Understand Directory Roles

Directory Roles provide role-based access control (RBAC) for the STACKIT identity directory. They control identity-directory operations and are separate from Cloud Roles used to grant permissions to cloud resources.

A Directory Role does not grant access to cloud resources. A Cloud Role does not grant permissions to manage the identity directory. Assign the appropriate role from the correct model for each task.

How Directory Roles work

Directory Roles are collections of permissions. You can assign them to a user, group, or service account. The assigned identity receives the permissions defined by that role.

Currently, Directory Roles support managing groups and assigning existing built-in Directory Roles to users, groups, and service accounts. You cannot create custom Directory Roles.

Find available Directory Roles

In the STACKIT Portal, open IAM > Directory Roles, then select Roles. The Available roles list shows each role’s name, type, and description. Use Search for role name to find a role.

Select a role to open its details. The detail view has Overview and Assignments sections. Overview shows the role’s name, type, and description; built-in roles are managed by STACKIT and cannot be edited.

In Assignments, the Portal lists assigned identities by name, type, and assignment date. Use Filter to narrow the list. To assign a role or revoke an assignment, follow Assign and revoke Directory Roles.

Built-in Directory Roles

STACKIT provides the following built-in Directory Roles. The Type column identifies each role as built-in; custom Directory Roles cannot currently be created.

Role	Type	Description
administrator	Built-in	Grants unrestricted control over the directory, including full management of users, groups, role definitions, role assignments, and global directory settings.
group-reader	Built-in	Grants read-only access to view directory groups, group properties, metadata, and group membership lists without permission to alter them.
group-writer	Built-in	Grants write access to create, update, and delete directory groups, as well as add or remove members within existing groups.
role-reader	Built-in	Grants read-only access to view directory role definitions, active role assignments, and member privilege scopes across the organization.
role-writer	Built-in	Grants permission to assign and revoke existing built-in Directory Roles for users, groups, and service accounts. It does not enable creating custom Directory Roles.
user-reader	Built-in	Grants read-only access to view directory user profiles, account metadata, and identity attributes without permission to create or modify them.

Initial organization administrator

When an organization is created, its initial organization owner receives the built-in administrator Directory Role as part of the creation process. This automatic assignment happens only during initial organization creation. After that, assigning administrator to the people who should administer the directory is the responsibility of the existing administrator. Organization owners added later do not automatically receive this Directory Role.

The Directory Role administrator is not the Cloud Role Owner. The two roles belong to separate authorization models and grant different permissions.