<commit_before>---
title: Managing Chronograf users
description: Managing Chronograf users and roles, SuperAdmin status, and InfluxDB and Kapacitor users.
menu:
  chronograf_1_7:
    name: Managing Chronograf users
    weight: 90
    parent: Administration
---

**On this page**

* [Managing Chronograf users and roles](#managing-chronograf-users-and-roles)
* [Organization-bound users](#organization-bound-users)
  * [InfluxDB and Kapacitor users within Chronograf](#influxdb-and-kapacitor-users-within-chronograf)
  * [Chronograf-owned resources](#chronograf-owned-resources)
  * [Chronograf-accessed resources](#chronograf-accessed-resources)
  * [Members](#members-role-member)
  * [Viewers](#viewers-role-viewer)
  * [Editors](#editors-role-editor)
  * [Admins](#admins-role-admin)
* [Cross-organization SuperAdmin status](#cross-organization-superadmin-status)
  * [All New Users are SuperAdmins configuration option](#all-new-users-are-superadmins-configuration-option)
* [Creating users](#creating-users)
* [Updating users](#updating-users)
* [Removing users](#removing-users)
* [Navigating organizations](#navigating-organizations)
  * [Logging in and logging out](#logging-in-and-logging-out)
  * [Switching the current organization](#switching-the-current-organization)
  * [Purgatory](#purgatory)

## Managing Chronograf users and roles

> ***Note:*** Support for organizations and user roles is available in Chronograf 1.4 or later. First, OAuth 2.0 authentication must be configured (if it is, you'll see the Chronograf Admin tab on the Admin menu). For more information, see [Managing security] (https://docs.influxdata.com/chronograf/v1.7/administration/managing-security/).

Chronograf includes four organization-bound user roles and one cross-organization SuperAdmin status. In an organization, admins (with the `admin` role) or users with SuperAdmin status can create, update, and assign roles to a user or remove a role assignment.

### Organization-bound users

Chronograf users are assigned one of the following four organization-bound user roles, listed here in order of increasing capabilities:

- [`member`](#members-role-member)
- [`viewer`](#viewers-role-viewer)
- [`editor`](#editors-role-editor)
- [`admin`](#admins-role-admin)

Each of these four roles, described in detail below, have different capabilities for the following Chronograf-owned or Chronograf-accessed resources.

#### InfluxDB and Kapacitor users within Chronograf

Chronograf uses InfluxDB and Kapacitor connections to manage user access control to InfluxDB and Kapacitor resources within Chronograf. The permissions of the InfluxDB and Kapacitor user specified within such a connection determine the capabilities for any Chronograf user with access (i.e., viewers, editors, and administrators) to that connection. Administrators include either an admin (`admin` role) or a user of any role with SuperAdmin status.

> **Note:** Chronograf users are entirely separate from InfluxDB and Kapacitor users.
> The Chronograf user and authentication system applies to the Chronograf user interface.
> InfluxDB and Kapacitor users and their permissions are managed separately.
> [Chronograf connections](https://docs.influxdata.com/chronograf/v1.7/administration/creating-connections/)
> determine which InfluxDB or Kapacitor users to use when when connecting to each service.

#### Chronograf-owned resources

Chronograf-owned resources include internal resources that are under the full control of Chronograf, including:

- Kapacitor connections
- InfluxDB connections
- Dashboards
- Canned layouts
- Chronograf organizations
- Chronograf users
- Chronograf Status Page content for News Feeds and Getting Started

#### Chronograf-accessed resources
<commit_msg>updated link to connection docs<commit_after>---
title: Managing Chronograf users
description: Managing Chronograf users and roles, SuperAdmin status, and InfluxDB and Kapacitor users.
menu:
  chronograf_1_7:
    name: Managing Chronograf users
    weight: 90
    parent: Administration
---

**On this page**

* [Managing Chronograf users and roles](#managing-chronograf-users-and-roles)
* [Organization-bound users](#organization-bound-users)
  * [InfluxDB and Kapacitor users within Chronograf](#influxdb-and-kapacitor-users-within-chronograf)
  * [Chronograf-owned resources](#chronograf-owned-resources)
  * [Chronograf-accessed resources](#chronograf-accessed-resources)
  * [Members](#members-role-member)
  * [Viewers](#viewers-role-viewer)
  * [Editors](#editors-role-editor)
  * [Admins](#admins-role-admin)
* [Cross-organization SuperAdmin status](#cross-organization-superadmin-status)
  * [All New Users are SuperAdmins configuration option](#all-new-users-are-superadmins-configuration-option)
* [Creating users](#creating-users)
* [Updating users](#updating-users)
* [Removing users](#removing-users)
* [Navigating organizations](#navigating-organizations)
  * [Logging in and logging out](#logging-in-and-logging-out)
  * [Switching the current organization](#switching-the-current-organization)
  * [Purgatory](#purgatory)

## Managing Chronograf users and roles

> ***Note:*** Support for organizations and user roles is available in Chronograf 1.4 or later. First, OAuth 2.0 authentication must be configured (if it is, you'll see the Chronograf Admin tab on the Admin menu). For more information, see [Managing security] (https://docs.influxdata.com/chronograf/v1.7/administration/managing-security/).

Chronograf includes four organization-bound user roles and one cross-organization SuperAdmin status. In an organization, admins (with the `admin` role) or users with SuperAdmin status can create, update, and assign roles to a user or remove a role assignment.

### Organization-bound users

Chronograf users are assigned one of the following four organization-bound user roles, listed here in order of increasing capabilities:

- [`member`](#members-role-member)
- [`viewer`](#viewers-role-viewer)
- [`editor`](#editors-role-editor)
- [`admin`](#admins-role-admin)

Each of these four roles, described in detail below, have different capabilities for the following Chronograf-owned or Chronograf-accessed resources.

#### InfluxDB and Kapacitor users within Chronograf

Chronograf uses InfluxDB and Kapacitor connections to manage user access control to InfluxDB and Kapacitor resources within Chronograf. The permissions of the InfluxDB and Kapacitor user specified within such a connection determine the capabilities for any Chronograf user with access (i.e., viewers, editors, and administrators) to that connection. Administrators include either an admin (`admin` role) or a user of any role with SuperAdmin status.

> **Note:** Chronograf users are entirely separate from InfluxDB and Kapacitor users.
> The Chronograf user and authentication system applies to the Chronograf user interface.
> InfluxDB and Kapacitor users and their permissions are managed separately.
> [Chronograf connections](/chronograf/v1.7/administration/creating-connections/)
> determine which InfluxDB or Kapacitor users to use when when connecting to each service.

#### Chronograf-owned resources

Chronograf-owned resources include internal resources that are under the full control of Chronograf, including:

- Kapacitor connections
- InfluxDB connections
- Dashboards
- Canned layouts
- Chronograf organizations
- Chronograf users
- Chronograf Status Page content for News Feeds and Getting Started

#### Chronograf-accessed resources

{'fraction_non_alphanumeric': 0.09166110740493662, 'fraction_numerical': 0.0032021347565043363, 'mean_word_length': 5.45650301464255, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 15, 'https://': 3, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4555727', 'n_tokens_mistral': 2081, 'n_tokens_neox': 1957, 'n_words': 736}