Cloudflare Docs
Cloudflare Fundamentals
Visit Cloudflare Fundamentals on GitHub
Set theme to dark (⇧+D)

Available roles

When you add a new member to your account, you need to choose a role for that member.

The exact roles available depend on your Cloudflare plan type.

​​ Non-Enterprise roles

If you have an account on a Free, Pro, or Business plan, users can have the following roles:

  • Super Administrator - All Privileges (only one allowed): Can edit any Cloudflare setting, make purchases, update billing, and manage memberships.
  • Administrator (unlimited): Can access the full account and configure dashboard, but cannot manage billing or account membership.

The user who creates your account automatically becomes the Super Administrator. This is the only Super Administrator role allowed for your account. For more details, refer to Change super administrator.

​​ Enterprise roles

If you have an account on an Enterprise plan, you can assign multiple roles to additional members, scoping permissions broadly or narrowly as needed.

AdministratorCan access the full account, except for membership management and billing.
Super Administrator - All PrivilegesCan edit any Cloudflare setting, make purchases, update billing, and manage memberships. Super Administrators can revoke the access of other Super Administrators.
Administrator Read OnlyCan access the full account in read only mode.
AnalyticsCan read Analytics.
Audit Logs ViewerCan view Audit Logs.
BillingCan edit the account’s billing profile and subscriptions
Cloudflare AccessCan edit Cloudflare Access policies.
Cache PurgeCan purge the edge cache.
Cloudflare GatewayCan edit Cloudflare Gateway and read Access.
Cloudflare ImagesCan access Cloudflare Images data.
Cloudflare StreamCan edit Cloudflare Stream media.
Cloudflare Workers AdminCan edit Cloudflare Workers and Pages.
Cloudflare Zero TrustCan edit Cloudflare Zero Trust.
Cloudflare Zero Trust PIICan access Cloudflare Zero Trust PII.
Cloudflare Zero Trust Read OnlyCan access Cloudflare for Zero Trust read only mode.
Cloudflare Zero Trust ReportingCan access Cloudflare for Zero Trust reporting data.
DNSCan edit DNS records.
FirewallCan edit WAF, IP Firewall, and Zone Lockdown settings.
Load BalancerCan edit Load Balancers, Pools, Origins, and Health Checks.
Log ShareCan edit Log Share configuration.
Log Share ReaderCan read Enterprise Log Share.
SSL/TLS, Caching, Performance, Page Rules, and CustomizationCan edit most Cloudflare settings except for DNS and Firewall.
Trust & SafetyCan access trust and safety related services.
Zaraz AdminCan edit Zaraz configuration.
Zaraz ReadCan read Zaraz configuration.