anything.

The following table summarizes the access level for each built-in role across key resource areas:

Resource area Admin Operator Viewer
User Management (roles, users, identity providers) Full access No access No access
Device Management (inventory, onboarding) Full access Read and write Read only
Telemetry and Dashboards Full access Read and write Read only
License Management Full access No access Read only
Fleet operations (backup, restore, software upgrades) Full access Read and write Read only
System Management and OTel Full access Read only Read only
AI Integrations (AIDF, assistant) Full access Read and write Read only
Audit Console Full access Read only Read only

Note

The permission matrix above is a summary. For the exact permissions each built-in role grants, select the role name in Settings > User Administration > Roles to view its full permission set.

Manage roles

Navigate to Settings > User Administration > Roles. The table shows every role, whether it’s Built-in or Custom, how many users currently hold it, and when it was created.

View a role’s permissions

Select a role’s name (or choose View from its row menu) to open a read-only drawer listing every permission the role grants, grouped by resource.

Create a custom role

  1. Select Add Custom Role.
  2. Enter a Role Name (required, must be unique) and an optional Description.
  3. In the permission matrix, select the resource and action combinations the role should grant. Hover over the column headers for a description of each action.
  4. Select Save Role.

The new role is immediately available for assignment to users and directory group mappings.

Tip

Follow the principle of least privilege: start from Viewer permissions and add only what the role needs, rather than cloning Admin and removing permissions.

Clone a role

Choose Clone from any role’s row menu (built-in or custom). This opens the same creation drawer, pre-filled with the source role’s permissions and a generated name (clone_<role name>, incrementing if that name is taken). Edit the name, description, and permissions as needed, then save it as a new, independent custom role. Changes to the clone don’t affect the original.

Edit a custom role

Choose Edit from a custom role’s row menu. Built-in roles can’t be edited. Update the permission matrix and select Save Changes.

Note

The role name and description can’t be changed after creation — only permissions can be updated. Users currently holding the role keep their existing access until their next login. Permission changes take effect on the next sign-in.

Delete a custom role

Choose Delete from a custom role’s row menu, then confirm. Built-in roles can’t be deleted.

Important

If any user or group mapping is still assigned to the role, deletion is blocked. Reassign them first, then delete the role.

Map directory groups to a role

If you sign in through an external identity provider (LDAP or SAML), you can automatically assign a role to anyone who belongs to a specific directory group — no manual per-user role assignment required.

  1. From a role’s row menu, choose Role Mapping.
  2. Select the Provider (the configured LDAP or SAML identity provider).
  3. Enter the exact group name (LDAP) or group/role attribute value (SAML) as it appears in your directory or SAML assertion. Matching is case-sensitive.
  4. Add additional attributes if more than one group should map to this role.
  5. Select Save.

Users authenticating through that provider who belong to the mapped group are automatically assigned the role on login.

To remove a mapping, select Delete Mapping from the role’s mapping view.

Quick reference: supported role operations

Operation Built-in roles Custom roles
View and list Yes Yes
View full permission set Yes Yes
Create — Yes
Clone (as a starting point for a new role) Yes Yes
Edit permissions No Yes
Delete No Yes (only if unassigned)
Map a directory group to the role Yes Yes

Best practices

  • Principle of least privilege: Grant only the resources and actions a role actually needs. Start from Viewer and add permissions incrementally rather than cloning Admin.
  • Prefer directory group mapping over manual per-user role assignment when you use LDAP or SAML. This keeps access in sync with your central identity system automatically.
  • Review the Roles table periodically and remove unused custom roles that are no longer needed.
  • Document the purpose of each custom role so it’s clear months later why the role exists and who it’s intended for.
  • Use Operator for day-to-day operations when users need to configure devices and view telemetry but shouldn’t manage users or licensing.
  • Use Viewer for stakeholders and auditors who need visibility into the fleet and dashboards without the ability to make changes.

Troubleshooting

Issue Resolution
“Add Custom Role” button is missing or disabled Custom role creation requires User Management — Create permission and a full (non-Light) license tier. Confirm both with your administrator.
Can’t delete a custom role A role can’t be deleted while any user or group mapping is still assigned to it. Reassign them first, then delete the role.
User still has old access after a role change Role and permission changes take effect on the user’s next login or session refresh, not instantly on their current session.
Operator can’t access License Management The built-in Operator role doesn’t include License Management permissions. Create a custom role with the required licensing permissions, or assign the Admin role.
Viewer can’t create or modify anything This is expected. The Viewer role is read-only by design. To grant write access to specific features, create a custom role with the required permissions.