Default roles

ArcGIS Enterprise defines a set of privileges for the following default roles:

• Viewer—View items such as maps, apps, demographics, and elevation analysis layers that have been shared by other ArcGIS users. Those assigned the Viewer role can join groups owned by the organization, as well as use geocoding, geosearch, and network analysis (routing and directions). Members assigned the Viewer role cannot create or share content or perform analysis or data enrichment. The Viewer role is compatible with all user types.
• Data Editor—Viewer privileges plus the ability to edit features shared by other ArcGIS users. The Data Editor role is compatible with all user types except Viewer.
• User—Data Editor privileges plus the ability to create groups and content. Users can use the organization's maps, apps, layers, and tools, and join groups that allow members to update all items in the group. Members assigned the User role can also create maps and apps, edit features, add items, share content, and create groups. The User role is compatible with the Creator and GIS Professional user types.
• Publisher—User privileges plus the ability to publish hosted web layers, ArcGIS Server layers, register data stores, publish from data store items, and perform feature and raster analysis. The Publisher role is compatible with the Creator and GIS Professional user types.
• Administrator—Publisher privileges plus privileges to manage the organization and other users.

  An organization must have at least one administrator, though two is recommended. There is no limit to the number of members who can be assigned to the Administrator role within an organization; however, for security reasons, you should only assign this role to those who require the additional privileges associated with it. The Administrator role is compatible with the Creator and GIS Professional user types.

To choose a default role assigned to new members, go to Organization > Settings > New member defaults and choose a role from the Role drop-down menu.

Keep the following in mind:

• You can only select a default role once a default user type is selected. Only roles that are compatible with the selected default user type will be listed in the drop-down menu.
• When you federate a server with the portal, the portal's security store controls all access to the server. This provides a convenient sign-in experience but also impacts how you access and administer the federated server. For example, when you federate, any users, roles, and permissions that you previously configured on ArcGIS Server services are no longer valid. Access to services is instead determined by portal members' roles and sharing permissions. See Administer a federated server to learn more about how federating will impact your site.

Custom roles

You may want to refine the default roles in your organization into a more fine-grained set of privileges by creating custom roles. For example, your organization may want to assign some members the same privileges as a default Publisher but without allowing them to use GeoEnrichment. This could be achieved by creating a custom role based on the default Publisher role, turning off the GeoEnrichment privilege, and naming the custom role to reflect what privileges it confers; for example, you could name this role Publisher without GeoEnrichment or something similar.

Only members of the default administrator role, or those assigned a custom administrator role with the Member roles privilege, can create and modify custom roles. These administrators can configure custom roles based on any combination of available general and administrative privileges. To help create a custom role, administrators can use one of the available predefined templates containing privileges for common workflows, such as curating data or authoring content. The templates can be used as configured or can be customized as needed by adding or removing privileges. Once a custom role has been created, any organization member who has the Change roles privilege can assign the role to members.

When you create a custom role, privileges that are dependent on one another are enabled by default. For example, to publish a hosted feature layer, role members must also have the privilege to create, update, and delete content. If you disable either of those privileges, members of the role cannot publish a hosted feature layer. See Privileges for common workflows for a list of dependent privileges required for members to complete specific tasks.

You can create custom roles that include administrative privileges to manage the portal settings. This allows administrators to delegate a specific set of administrative tasks to users without giving them the full set of privileges in the default administrator role. For example, a user with a custom role that includes the Organization website privilege will have the ability to manage the portal's website settings without the ability to perform other administrative tasks, such as managing security or server settings.

The privileges that can be granted to a member through a custom role cannot exceed those associated with the member's assigned user type. For example, a member with a Viewer user type cannot be assigned a role with editing privileges.