Privileges granted to roles

Privileges are granted to organization members through roles. Role privileges allow members to perform various tasks and workflows in an organization. For example, some members have privileges to create and publish content, while others have privileges to view content but cannot create their own.

When the organization administrator creates custom roles, the administrator specifies which privileges the custom role includes. Default roles include a specific set of privileges that cannot be altered.

There are two levels of privileges: General privileges and Administrative privileges.

General privileges

Members who perform specific tasks in the organization—create maps or edit features, for example—can be assigned the general privileges they need to complete their work.

The following table lists privileges, grouped by category, and provides a description of each privilege. The table also lists which default roles include the privilege.

In addition to these privileges that you can grant to custom roles and that are included with default roles, all organization members can use geosearch and subscriber content regardless of their role.

Category	General privilege	Description	Default roles that include the privilege
AI	Use AI	Allows use of AI features in ArcGIS.	All default roles
AI	Use AI assistants	Allows access to AI assistants.	All default roles
AI	Use AI premium services	Allows access to AI premium services.	All default roles
Members	View	Allows members to view the Members tab of the organization page. Without this privilege, members cannot see the organization page.	All default roles
Members	Take ArcGIS Pro license offline	Allows members to take their ArcGIS Pro license offline. Note: If the organization administrator turns on the Members cannot take ArcGIS Pro offline setting, it overrides this privilege. See Manage ArcGIS Pro settings.	All default roles
Members	Share location	Allows members to share their last known location when location sharing is enabled.	All default roles
Members	Share location history	Allows members to share their historical tracks, track lines, and last known location when location sharing is enabled.	Data Editor, User, Publisher, Facilitator, Administrator
Groups	Create, update, and delete	Allows members to create groups in the organization and control the groups they own.	User, Publisher, Facilitator, Administrator
Groups	Join organizational groups	Allows members to be added to or request to join groups in the organization. Members can only request to join organizational groups if they also have the privilege to view groups shared with the organization. Without the privilege to view groups shared with the organization, members do not see the groups and, therefore, cannot request to join them.	All default roles Note: Only members of the User, Publisher, Facilitator, and Administrator default roles can join shared update groups.
Groups	Join external groups	Allows members to be added to or request to join groups external to the organization. Members can only request to join external groups if they also have the privilege to view groups shared with the organization. Without the privilege to view groups shared with the organization, members do not see the groups and, therefore, cannot request to join them.	User, Publisher, Facilitator, Administrator
Groups	View groups shared with organization	Allows members to discover and view groups that are configured to allow organization members to view them.	User, Publisher, Facilitator, Administrator
Groups	Invite partnered organization members	Allows members to create groups that include members from partnered organizations, as well as invite members of partnered organizations to groups.	User, Publisher, Facilitator, Administrator
Groups	Add members from other organizations	Allows members to create groups that include members from other organizations, as well as invite members of other organizations to groups.	User, Publisher, Facilitator, Administrator
Content	Create, update, and delete	Allows members to create items in the organization and control items they own. Members are also required to be a member of a shared update group.	User, Publisher, Facilitator, Administrator
Content	Publish hosted feature layers	Allows members to publish hosted feature layers from supported files and clients.	Publisher, Facilitator, Administrator
Content	Publish hosted tile layers	Allows members to publish hosted tile layers and hosted 3D tiles layers. This also allows members to manage layers published from packages.	Publisher, Facilitator, Administrator
Content	Publish hosted scene layers	Allows members to publish hosted 3D (scene) layers and allows members to manage scene layers published from packages.	Publisher, Facilitator, Administrator
Content	Publish hosted tiled imagery layers	Allows members to publish hosted tiled imagery layers from a single image or collection of images and allows members to export a tile package from a hosted tiled imagery layer.	Publisher, Facilitator, Administrator
Content	Publish hosted dynamic imagery layers	Allows members to publish hosted dynamic imagery layers from a single image or collection of images.	Publisher, Facilitator, Administrator
Content	View content shared with the organization	Allows members to view content shared with the organization.	All default roles
Content	Create and edit notebooks	Allows members to create and edit interactive notebooks.	Administrator
Content	Schedule notebooks	Allows members to schedule future automated runs of a notebook.	Administrator
Content	View location tracks	Allows members to view members' location tracks using shared track views when location sharing is enabled.	Administrator
Content	Publish feeds	Allows members to publish feeds to collect and display real-time data using ArcGIS Velocity. Note: This privilege is only available if the organization has ArcGIS Velocity licenses.	Publisher, Facilitator, Administrator
Content	Publish real-time analytics	Allows members to publish real-time analytics to analyze and process real-time data using ArcGIS Velocity. Note: This privilege is only available if the organization has ArcGIS Velocity licenses.	Publisher, Facilitator, Administrator
Content	Publish big data analytics	Allows members to publish big data analytics to analyze historical observation data using ArcGIS Velocity. Note: This privilege is only available if the organization has ArcGIS Velocity licenses.	Publisher, Facilitator, Administrator
Content	Reassign content	Allows members to transfer ownership of content they own to another member in the same organization. The member to whom ownership is transferred must have the privilege to receive content.	Administrator
Content	Receive content	Allows members to receive content transferred to them from members who have the privilege to reassign content. This privilege is not required to receive content transferred by organization administrators.	Administrator
Content	Create and run data pipelines	Allows members to create, edit, and run data pipelines.	Publisher, Facilitator, Administrator
Content	Generate API keys	Allows members to create and embed API keys as a longer-term authentication option in app items.	Administrator
Content	Assign privileges to OAuth 2.0 applications	Allows members to define privileges for OAuth 2.0 credentials in app items. The privileges a member can assign are based on their own privileges in the organization; for example, a member of a role that does not have administrative privileges cannot assign administrative privileges to the OAuth app. This privilege also allows members to specify which of their own items can be accessed by the OAuth app.	Administrator
Content	Create workflow item	Allows members to create Workflow Manager items. Note: The ability to create workflow items is only available when Workflow Manager is configured for the organization.	Publisher, Facilitator, Administrator
Sharing	Share with groups	Allows members to share items they own with groups to which they belong.	User, Publisher, Facilitator, Administrator
Sharing	Share with organization	Allows members to share items they own with their organization.	User, Publisher, Facilitator, Administrator
Sharing	Share with public	Allows members to share items they own with the public, including those who are not signed in.	User, Publisher, Facilitator, Administrator
Sharing	Make groups visible to organization	Allows members to make groups discoverable by the organization.	User, Publisher, Facilitator, Administrator
Sharing	Make groups visible to public	Allows members to make groups discoverable by the public, including those who are not signed in.	User, Publisher, Facilitator, Administrator
Sharing	Make groups available to Open Data	Allow members to add an Open data label to groups.	Administrator
Premium Content	Geocoding	Allows members to use ArcGIS World Geocoding Service (or a view of this locator) to convert addresses or places to map points and store the results—for example, when publishing spreadsheets (.csv or Microsoft Excel files) as hosted feature layers. This privilege does not apply to locators configured for the organization.	All default roles
Premium Content	Network Analysis	Allows members to perform network analysis tasks such as routing and drive-time areas.	All default roles
Premium Content	Spatial Analysis	Allows members to perform spatial analysis tasks such as creating buffers.	User, Publisher, Facilitator, Administrator
Premium Content	Custom print layout templates	Allows members to print from layout items.	All default roles
Premium Content	GeoEnrichment	Allows members to use ArcGIS GeoEnrichment Service to enrich features.	User, Publisher, Facilitator, Administrator
Premium Content	Demographics	Allows members to use premium demographic data.	All default roles
Premium Content	Imagery Analysis	Allows members to perform imagery and raster analysis tasks such as calculating slope.	Publisher, Facilitator, Administrator
Premium Content	Advanced notebooks	Allows members to import and use ArcPy modules in ArcGIS Notebooks.	Administrator
Premium Content	Run web tools	Allows members to run web tools. Note: Additional privileges (such as publishing hosted web layers, creating items, managing content, or running specialized analysis tools) may be required depending on the workflows included in the web tool. See Privileges for common workflows below for the privileges needed to complete common tasks.	Administrator
Premium Content	Feature report	Allows members to create feature reports in ArcGIS Survey123.	User, Publisher, Facilitator, Administrator
Features	Edit	Allows members to edit features in editable layers that are not public, based on the editing options enabled on the layer.	Data Editor, User, Publisher, Facilitator, Administrator
Features	Edit with full control	Allows members to add, delete, and update features and attributes in editable hosted feature layers, regardless of the editing operations enabled on the layer. Members of custom roles with this privilege are considered data curators. A data curator can perform all editing functions (add, update, and delete features and attributes) on editable hosted feature layers and hosted tables no matter what level of editing is allowed on the feature layer or table.	Administrator

Administrative privileges

The privileges in the table below are included in the default administrator role and can also be assigned to custom roles. Including administrative privileges in custom roles allows members to assist default administrators with a subset of administration tasks, such as managing members, groups, and content in the organization.

When you create a custom role that includes administrative privileges, only members assigned a Creator, Professional, or Professional Plus user type can be assigned to the custom role.

Note:

Some administrative privileges are reserved for members of the default administrator role and are not available for custom roles.

Category	Administrative privilege	Description
Members	View all	Allows role members to view all member account information.
Members	Update	Allows role members to reset passwords, update member account information, and assign (and unassign) member categories. Note: Only members of the default administrator role can reset the passwords of other members of the default administrator role.
Members	Delete	Allows role members to delete organization member accounts.
Members	Invite	Allows role members to invite members to the organization.
Members	Disable	Allows role members to disable and enable organization member accounts.
Members	Change roles	Allows role members to change the roles assigned to organization members. Note: Only members of the default administrator role can change another member's role to and from the default administrator role.
Members	Manage licenses	Allows role members to manage licenses for organization members.
Members	Manage categories	Allows role members to configure member categories for the organization.
Groups	View all	Allows role members to view groups owned by other organization members.
Groups	Update	Allows role members to update groups owned by other organization members.
Groups	Delete	Allows role members to delete groups owned by other organization members.
Groups	Reassign ownership	Allows role members to reassign ownership of groups.
Groups	Assign members	Allows role members to assign organization members to groups, remove members from groups, and update members' group roles in the organization.
Groups	Link to organization-specific group	Allows role members to link ArcGIS Online group membership to organization-specific groups.
Groups	Create with leaving disallowed	Allows role members to create and own groups that do not allow group members to leave (administrative groups).
Groups	Create with update capabilities	Allows role members to create and own groups that allow group members to update all items in the group (shared update groups).
Content	View all	Allows role members to view content owned by all organization members.
Content	Update	Allows role members to update and categorize content owned by all organization members and allows role members to edit data in all hosted feature layers and hosted feature layer views, even when editing is not enabled on those layers.
Content	Delete	Allows role members to delete content owned by other organization members and to restore content from any organization member's recycle bin.
Content	Reassign ownership	Allows role members to reassign ownership of content.
Content	Manage categories	Allows role members to configure content categories for the organization.
Content	Publish web tools	Allows role members to publish web tools.
Content	Share member content with organization	Allows role members to share content owned by other members of the organization with the organization.
Content	Share member content with public	Allows role members to share content owned by other members of the organization with the public.
Content	Create and manage administrative reports	Allows role members to create and manage administrative reports for the organization.
ArcGIS Marketplace subscriptions	Create and manage Note: ArcGIS Marketplace will be retired in the first quarter of 2027. The ArcGIS Marketplace website was shut down in March 2026. See the ArcGIS Marketplace Retirement Esri Technical Support article for details.	Allows role members to create listings, list items, and manage subscriptions in ArcGIS Marketplace, and manage purchasers and contact information for the organization. Note: Use of this privilege depends on the organization obtaining listing and publishing access to ArcGIS Marketplace.
ArcGIS Marketplace subscriptions	Purchase and get free products Note: ArcGIS Marketplace will be retired in the first quarter of 2027. The ArcGIS Marketplace website was shut down in March 2026. See the ArcGIS Marketplace Retirement Esri Technical Support article for details.	Allows role members to send purchase requests and access free products from providers in ArcGIS Marketplace. Note: To allow members to purchase products using credit cards, you must designate them as ArcGIS Marketplace purchasers.
ArcGIS Marketplace subscriptions	Start trials Note: ArcGIS Marketplace will be retired in the first quarter of 2027. The ArcGIS Marketplace website was shut down in March 2026. See the ArcGIS Marketplace Retirement Esri Technical Support article for details.	Allows role members to start trials in ArcGIS Marketplace.
Organization settings	Security and infrastructure	Manage the organization's security settings. Allows role members to configure the following in the organization settings: General—This privilege allows members to alter the following general settings: Organization verification, Short name, Administrative contacts, and Esri User Experience Improvement Program. Items—This privilege allows members to alter the Comments settings. New member defaults Security AI
Organization settings	Organization website	Manage the organization's website settings. Allows role members to configure the following in the organization settings: General—This privilege allows members to alter the following general settings: Organization profile (Name, Logo, Summary), Organization verification, Contact link, Organization defaults (Region, Language, Short name), Administrative contacts, Esri User Experience Improvement Program, Shared theme, Navigation bar, and App launcher. Home Page Gallery Map and scene Items—This privilege allows members to alter the Metadata and Organization categories settings. Groups Open Data
Organization settings	Collaborations	Allows role members to configure and manage the organization's collaborations in the organization settings.
Organization settings	Credits	Allows role members to configure credits in the organization settings and enable credit budgeting.
Organization settings	Member roles	Allows role members to create and manage custom roles in the organization settings and change member roles.
Organization settings	Utility services	Manage the organization's utility service settings. Allows role members to configure the following in the organization settings: Utility services Organization extensions
Organization settings	Webhooks	Create and manage webhooks for any hosted feature layer, view, or table in the organization. Allows role members to configure advanced settings for webhooks that affect all webhooks in the organization.

Privileges of the default administrator role

Some administrative privileges are reserved for the organization members with the default administrator role and are not available for custom roles. For example, only members with the default administrator role can remove other administrators from the organization. The following is a list of privileges limited to the default administrator role:

• Enable and disable Esri access on member accounts.

• Change member role to or from administrator.

• Delete other administrators from the organization.

• Change member email addresses for ArcGIS organizational accounts.

• Reset the passwords of other members of the default administrator role or members of custom administrator roles.

• Assign custom roles with administrative privileges to new members when adding them to the organization.

• Manage scheduled administrative reports owned by members.

• Configure recycle bin settings for the organization.

• Create a custom sign-in category for an app owned by another member.

Privileges for common workflows

Some workflows require a combination of privileges. In some cases, members are responsible for performing multiple workflows. For example, a GIS analyst may need to use certain analysis tools as well as publish hosted feature layers, which require the privileges listed in the table below for the Use the analysis tools and Publish hosted feature and WFS layers workflows. If you are unable to perform a function that you think your role should allow you to perform, verify that the organization administrator has enabled the full set of privileges required for the function.

In the tables below, privilege categories are listed in parentheses after the privilege name.

General workflows

Workflow		Required privileges
Use the analysis tools.	Create, update, and delete (Content) Publish hosted feature layers (Content) Spatial Analysis (Premium Content) Note: Some tools require the following additional premium content privileges: GeoEnrichment Network Analysis Imagery Analysis
Publish hosted feature and WFS layers.	Create, update, and delete (Content) Publish hosted feature layers (Content)
Publish hosted tile layers.	Create, update, and delete (Content) Publish hosted tile layers (Content)
Publish hosted scene layers.	Create, update, and delete (Content) Publish hosted feature layers (Content) Publish hosted scene layers (Content)
Publish hosted elevation layers.	Create, update, and delete (Content) Publish hosted tile layers (Content)
Publish hosted imagery layers.	Create, update, and delete (Content) Publish hosted tiled imagery layers (Content) Publish hosted dynamic imagery layers (Content)
Publish apps from Map Viewer or a group page.	Create, update, and delete (Content) Share with groups (Sharing) Share with organization (Sharing) Share with public (Sharing)
Customize app sign-in categories.	Create, update, and delete (Content) Note: To customize app sign-in categories, your administrator must enable custom sign-in for the organization.
Embed maps or groups.	Create, update, and delete (Content) Share with public (Content)
Reassign ownership of your items to another member.	View (Members) Create, update, and delete (Content) Reassign content (Content) Note: Only members who have the privilege to receive content can become owners of your reassigned content.
Add, update, and delete features in hosted feature layers that have editing enabled for add or update only.	Edit (Features) Edit with full control (Features)
Create and run data pipelines in ArcGIS Data Pipelines editor.	Create and run data pipelines (Content) Create, update, and delete (Content) Publish hosted feature layers (Content)
Create Workflow Manager items.	View (Members) Create, update, and delete (Groups) View groups shared with organization (Groups) Create, update, and delete (Content) Create workflow item (Content) Publish hosted feature layers (Content) View content shared with the organization (Content) Share with groups (Sharing) Make groups visible to organization (Sharing)

Administrative workflows

Workflow	Required general privileges	Required administrative privileges
Manage all content owned by organization members.	Share with organization (Sharing) Share with public (Sharing)	View all (Members) View all (Groups) View all (Content) Update (Content) Delete (Content) Reassign ownership (Content) Share member content with organization (Content) Share member content with public (Content)
Manage all groups owned by organization members.		View all (Members) View all (Groups) Update (Groups) Delete (Groups) Reassign ownership (Groups) Assign members (Groups)
Manage member profiles.		View all (Members) Update (Members)
Delete members, which also involves managing (reassigning or deleting) their content and groups.	View (Members)	Delete (Members) View all (Members) View all (Content) Reassign ownership (Content) Delete (Content) View all (Groups) Reassign ownership (Groups) Delete (Groups) Note: If you want members who have been assigned the custom administrator role to always reassign groups and content owned by the members they're deleting from the organization rather than deleting those groups and content, do not allow the custom role to have the administrative privileges to delete content or to delete groups.
View subscription status reports.		View all (Members) View all (Content) View all (Groups)
Manage the organization's security settings.	View (Members) View groups shared with organization (Groups)	View all (Members) View all (Groups) Security and infrastructure (Organization settings)
Manage the organization's website settings.	View (Members) Create, update, and delete (Groups) View groups shared with organization (Groups) Create, update, and delete (Content) View content shared with the organization (Content) Share with groups (Sharing) Share with organization (Sharing) Share with public (Sharing) Make groups visible to organization (Sharing) Make groups visible to public (Sharing)	View all (Members) View all (Groups) Update (Groups) View all (Content) Update (Content) Manage categories (Content) Organization website (Organization settings)
Manage the organization's collaborations.	View (Members) Create, update, and delete (Groups) View groups shared with organization (Groups) Create, update, and delete (Content) Publish hosted feature layers (Content) View content shared with organization (Content) Share with groups (Sharing)	View all (Members) View all (Groups) Update (Groups) View all (Content) Update (Content) Delete (Content) Collaborations (Organization settings)
Manage the organization's credit settings.	View (Members)	View all (Members) Update (Members) Credits (Organization settings)
Manage the organization's member roles.	View (Members)	View all (Members) Change roles (Members) Member roles (Organization settings)
Change a member's user type.	View (Members)	View all (Members) Update (Members) Change roles (Members) Manage licenses (Members)
Create and manage administrative groups.	Create, update, and delete (Groups)	Update (Groups) Create with leaving disallowed (Groups) View all (Members)
Manage the organization's utility service settings.	View (Members) Create, update, and delete (Content) Publish hosted feature layers (Content)	Utility services (Organization settings)
Create and manage all webhooks in the organization.	View (Members) View groups shared with organization (Groups) Create, update, and delete (Content) Publish hosted feature layers (Content) View content shared with organization (Content)	View all (Groups) View all (Members) View all (Content) Update (Content) Webhooks (Organization settings)