This article discusses roles in Splunk On-Call and provides a detailed breakdown of the specific permissions allocated to each role. It will also review how to change the roles for users.

There are five roles in Splunk On-Call:

• Global Admin: Global access, no restrictions
• Team Admin: Manages people and scheduling on a team basis
• Alert Admin: Manages the technical aspects of creating and optimizing alerts
• User: Alert response
• Stakeholder: Read-only awareness

Global Admin, Alert Admin, User, and Stakeholder are global roles. The Team Admin role is assigned on a team basis. This means that a user that is a Team Admin for one team has permissions to manage people and schedules for only that team.

This means that a user can hold two roles. Here are the possible combinations:

• User & Team Admin
• Alert Admin & Team Admin

Stakeholders can be considered separate from all other roles as these users cannot be placed in any on-call schedules nor take action on incidents.  They can simply be added to existing incidents and notified through their defined contact methods for awareness.  For comprehensive information on stakeholders, please see this article.

The next sections provides a detailed breakdown of the specific permissions for each role.

User Permissions

User Management

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Invite User		✔		✔
Delete User		✔
Increase Seats		✔		✔
User Profile	View	✔	own	For users on team(s) where they are a Team Admin	own	own
	Manage Contact Methods	✔	own	For users on team(s) where they are a Team Admin	own	own
	Manage Paging Policies	✔	own	For users on team(s) where they are a Team Admin	own	own
	Manage Global Roles	✔
Promote User to Team Admin		✔		For team(s) where they are a Team Admin

Team Management

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Team	Create	✔		✔
	Rename	✔		For team(s) where they are a Team Admin
	Delete	✔		For team(s) where they are a Team Admin
Users	Add	✔		For team(s) where they are a Team Admin
	Remove	✔		For team(s) where they are a Team Admin
	Make Team Admin	✔		For team(s) where they are a Team Admin
Rotations	View	✔	✔	For team(s) where they are a Team Admin	✔
	Create	✔		For team(s) where they are a Team Admin
	Edit	✔		For team(s) where they are a Team Admin
	Delete	✔		For team(s) where they are a Team Admin
Escalation Policies	View	✔	✔	For team(s) where they are a Team Admin	✔
	Create	✔		For team(s) where they are a Team Admin
	Edit	✔		For team(s) where they are a Team Admin
	Delete	✔		For team(s) where they are a Team Admin
Scheduled Overrides	Take	✔	✔	✔	✔
	Create	✔	For themselves	For users on team(s) where they are a Team Admin	For themselves
	Assign	✔		For Escalation Policies within a team where they are a Team Admin
	Reset assignee to NULL	✔	For their own	For Escalation Policies within a team where they are a Team Admin	For their own
	Delete	✔	For their own	For their own	For their own

Alert/Incident Management

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Integrations	View	✔	✔	✔	✔
	Enable	✔	✔
	Revoke	✔	✔
Incident Configurations	View	✔	✔	✔	✔
	Edit	✔	✔
Routing Keys	View	✔	✔	✔	✔
	Create	✔	✔
	Update	✔	✔
	Delete	✔	✔
Rules Engine	View rules	✔	✔	✔	✔
	Preview Rule	✔	✔	✔	✔
	Create	✔	✔
	Edit	✔	✔
	Reorder	✔	✔
	Enable	✔	✔
	Disable	✔	✔
	Delete	✔	✔
Outgoing Webhooks	View	✔	✔
	Create	✔	✔
	Edit	✔	✔
	Delete	✔	✔
	Enable	✔	✔
	Disable	✔	✔
On-Call API	Create key	✔
	Delete key	✔
	Rename key	✔
	Revoke ALL keys	✔

On-call Actions

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Manual Take On-call	Take On-call	✔	✔	✔	✔
	Take Back	If they are the user who's shift was taken (ex: Jason takes for Sarah, Sarah can Take Back. This is not role dependent)
	Clear Take	✔	Only if they are the person who took the on-call shift	For escalation policies within a team where they are a Team Admin	Only if they are the person who took the on-call shift
Maintenance Mode	Enter	✔	✔
	Exit	✔	✔
Conference Bridges	Start	✔	✔
	End	✔	✔
Incident Actions	View	✔	✔	✔	✔	View stakeholder information on specific incidents that a user has added them to
	Ack	✔	✔	✔	✔
	Ack All	✔	✔	✔	✔
	Resolve	✔	✔	✔	✔
	Resolve All	✔	✔	✔	✔
	Reroute	✔	✔	✔	✔
	Snooze	✔	✔	✔	✔
	Edit Snooze time	Only the user who snoozed the incident can change the time, this is not role-dependent
	Add Stakeholders to Incidents	✔	✔	✔	✔
	Create Manual Incident	✔	✔	✔	✔

Billing

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Change Billing Contact Info		✔
Add payment method		✔
Update payment method		✔
Download invoice (PDF)		✔

Reporting

		Global Admin	Alert Admin	Team Admin	User	Stakeholder
Post Incident Review	View	✔	✔	✔	✔
	Print	✔	✔	✔	✔
	Create	✔	✔	✔	✔
	Edit	✔	For reports they created	✔	For reports they created
	Delete	✔	For reports they created	✔	For reports they created
Performance (MTTA/MTTR)	View	✔	✔	✔	✔
	Print	✔	✔	✔	✔
On-call	View	✔	✔	✔	✔
	Print	✔	✔	✔	✔
Incident Frequency	View	✔	✔	✔	✔
	Print	✔	✔	✔	✔

How to Change Global Roles

Only Global Admins can change the user roles. This includes other Global Admins.

To change a user’s global role, navigate to Users, and click on the name of the user to access their profile page.

You may change the role of that user by selecting a new role from the Role dropdown. Your changes will save automatically.

For information on how to manage Team Admin permissions, please visit the How to set up Team Admins article.

For more information regarding overall Admin permissions, including the Alert Admin role, please follow the link our How to Manage Admin Permissions Knowledge Base article.

How to change Stakeholder Roles

Users can be converted to or from a stakeholder role with the assistance of the support team.  Please note that Stakeholders are priced differently from all other user roles so additional charges may be incurred if converting someone from a stakeholder to another role.

If interested in a stakeholder conversion, please contact the support team and include the specific user(s) you’d like to convert and what role you’d like them converted to.  If converting from one of the user role types to a stakeholder, please ensure that the user is removed from all rotations and escalation policies and isn’t actively being paged for any incidents.