Users, roles, permissions (original user model)

For users on our original user model, an introduction to how the user model works, including user roles and permissions, and how to add and manage users.

Requirements

This doc and the surrounding section of docs shows you how to manage users on our original user model. If you were a New Relic customer before July 30 2020 and haven't migrated your users to the new model, your users are on our original user model (and not the New Relic One model).

If you're an admin and want to see if you have users on the original model: If you can see users in the Users and roles UI, those users are on our original user model.

Updates about our new user model

In July of 2020, we released a new user model called the New Relic One user model, which offers many benefits in terms of how you manage your organization and users. At first this was only available to new sign-ups but over time we've been migrating more older customers to the new model. Some older customers are able to migrate their users on their own. We'll continue working on migrating users to the new model until the original model is fully deprecated.

One impact of the new user model is that it's possible now for users to have multiple logins associated with the same email. For example, a user with access to multiple organizations (like a contractor) may have their user record updated to the new user model in one organization, resulting in them having their original login method and records and a New Relic One user model record. This may result in the user being logged in to New Relic and not being able to find an account they're looking for. For more on that, see Factors affecting access.

View and manage users in UI

If your New Relic account has users on our original user model, you can use the Users and roles UI. To access this: Click the account dropdown, click Account settings, and then click Users and roles.

Some features in the UI are visible only to account Owners and Admins.

Here are some instructions and tips for adding and managing users via the UI:

User types: basic user and full user

The user type (basic user or full user) determines what features a user has access to.

Below are details on the two user types. Note that billing-related aspects only apply if you're on New Relic One pricing. If you're on our original pricing plan, billing impacts do not apply.

• Basic user. Details:
  • These users have access to basic features like setting up reporting of data, running queries of data, making custom charts and dashboards, and setting up alerts. They do not have access to our more curated observability UI experiences (for more details on feature access, see Capabilities).
  • Depending on access request settings, basic users can either upgrade themselves to be full users or request upgrade access from admins.
• Full user. Details:
  • Full users have access to everything (dependent on role restrictions), which includes our curated observability UI experiences, such as APM, infrastructure monitoring, browser monitoring, mobile monitoring, and synthetic monitors. For details, see Capabilities.
  • For organizations on New Relic One pricing: these users are billable. The Standard edition includes one free full user and up to five total.

If a user in your organization is set as a basic user in one account and a full user in another, the user is considered a full user and has full user access on all accounts in that organization.

For how to edit a user's type, see Manage users.

Account roles

A New Relic account can have only one Owner. To share an account with other users in your organization, create Admins, Users, or Restricted Users.

Add-on roles

With add-on roles, you can grant variable levels of access to all users in your account, across the entire platform of New Relic products. This allows you to tailor your account permissions levels to suit the needs of Users and Restricted Users within your account.

Giving a User or Restricted User add-on manager access to a product grants them the equivalent of Admin capabilities within the product. They will continue to have User or Restricted User capabilities for all other New Relic products. For example, you could make a software engineer in your company a User in most products, but assign Admin-level access to APM. For another example, you might assign the Nerdpack manager role to a user, and that gives them the ability to subscribe and unsubscribe New Relic One applications to an account.

There are two types of add-on roles:

• Add-on Manager roles are available to grant permissions on a per-product basis. Giving a User or Restricted User managed add-on access to a product grants them the equivalent of Admin capabilities within the product.
• Custom add-on roles can grant feature-specific permissions across different New Relic products. For example, a group of Users could have the ability to acknowledge incidents and close violations in New Relic Alerts, but not have the ability to modify your existing alert preferences.

Individuals on a parent account automatically have the same level of access for all the child accounts of the parent account.

Below are options for managing both managed add-on roles and custom add-on roles:

Account permissions

Here is a summary of user permissions. Individuals on a parent account automatically have the same level of access for all the child accounts of that parent account. However, they won't receive email notifications for alerts or weekly reports for child accounts unless they are explicitly granted permission on those accounts.

Alert permissions

Here is a summary of Admin and Add-on manager capabilities with New Relic Alerts. To allow a User or Restricted User to execute any of these functions in New Relic Alerts, assign an Alerts add-on manager role.

Admin and manager capabilities for Alerts include:

• Create or name alert policies.
• Specify incident preferences.
• Disable or define alert conditions.
• Provide runbook instructions.
• Select product targets.
• Alter alert condition thresholds.
• Create, modify, or delete notification channels.

APM permissions

Here is a summary of Admin and Add-on manager capabilities with APM. To allow a User or Restricted User to execute any of these functions in APM, assign an APM add-on manager role.

Admin and manager capabilities for APM include:

• Remove applications from the New Relic UI.
• Delete app traces and error traces.

Browser permissions

Here is a summary of Admin and Add-on manager capabilities with New Relic Browser. To allow a User or Restricted User to execute any of these functions in New Relic Browser, assign a Browser add-on manager role.

Admin and manager capabilities for Browser include:

• Add, rename, or delete applications.
• Manage whitelists.
• Manage domain conditions.

Infrastructure permissions

Here is a summary of Admin and Add-on manager capabilities with New Relic Infrastructure. To allow a User or Restricted User to execute any of these functions in New Relic Infrastructure, assign an Infrastructure manager role.

Admin and manager capabilities for Infrastructure include:

• Create alert conditions in New Relic Infrastructure, including conditions for host not reporting.
• Add or modify integrations.

Insights permissions

Here is a summary of Admin and Add-on manager capabilities with New Relic Insights.

To allow a User or Restricted User to execute any of these functions, assign an Insights manager role. These functions include:

• Create, view, modify, or delete Query API keys or Insert API keys.

Mobile permissions

To give permission to delete a mobile app from New Relic, you can assign an Admin or Mobile manager role.

Synthetics permissions

Here's a summary of Admin and Add-on manager capabilities with New Relic Synthetics. To allow a User or Restricted User to execute any of these functions in New Relic Synthetics, assign a Synthetics add-on manager role.

Admin and manager capabilities for Synthetics include:

• Create, edit, or delete monitors.
• Edit monitor scripts.
• Create, edit, or delete private locations.
• Create, edit, or delete monitor downtimes.
• Create, view, edit, or delete secure credentials.

For more information, see User roles in Synthetics.

Workloads permissions

Here's a summary of Admin and Add-on manager capabilities with New Relic One workloads:

• Create, duplicate, modify, or delete workloads.
• Link dashboards to workloads and save filters.

To allow a User or Restricted User to execute these functions, assign the workloads manager add-on role.