---
title: Access Control
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Access Control
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Access Control
Available for:
{% icon name="icon-siem" /%}
 Cloud SIEM | 
{% icon name="icon-cloud-security-management" /%}
 Workload Protection | 
{% icon name="icon-app-sec" /%}
 App and API Protection 
## Overview{% #overview %}

Datadog's access management system uses role-based access control, enabling you to define the level of access users have to Datadog resources. Users are assigned to roles that define their account permissions, including what data they can read and which account assets they can modify. When permissions are granted to a role, any user who is associated with that role receives those permissions. See the [Account Management Access Control](https://docs.datadoghq.com/account_management/rbac.md#role-based-access-control) documentation for more information.

For Datadog Security products, [granular access control](https://docs.datadoghq.com/account_management/rbac/granular_access.md) is available for detection rules, suppressions, and dynamic severity rules, allowing you to restrict access by teams, roles, or service accounts.

To restrict access to the security data itself, use Data Access Control.

## Permissions{% #permissions %}

See the [list of permissions](https://docs.datadoghq.com/account_management/rbac/permissions.md#cloud-security-platform) for Security products.

## Restrict access to detection rules{% #restrict-access-to-detection-rules %}

By default, all users have view and edit access to the detection rules. To use granular access controls to limit the [roles](https://docs.datadoghq.com/account_management/rbac.md#role-based-access-control) that may edit a single rule:

1. Click the vertical three-dot menu for the rule and select **Permissions**.
1. Click **Restrict Access**. The dialog box updates to show that members of your organization have **Viewer** access by default. Use that dropdown menu to select one or more roles, teams, or users that may edit the security rule.
1. Use the dropdown menu to select one or more roles, teams, or users that may edit the security rule.
1. Click **Add**.
1. Click **Save**.

**Note:** To maintain your edit access to the rule, Datadog requires you to include at least one role that you are a member of before saving.

To restore access to a rule:

1. Click the vertical three-dot menu for the rule and select **Permissions**.
1. Click **Restore Full Access**.
1. Click **Save**.

## Restrict access to suppression rules{% #restrict-access-to-suppression-rules %}

By default, all users have view and edit access to [suppressions](https://docs.datadoghq.com/security/suppressions.md). To use granular access controls to limit the roles that may edit a suppression rule:

1. Click the vertical three-dot menu for the rule and select **Permissions**.
1. Click **Restrict Access**. The dialog box updates to show that members of your organization have **Viewer** access by default. Use that dropdown menu to select one or more roles, teams, or users that may edit the suppression rule.
1. Click **Add**.
1. Click **Save**.

**Note**: To maintain your edit access to the rule, Datadog requires you to include at least one role that you are a member of before saving.

To restore access to a rule:

1. Click the vertical three-dot menu for the rule and select **Permissions**.
1. Click **Restore Full Access**.
1. Click **Save**.

## Restrict access to dynamic severity rules{% #restrict-access-to-dynamic-severity-rules %}

By default, all users have view and edit access to [dynamic severity rules](https://docs.datadoghq.com/security/cloud_siem/detect_and_monitor/dynamic_severity.md). To use granular access controls to limit the roles that may edit a dynamic severity rule:

1. Click the vertical three-dot menu for the dynamic severity rule and select **Permissions**.
1. Click **Restrict Access**. The dialog box updates to show that members of your organization have **Viewer** access by default. Use that dropdown menu to select one or more roles, teams, or users that may edit the dynamic severity rule.
1. Click **Add**.
1. Click **Save**.

**Note**: To maintain your edit access to the dynamic severity rule, Datadog requires you to include at least one role that you are a member of before saving.

To restore access to a dynamic severity rule:

1. Click the vertical three-dot menu for the dynamic severity rule and select **Permissions**.
1. Click **Restore Full Access**.
1. Click **Save**.

## Restrict access to security data{% #restrict-access-to-security-data %}

Use [Data Access Control](https://docs.datadoghq.com/account_management/rbac/data_access.md) to restrict which security data a user can view, based on the tags and attributes in the data. Define a [Restricted Dataset](https://docs.datadoghq.com/account_management/rbac/data_access.md#configure-data-access) with a query, then grant access to specific teams or roles. Three security options are available when you create a Restricted Dataset:

- **Security Signals**: Cloud SIEM and Workload Protection signals
- **Workload Protection Agent Events**
- **Security Findings** (in Preview, available upon request): Cloud Security, Code Security, Workload Protection, and App and API Protection findings

Security data that isn't included in any Restricted Dataset remains visible to all users with the appropriate permissions unless you mark it as [Restricted](https://docs.datadoghq.com/account_management/rbac/data_access.md#strict-mode).

### Restrict findings by team ownership{% #restrict-findings-by-team-ownership %}

{% callout %}
##### Join the Preview!

Ownership-based access control is in Preview and available upon request.
{% /callout %}

Ownership-based access control restricts access to security findings based on team membership and requires less configuration than Restricted Datasets. Each user sees findings owned by the [teams](https://docs.datadoghq.com/account_management/teams.md) they belong to, without requiring a separate dataset for each group of findings.

Ownership-based access control is available for Security Findings, which covers Cloud Security, Code Security, Workload Protection, and App and API Protection findings. Datadog determines ownership from the `team` tag. Findings without this tag are visible only to teams and roles with [unrestricted access](https://docs.datadoghq.com/account_management/rbac/data_access.md#unrestricted-user-groups).