> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.middesk.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.middesk.com/_mcp/server.

# Manage user roles and permissions

> Learn what each Middesk Dashboard role can access, including Production and sandbox data, orders, API keys, and team management

Each user in your Middesk account has a role that controls what they can see and do in the Dashboard, in both [Production (live)](/environments) and sandbox. Admins assign a role when inviting members from the [team settings page](https://app.middesk.com/settings/team). With Directory Sync, the role comes from your identity provider.

## Roles

| Role                         | Value                        | Description                                                                                                                             |
| :--------------------------- | :--------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------- |
| Read-only Member — Live only | `live_only_read_only_member` | Can view Production business reports. Can't place orders, make changes, or access sandbox.                                              |
| Member                       | `member`                     | Can view all business reports. Can't manage team members or access API keys and API logs.                                               |
| Developer                    | `developer`                  | Everything a Member can do, plus API keys, API logs, and webhooks. Can't manage team members.                                           |
| Admin                        | `admin`                      | Full access. Only Admins can manage team members and roles, and configure SSO and Directory Sync once they're enabled for your account. |
| Sandbox only                 | `sandbox_admin`              | Can only access the sandbox environment. No access to Production data, account settings, or team management.                            |

> **Note**
>
> **Sandbox only** is enabled per account. Contact your account manager to make it available in Invite members. **Read-only Member — Live only** can't be combined with any other role.

## Permission matrix

| Role                         | View Production reports | View sandbox | Place orders             | API keys and API logs                                                       | Manage team |
| :--------------------------- | :---------------------- | :----------- | :----------------------- | :-------------------------------------------------------------------------- | :---------- |
| Read-only Member — Live only | Yes                     | No           | No                       | No                                                                          | No          |
| Member                       | Yes                     | Yes          | Yes                      | No                                                                          | No          |
| Developer                    | Yes                     | Yes          | Yes                      | Yes                                                                         | No          |
| Admin                        | Yes                     | Yes          | Yes                      | Yes                                                                         | Yes         |
| Sandbox only                 | No                      | Yes          | Sandbox test orders only | Sandbox API logs for business, order, batch, and lien requests; no API keys | No          |

**Read-only Member — Live only** can't make changes, such as placing orders, adding businesses, or changing a business's status or assignee. These users can still update their own profile, password, and settings.

## Role values

The `roles` field on users in API responses is an array. It can hold a single value, such as `[admin]` for users managed by Directory Sync, or a cumulative list, such as `[member, developer, admin]` for users invited from the Dashboard. The user's access is the broadest role listed, so don't infer a role from whether `member` is present.

`sandbox_admin` means **Sandbox only** only when it's the sole value. If the user also has another role, they get that role's access.

With Directory Sync, map each identity provider group to exactly one of the five values. For users managed by Directory Sync, each sync replaces the user's roles with that one value, and Middesk doesn't provision or update users whose role isn't one of these values. To change a synced user's role, change it in your identity provider. The Dashboard marks these users as **Managed** and disables role edits.

> **Get a demo**
>
> Contact your account manager or [contact sales](https://www.middesk.com/contact-sales) to inquire about access.