Download PDF
Download page Application Permissions.
Application Permissions
This page provides an overview of application permissions in AppDynamics. Application permissions follow an inheritance model with three levels listed in order from highest (default) to lowest (tier-specific):
- Default permissions
- Application-wide permissions
- Tier-specific permissions
By default, each level inherits from the one above it, unless you customize permissions at a lower level. This mechanism enables you to grant access to groups or users for specific business applications in the Tenant UI.
Customized permissions at a specific level override more general permissions at another level. That is, tier-specific permissions take precedence over application-specific permissions, and application-specific permissions override default permissions. Not all permissions can be customized at the tier-level.
You can set application permissions for custom roles from the Applications tab in the Tenant Administration UI. You can also assign the Can Create Applications permission to a custom role. See Create and Manage Custom Roles.
Create Default Permissions
All new applications inherit default permissions.
Configure Default Application Permissions
- Log in to the Tenant Administration UI and select Roles.
- Add a new role or select a custom role.
- Click Can Create Applications to grant the role permission.
- Under Default Permissions, select the default permissions for this role: View, Edit, or Delete.
- To give all permissions to all applications, click Edit.
- To specify permissions for specific application configurations for all applications, deselect Edit, and then click Edit (None).
- In the Edit Permissions panel, select specific permissions.
- Click Delete to grant permissions to delete any application. To grant permission to delete a specific application, customize the permission at the application level. See Application and Tier Level Permissions.
- Click OK then click Save.
Customize Application Permissions
To customize business application-level permissions:
- Set the Permissions dropdown to Custom.
- Select View and then Edit (None).
You can also grant permission to delete a specific application.
To customize permissions at the tier level,
- Click Add to add tiers or select an existing tier.
- Select Edit.
- Select the individual permissions for the specific tier.
- Click OK then click Save.
Overlapping Role Permissions Examples
Within specific and default permissions, granting a specific permission takes precedence over denying the same permission elsewhere. For example, if a user is assigned two roles and one grants a permission and the second role denies it, the user will have permissions for the activity.
These examples show how overlapping permissions of different roles interact. The examples enable view, edit, and delete permissions to applications for two Groups. The last column shows the resulting permissions for a specific user with roles that are assigned to each group.
| Group 1 | Group 2 | |||
| Default Permissions (view, edit delete all applications) | Explicit permissions (view, edit delete application-1) | Default Permissions (view, edit delete all applications) | Explicit permissions (view, edit delete application-1) | |
|---|---|---|---|---|
| A | None | Yes | Yes | None |
| B | Yes | None | Yes | Yes |
| C | Yes | None | None | Non |
- Result for example A: User has view, edit, and delete permissions to all applications, including application-1.
- Result for example B: User has view, edit, and delete permissions to all applications, including application-1.
- Result for example C: User has view, edit, and delete permissions to all applications, excluding application-1.
General Permissions
| Permission | Activities Enabled | More Information |
|---|---|---|
| Can Create Applications | Create business, browser, and mobile applications. Also controls the Archive Snapshot action. | Business Applications |
| View, Edit, and Delete permissions for new applications can be set as part of the default permissions for a custom role | View, edit, or delete business applications (and the tiers and nodes), browser, and mobile applications. Setting default delete permissions allows the user to delete all three artifacts from the application model. |
Application and Tier Permissions
You can grant the following permissions as specified. Permissions that you can customize at the tier level are indicated in the Description of Activities Enabled column. Asterisks (*) in the permissions table indicate permissions that are considered sensitive for security and data privacy purposes. Carefully consider the security and data privacy policies of your organization before granting these permissions.
| Permission | Description of Activities Enabled | More Information |
|---|---|---|
| Configure Transaction Detection* | Create, edit, or delete transaction detection - can be at the tier level. | |
Configure Backend Detection | Create, edit, or delete backends - can be at the tier level. | |
| Configure Error Detection | Create, edit, or delete error detection. | Error Detection |
| Configure Diagnostic Data Collectors* | Create, edit, or delete diagnostic data collectors. | Data Collectors |
| Configure Call Graph Settings |
| Call Graph Settings |
| Configure JMX | Create, edit, or delete JMX metrics. | Configure JMX Metrics from MBeans |
| Configure Memory Monitoring | Configure which custom classes are tracked by Object Instance Tracking. 
To enable or disable Object Instance Tracking, you need the Configure Agent Properties permission. | |
| Configure EUM (for Browser RUM) | ||
| Configure EUM (for Mobile RUM) | ||
| Configure Information Points* | Create, edit, or delete information points. | |
| Configure Health Rules | Create, edit, or delete health rules. | Configure Health Rules |
| Configure Actions | Create, edit, or delete actions on agent properties UI. Create, edit, or delete email digests. | |
| Configure Policies | Create, edit, or delete policies. | |
Configure Business Transactions | Organize Business Transactions including:
Configure Business Transaction thresholds. Configure snapshot settings. Set as a background task. Configure data collectors. Enable End User Monitoring. Enable analytics for business transactions. Enable or disable GUID injection. | Organize Business Transactions |
| Configure Baselines | Create, edit, or delete baselines. | |
| Configure SQL Bind Variables* | Turn on or off capture raw SQL (also requires Configure Call Graph Settings). | |
| Configure Agent Properties | Create, edit, or delete agent configuration (can be at the tier level). Enable or disable automatic leak detection (can be at the tier level). Enable or disable object instance tracking (can be at the tier level). Enable or disable custom memory structure (can be at the tier level). | |
| Agent Advanced Operation | Reset agent from the node dashboard. Request agent thread dumps. Request agent debug logs. | |
| Set JMX MBean Attributes and Invoke Operations | Edit MBean attributes or invoke actions on operations. | |
| Configure Service Endpoints | Create, edit, or delete service endpoints. | |
| Configure Monitoring Level (Production/Deployment) | Switch between production and development mode. | |
| Configure 'My Dashboards' for Tiers and Nodes | Create, edit or delete custom dashboards (can be at the tier level). | |
| Create Events | Create, edit, or delete events. | Alert and Respond API |
| Start Diagnostic Sessions | Start a diagnostic session. | |
| View Sensitive Data* | In combination with the Configure Transaction Detection permission, enables the use of Live Preview and Business Transaction Discovery features to stream live data from your application. | Custom Match Rule Live Preview |