Roles and permissions in Nuxari

Who this is for

Client Owners and Client Admins who manage their organization's Nuxari tenant, and anyone who wants to understand what each role can do.

What "client" means in this context

In Nuxari, Clientrefers to your organization, the customer tenant that uses Nuxari to manage governance, automation, and access. It is not a role name. Roles that begin with "Client" (such as Client Owner or Client Admin) are roles held by users insideyour organization's tenant. These are distinct from Nuxari's own internal staff roles, which customers cannot assign.

The two role families

Nuxari uses two separate families of roles:

• Client Tenant Roles — roles you assign to users inside your organization. These control what each person can see and do within your Nuxari workspace. There are eight client tenant roles.
• Nuxari Internal Roles— roles used by Nuxari's own staff for operations and support. Customers cannot assign, view, or modify these roles. They are scoped, audited, and managed entirely by Nuxari.

Client tenant roles

The following eight roles are available for assignment within your organization. Each role follows least-privilege principles — assign the role that matches the person's actual responsibilities.

MFA and PIM requirements for privileged roles

Three roles have elevated security requirements because they can modify tenant-wide settings, assign roles to other users, or control security policy:

• Client Owner — MFA required. PIM eligible for just-in-time activation of owner-level actions.
• Client Admin— PIM eligible for elevation. MFA recommended and may be required by your organization's policy.
• Client Security Admin — MFA required. PIM eligible to activate security administration actions with a justification.

PIM (Privileged Identity Management) allows users to hold a role as eligible rather than permanently active. To perform privileged actions, the user activates the role with a business justification, and the activation is time-limited and audited. To configure PIM, go to Administration > PIM.

Last Client Owner protection

Nuxari enforces a tenant safety rule: the last Client Owner in an organization cannot be removed or have their role changed. This prevents an organization from becoming permanently locked out of its own tenant. If you need to remove an owner, first assign the Client Owner role to another user, then remove the original owner.

Nuxari internal roles

Nuxari operates its own set of internal roles for its operations and support staff. These roles are not visible or assignable in your tenant. If you do not see an "internal role" option in your role assignment UI, that is expected and correct. Nuxari staff access to your tenant, when required for support purposes, is controlled, scoped to the minimum necessary, and audited.