Add or Remove Users from a Role

This section has instructions for added users to a role, and removing users from a role.

Add a user to a role

1. Classic UI. In the main Sumo Logic menu select Administration > Users and Roles > Roles.
   New UI. In the top menu select Administration, and then under Users and Roles select Roles. You can also click the Go To... menu at the top of the screen and select Roles.
2. Navigate to the role and click the number in the Users column.
   
3. A list of users currently assigned to the role appears.
   
4. Click the Assign Users field. A list of users that are not currently assigned to the role appears. Click a user’s name to add the user to the role. 
5. Add additional users to the role, as desired.
6. Click Save when you are done adding users to the role.

info

When you add or remove a role from a user, it can take about an hour for the RBAC changes to take effect on an existing real-time alert. For example, when a user creates a real-time alert, the user’s search filter governs what log data is returned by the scheduled search. If an admin subsequently makes that user’s search filter more restrictive or removes that role from the user, for about an hour, alerts triggered by data that the user’s updated search filter now prohibits will still fire. (Changes take effect immediately for manually run searches.) 

Remove a user from a role

1. Classic UI. In the main Sumo Logic menu select Administration > Users and Roles > Roles.
   New UI. In the top menu select Administration, and then under Users and Roles select Roles. You can also click the Go To... menu at the top of the screen and select Roles.
2. Navigate to the role and click the number in the Users column.
   
3. A list of users currently assigned to the role appears. 
4. Navigate to the user you want to remove from the role, and click the trash can icon in that row.
   
5. Click Save when you are done removing users from the role. 

info

When you add or remove a role from a user, it can take about an hour for the RBAC changes to take effect on an existing real-time alert. For example, when a user creates a real-time alert, the user’s search filter governs what log data is returned by the scheduled search. If an admin subsequently makes that user’s search filter more restrictive or removes that role from the user, for about an hour, alerts triggered by data that the user’s updated search filter now prohibits will still fire. (Changes take effect immediately for manually run searches.)