---
slug: rollen-und-rechte
title: "Which roles exist and what may they do?"
category: konto
locale: en
updated: 2026-10-14
keywords: ["roles","permissions","admin","administration","analysis","read only","read access","suspend"]
questions: ["Who is allowed to do what in the portal?","Permissions","Who can manage users?","Restrict rights","Read-only access","Why can I no longer see some areas?","Why are email addresses missing from the user list?","How do I change someone’s role?","How do I suspend someone’s access?","Why can I not suspend this person?","Can accounting see invoices without being an admin?","Who can book a plan?","Who can see invoices?"]
url: https://bench.metrunio.com/en/help/rollen-und-rechte
---

# Which roles exist and what may they do?

**Who is allowed to do what in the portal?**

There are three roles inside a tenant (Admin, Analysis and Read only) plus two platform-side roles. Every API route checks the permission server-side; hiding things in the interface is only the display of that.

| Role | May |
| --- | --- |
| Admin | everything in the tenant: users, websites, keys, settings (including whether support may access it), privacy requests, change log |
| Analysis | report, export, import, maintain campaigns, tracking elements and conversions, run diagnostics, send test events |
| Read only | report, without changing anything |
| Support | read-only, only with an active, justified support grant for this tenant, and only while the tenant allows support access in its settings |
| Platform administration | additionally platform-wide administration; no access to identifiers from privacy requests |

The interface shows only what the role can actually do: “Privacy”, “Change log” and the API key form are visible to the Admin role only, and the export buttons are missing for Read only. Anyone who may not manage users sees names and roles in the user list, but not the other people’s email addresses.

> **Note:** Only the Admin role may handle privacy requests. That is deliberate: access and deletion are acts with legal effect, not part of daily reporting.

## Plan, invoices and payment details

All three roles see “Plan & usage”: plan, allowance and usage. Only the Admin role may book, switch the plan, change the invoice language and open “Invoices and payment details”, where invoices, payment method and billing address live. There is no separate role for accounting: whoever collects invoices needs the Admin role, or a person with that role downloads them and passes them on.

## Change a role, suspend access, remove

- You change a role under “Team & roles” in the row’s selection field. The field shows the new role only once it is saved; if saving fails, it still shows the role that applies, and the message says so.
- The new role applies from the person’s next request; no new sign-in is needed.
- You cannot take the Admin role away from yourself, suspend yourself or remove yourself. Another person with that role does it.
- A suspension applies to the person’s whole user account, not just this tenant, and ends all their sessions. That is why you can only suspend someone who belongs exclusively to tenants you administer. If the person belongs elsewhere too, remove them from your tenant. That only takes effect here.
- Role changes, suspension, reinstatement and removal appear in the change log.

## Also asked

- Permissions
- Who can manage users?
- Restrict rights
- Read-only access
- Why can I no longer see some areas?
- Why are email addresses missing from the user list?
- How do I change someone’s role?
- How do I suspend someone’s access?
- Why can I not suspend this person?
- Can accounting see invoices without being an admin?
- Who can book a plan?
- Who can see invoices?

## Related

- https://bench.metrunio.com/en/help/nutzer-einladen
- https://bench.metrunio.com/en/help/support-zugriff
- https://bench.metrunio.com/en/help/audit-log