Users, roles, permissions (original user model)

For users on our original user model: how user roles and permissions work on this model, and how to add and manage users.

Requirements

This section of docs shows you how to manage users on our original user model. If you can see users in the Users and roles UI, those users are on our original user model.

There are limits on how many sessions and IP addresses a New Relic user can have. For details, see Factors affecting access.

Updates about our new user model

In July of 2020, we released a new user model that offers many benefits in terms of how you manage your organization and users. At first this was only available to new sign-ups but over time we've been migrating older customers to the new model. Some older customers are able to self-serve the migration of their users. We'll continue working on migrating users to the new model until the original model is fully deprecated.

One impact of the new user model is that it's possible now for users to have multiple logins associated with the same email. For example, a user with access to multiple organizations (like a contractor) may have their user record updated to the new user model in one organization, resulting in them having both their original login method and records and a user record on the newer model. This may result in the user being logged in to New Relic and not being able to find an account they're looking for. For more on that, see Factors affecting access.

If a user's email is associated with more than one login, they'll see a "multiple accounts found" note when logging in.

View and manage users in UI

The Users and roles UI is used for managing users on our original user model. To find this UI: click the user menu, click Account settings, and then click Users and roles.

If you're on our newer usage-based pricing model, see some important considerations.

You can also use the New Relic REST API to get a list of users for an account.

Here are instructions and considerations for some common user management tasks and scenarios:

Tip

Owner or Admins

Note that if you're adding users on our original user model to an organization that has multiple accounts, you'll want to think about which account you add users to, because the account structure impacts what users have access to.

To add a new user to a New Relic account:

For the account you want to add a user to, go to: user menu > Account settings > Users and roles > Users.
In the upper right corner, click New user.
Enter the appropriate name and email address.
Select their user type. Note that the user type is a billing factor if you're on our usage-based pricing model.
Select their base role as either Admin, User, or Restricted.
Select Add user.
The new user will receive an email notification automatically from New Relic.
Important
New Relic recommends a maximum of 1,000 accounts per user. Additional accounts may result in limited access to some New Relic features.

If you're on our usage-based pricing model, the user types of your users are a factor in your billing.

If you have multiple accounts in your organization, here are some important considerations when managing billable users on the original user model:

You aren't able to see all your organization's users in a single UI. If your goal is to review and edit all your users (for example, editing their user type for billing purposes), you must go to the Users and roles UI for each individual account. (Note that the ability to more easily manage your users is one benefit of our newer user model.)
Because of the above point, the count of billable users you see in the View your usage UI may not match the number of users you see when you go to a specific account's Users and roles UI.
You can be charged for billable users in all accounts in your organization, regardless of whether those accounts are marked as "active" or "inactive" (not reporting data) in the Account settings UI.
For tips on editing user type, see Manage user type.

Some important tips for managing user type:

If you're on our usage-based pricing model, your users' user type is a billing factor.
If you upgrade a user to a higher user type (either via the UI or via an upgrade request email), their user type is changed across all accounts in the organization.
To update your users' user type:

Go to: user menu > Account settings > Users and roles > Users.
Select a user and edit their type, or bulk update the type for multiple users. Note that if your organization has multiple accounts, you can't see all your users in a single UI location: to manage users across in different accounts, you'll have to go to the Users and roles UI for each account.
To view and approve users who have requested an upgrade:
Go to: user menu > Account settings > Users and roles.
Click Upgrade requests. Note that if your organization has multiple accounts, you can't see all your users in a single UI location: to manage users across in different accounts, you'll have to go to the Users and roles UI for each account.
To control how users upgrade, from the Users and roles UI, you can select Access requests. You have two options:

Automatic approval: With this option, users can automatically and immediately upgrade their user type. This option allows your users to more easily troubleshoot problems.
Require review: With this option, your admins get a notification email when users request an upgrade and the admins must upgrade them first. They can be approved either from the notification email or from the user's record in the Users and roles UI.
For more about user type, see User type.

If your organization has implemented SAML Single Sign On, you may have a list of Pending users. These are users who have been added to the SAML-enabled account but have not yet confirmed.

For organizations on our newer usage-based pricing model and have users on our original user model, these Pending invite users are not billable. (If they're on our newer user model, Pending invite users are billable).

The Owner role concept exists only for users on our original user model.

A New Relic account can have only one Owner role at any time. You must be the current account Owner to change your role to someone who currently has an Admin role for the account. If the current Owner is unavailable, contact your account representative at New Relic, or get support at support.newrelic.com.

You cannot delete or remove your assigned Owner role. However, if the account has one or more Admin role, you can change an Owner to an Admin.

Go to: user menu > Account settings > Account > Users and roles.
Above the Active users list, select Change owner. If an account has no Admins, this button won't be available.
Select someone who currently has an Admin role for the account.
Refresh the page for changes to take effect.
Your previous Owner role automatically changes to an Admin role.
To find out who is the current assigned Owner:
Go to: user menu > Account settings > Account > Users and roles.
View the Base role column to locate your account Owner.
The Change owner button is only visible to the current account Owner. If the current Owner is unable to change the role (for example, that person no longer is with your organization), contact your account representative at New Relic, or get support at support.newrelic.com.

User type

For organizations on our usage-based pricing model, the user type is a billing factor.

A user's user type is what governs their maximum allowed access to New Relic features. In practice, users will often have roles assigned to them that limit their permissions in various ways, but the user type represents their maximum theoretical access. For more information, see User type.

If a user in your organization is set as different user types in different accounts, the user is considered as whatever their highest user type is.

For how to edit a user's type, see Manage user type.

Account roles

Here are our default available roles:

Account role	Description
Owner	The person who initially creates a New Relic account and receives all billing queries. A New Relic account can have only one Owner. The Owner has complete access to all of the account information.
Admin	Can add, edit, and delete users, and can enable or set up features.
User	Can use (and optionally set up) New Relic features. In general, Admins take responsibility for setting up features, and Users and Restricted Users can use them.
Restricted User	One or more individuals who can view (but not set up or change) any New Relic features. The Restricted User role is useful, for example, for demos. You can change your New Relic session settings so that Restricted User logins do not time out, and then set the user interface to Kiosk mode.

Add-on roles

Add-on roles let you grant more specific and granular access to your users. Giving a User or Restricted User add-on manager access grants them the equivalent of Admin permissions for that feature category. They will continue to have User or Restricted User permissions for all other New Relic products. For example, you could make a software engineer in your company a User and assign them the APM manager role to give them permissions.

A view of the permissions UI for the alerts manager

Individuals on a parent account automatically have the same level of access for all the child accounts of the parent account.

We have the following add-on manager roles:

Alerts manager
manager
Applied intelligence manager
Browser manager
Data retention manager
Incident intelligence manager
Incident workflows manager
Infrastructure manager
Insights manager
Invite teammate email manager
Logs manager
Mobile manager
Nerdpack manager
Synthetics manager
Trace observer manager
Workloads manager

To understand the permissions that a role has, go to: user menu > Account settings > Users and roles > Roles and select a specific role. For a description of specific permissions, see Permissions.

Here are some more details about some of our add-on manager roles:

Here is a summary of Admin and Add-on manager permissions with alerts. To allow a User or Restricted User to execute any of these functions in alerts, assign an alerts add-on manager role.

Admin and manager permissions for include:

Create or name alert policies.
Specify incident preferences.
Disable or define alert conditions.
Provide runbook instructions.
Select product targets.
Alter alert condition thresholds.
Create, modify, or delete notification channels.

Here is a summary of Admin and Add-on manager permissions with New Relic Infrastructure. To allow a User or Restricted User to execute any of these functions in New Relic Infrastructure, assign an Infrastructure manager role.

Admin and manager permissions for Infrastructure include:

Create alert conditions in New Relic infrastructure, including conditions for host not reporting.
Add or modify integrations.

Here's a summary of Admin and Add-on manager permissions with synthetic monitoring. To allow a User or Restricted User to execute any of these functions with synthetic monitoring, assign a synthetics add-on manager role.

Admin and manager permissions for synthetics include:

Create, edit, or delete monitors.
Edit monitor scripts.
Create, edit, or delete private locations.
Create, edit, or delete monitor downtimes.
Create, view, edit, or delete secure credentials.
For more information, see User roles in Synthetics.

For a description of specific permissions, see Capabilities.

Manage custom and add-on roles

Below are options for managing both managed add-on roles and custom add-on roles:

Tip

Owner and Admins

Managed add-on roles are available by default for each New Relic product. Adding a managed role for a user grants them Admin-level permissions for the assigned product. They cannot be edited or deleted. To assign a managed add-on role for a User or Restricted User in your account:

Go to user menu > Account settings > Users and roles.
From the list of users associated with your account, select their name.
Under Add-on roles, select the type of manager role for the user.
To understand which permissions may be added, use the Capabilities preview chart.
Features in the Capabilities preview chart may not exactly match what features are available for your subscription level.
Tip
You can also add, update, or delete users in bulk by using a CSV file.

Account permissions

The table below gives a summary of roles and their permissions. Note that these are roles applicable only for our original user model.

Users in a parent account have the same level of access for all the child accounts of that parent account. However, those users won't receive email notifications for alerts or weekly reports for child accounts unless they are explicitly granted permission on those accounts.

Function	Owner	Admin	User	Restricted
Maintain billing information.
Change the account Owner.
Add, update, and delete account Admins, Users, and Restricted Users. When the account Owner and Admins add individuals to the account, New Relic automatically sends them an email message.
Update users' job titles and roles from Account settings in the New Relic UI.
Create, modify and delete child accounts from Account settings in the New Relic UI.
Update your own account information (name, password change or password reset request, default account, email preferences, etc.) from User preferences in the New Relic UI.
Change someone else's password. You cannot reset passwords for anyone else on the account, even if you are an Owner or Admin. Instead, follow standard procedures to request a password reset from New Relic.
View the list of individuals on the account from (user menu) > Account settings > Account > Summary in the New Relic UI.
Manage flexible data retention.
Subscribe and unsubscribe applications to New Relic
Add, update, and delete proactive detection configurations.

Have more questions about access to New Relic? See Factors affecting access.

Bulk user management

With the Bulk user actions feature, you can add, update, or delete multiple users at once. This can be helpful for:

adding roles when multiple new employees start
deleting roles when multiple employees leave
giving multiple employees Admin roles

Update users in bulk

Some important rules and recommendations for making bulk user actions:

You cannot make updates to your own role or an Owner role.
You cannot edit an existing user's email address or name.
You should avoid editing an existing user by deleting and re-adding them because this can have unintended consequences (for example, API keys associated with the original user will be lost).

To add new user roles, update existing user roles, or delete user roles for users on the original user model:

Go to: user menu > Account settings > Users and roles, and add /bulk_actions at the end of the URL.
Example URL:
```
https://account.newrelic.com/accounts/123456789/users/bulk_actions
```
Download a Backup CSV file. Downloading a backup file keeps a record of the users in your account prior to changes being made, and allows you to easily re-add any users that may be removed accidentally.
Download a CSV of users or a CSV template. Each bulk action (add, update, or delete) will require its own CSV file. New Relic recommends saving your files with an account number, date, and the bulk action being performed. For example: account_123456789_delete_users_2018-06-29

Populate that sheet with only the users whose roles you'll be applying the chosen bulk action for. Remove users from the spreadsheet whose roles you do not want to change.

Bulk action	Fields
Add	Required fields: user email, name, type, base role Optional field: add-on role
Update	Required fields: user email (do not edit), name (do not edit), base role Optional field: add-on role
Delete	Required fields: only user email

Bulk action

Fields

Add

Required fields: user email, name, type, base role

Optional field: add-on role

Update

Required fields: user email (do not edit), name (do not edit), base role

Optional field: add-on role

Delete

Required fields: only user email

The following is an example downloaded CSV of users that lists four users on the New Relic account. In this example, we want to delete the user Alex Datanerd. All other users must be removed before uploading the CSV.

Email	Name	Type	Base role	Add-on roles	Last active
User1 @Company.com	Jane Datanerd	full	Owner		2/6/20
User2 @Company.com	Jamie Datanerd	full	Admin		6/6/20
User3 @Company.com	Alex Datanerd	full	User	apm_admin, browser_admin	7/25/20
User4 @Company.com	Pat Datanerd	basic	User	alerts_admin, insights_admin, apm_admin	4/6/20

The other three users, whose roles will remain unchanged, are removed. The final CSV only shows Alex's name. This file would then be uploaded using the Delete users in CSV option in the UI.

Email	Name	Type	Base role	Add-on roles	Last active
User3 @Company.com	Alex Datanerd	full	User	apm_admin, browser_admin

In the UI, select a CSV action: Add, Update, or Delete the users listed within the CSV file.
Upload the new CSV, and select Save changes.

Bulk user management troubleshooting

If a user is removed or changed during your CSV file upload by mistake, you can add them back through another CSV file upload.

Important

Be aware that associated permissions may be lost when a user is deleted and re-added. For example, associated API keys will need to be re-added.

If no backup CSV file has been previously downloaded:

Download the CSV file template.
Populate the spreadsheet with the information required for the user to be restored.
Action
Required fields
Add
User email, name, type, base role.
Optional: Add-on role
Update
User email, name, type, base role.
Optional: Add-on role
Delete
User email
Select a CSV action for the new CSV file: Add, Update, or Delete.
Upload the new CSV, and select Save changes.

Users, roles, permissions (original user model)

Requirements .css-21sua1{background:none;border:none;width:0;padding:0;}

Updates about our new user model

View and manage users in UI

Manage billable users

Manage user type and user upgrades

Enable SAML SSO and/or SCIM

View pending SAML SSO users

Update account roles

Delete a user

Update the account Owner

User type

Account roles

Add-on roles

Alerts manager

APM manager

Applied intelligence, incident intelligence, incident workflow

Browser manager

Infrastructure manager

Insights manager

Invite teammate email manager

Nerdpack manager

Synthetics manager

Trace observer manager

Workloads manager

Manage custom and add-on roles

View roles

Assign a managed role

Create a custom role

Assign a custom role

Edit or delete a custom role

Account permissions

Bulk user management

Update users in bulk

Example CSV file

Bulk user management troubleshooting

Important

If you have a backup CSV file

If no backup file exists

Requirements