What Are Security Roles?

Our Security Roles feature, available to Platinum and Diamond customers, allows you to set the level of administrative permission for a specific user group. This will help you follow the principle of least privilege in your KnowBe4 console, ensuring that the various areas of your KnowBe4 account are only accessible to those who need them.

For a short overview, check out our How to Use Security Roles video. For more in-depth information, continue reading or click the links below jump to a specific section of this article.

Jump to:

How to Set Up Security Roles
Managing Security Roles
Permission Descriptions
Security Role Use Cases
Frequently Asked Questions (FAQs)

How to Set Up Security Roles

First, you'll want to make sure you have groups set up in your console, as Security Roles are applied to groups rather than users. See the Managing Groups section of our Users and Groups article for more information.

Once you have groups set up, you can follow the steps below to create Security Roles for specific groups.

1. Navigate to the Users tab within your console, then click the Security Roles subtab. 
2. From the top-right of the screen, click the +New Security Role button.
   
3. Set a name for this Security Role and then select one or more groups from the drop-down to assign this role to.
   
4. Navigate using the remaining subtabs and select the permissions you'd like this Security Role to have. The remaining subtabs on the screen include permission options for the corresponding areas of your console. See the Permissions Descriptions section below for details on what each permission includes.
   • For some permissions, you can further limit them to specific targeted groups.
     
     Important: Users can only see training and phishing campaigns if the Security Role has access to all groups in the campaign.

     • If a user is individually or CSV bulk enrolled Security Role users will lose access to the campaign.
     • Phishing data and phishing report data will only appear if the Security Role has access to all groups in the campaign.
5. Once you've made all the necessary selections, click the Create Security Role button. Any users affected by the Security Roles you've defined will gain access to their designated areas instantly.
   

Back to top

Managing Security Roles

To manage your Security roles, go to the Users tab of your KnowBe4 console and select the Security Roles subtab. All of your created Security Roles are listed here.

1. Search: Search for Security Roles by name or group.
2. Security Role Name: Click on a Security Role name to view and edit the permissions for that role. 
3. Groups: Lists all groups with this Security Role assigned. Click on a group name to see more details on that group.
4. Users: This is the number of users with this Security Role assigned. 
5. Actions: Use the drop-down menu to edit, clone, or delete.
   • Edit: View and edit the permissions for that role. 
   • Clone: Cloning a Security Role will open the New Security Role screen. The same permissions from the cloned group will already be selected for you. You can modify the Name, Security Role Groups, permissions settings, and Targeted Groups as necessary, then click the Create Security Role button to save your new group.
   • Delete: Deleting a Security Role completely removes it from your console. This action cannot be undone. 

Back to top

Permissions Descriptions

Click a tab below to learn more about the permissions available for that area of your console. 

Back to top

Security Role Use Cases

Here are a few examples of how you can use Security Roles to limit console access based on your employees' job responsibilities or requirements. Click on Use Case title for more information.
Be sure to consider your own organizational structure and needs when creating Security Roles for your KnowBe4 console. 

Back to top

Frequently Asked Questions (FAQs)

Q: I don't see the Security Roles tab on my console.

• A: If your KnowBe4 account's subscription level is Platinum or Diamond, you should see the Security Roles tab available to you after clicking on the Users tab at the top of your console.
  
  If you are a Platinum or Diamond customer and still cannot locate the Security Roles tab, you can contact Support for assistance. If you're not a Platinum or Diamond customer yet but you're interested in upgrading, your Customer Success Manager can assist you.

Q: If a user is in two groups, each with separate Security Roles defined, what permissions will they get?

• A: Permissions are additive, meaning the user will gain all the permissions you defined in the Security Roles for the groups they are a part of.
  Permissions will not be taken away from a user by giving them multiple Security Roles with differing permissions.

Q: Can I provide someone the ability to create Security Roles?

• A: Only Admins on your KnowBe4 account can create Security Roles. Admins will have access to all areas of the console. See: How to assign Admin functions

Q: Does the Security Roles feature work with Smart Groups?

• A: Yes! You can apply Security Roles to Smart Groups if necessary, but this should only be used for special cases. When using Smart Groups and Security Roles, keep in mind that for any campaign/reports access you provide, associated campaigns must have targeted only the group(s) that the Security Role has access to or else they will not appear for that Security Role.

  You can also limit access for a Security Role by using the Targeted Groups feature to view/manage specific Smart Groups.

Q: I want to allow my Security Role to import or delete users for specific groups only. Can I do this?

• A: No, you can't limit the ability to import users to specific groups. If your permissions are limited to a particular group, you will be unable to take actions that affect multiple groups. Specifically, a Security Role for Users & Groups (which targets specific groups only) will not have the ability to import users.

Back to top