Available roles
When you add a new member to your account, you need to choose a role for that member.
The exact roles available depend on your Cloudflare plan type.
Non-Enterprise roles
If you have an account on a Free, Pro, or Business plan, users can have the following roles:
- Super Administrator - All Privileges (only one allowed): Can edit any Cloudflare setting, make purchases, update billing, and manage memberships.
- Administrator (unlimited): Can access the full account and configure dashboard, but cannot manage billing or account membership.
The user who creates your account automatically becomes the Super Administrator. This is the only Super Administrator role allowed for your account. For more details, refer to Change super administrator.
Enterprise roles
If you have an account on an Enterprise plan, you can assign multiple roles to additional members, scoping permissions broadly or narrowly as needed.
| Role | Description |
|---|---|
| Administrator | Can access the full account, except for membership management and billing. |
| Super Administrator - All Privileges | Can edit any Cloudflare setting, make purchases, update billing, and manage memberships. Super Administrators can revoke the access of other Super Administrators. |
| Administrator Read Only | Can access the full account in read only mode. |
| Analytics | Can read Analytics. |
| Audit Logs Viewer | Can view Audit Logs. |
| Billing | Can edit the account’s billing profile and subscriptions |
| Cloudflare Access | Can edit Cloudflare Access policies. |
| Cache Purge | Can purge the edge cache. |
| Cloudflare Gateway | Can edit Cloudflare Gateway and read Access. |
| Cloudflare Images | Can access Cloudflare Images data. |
| Cloudflare Stream | Can edit Cloudflare Stream media. |
| Cloudflare Workers Admin | Can edit Cloudflare Workers and Pages. |
| Cloudflare Zero Trust | Can edit Cloudflare Zero Trust. |
| Cloudflare Zero Trust PII | Can access Cloudflare Zero Trust PII. |
| Cloudflare Zero Trust Read Only | Can access Cloudflare for Zero Trust read only mode. |
| Cloudflare Zero Trust Reporting | Can access Cloudflare for Zero Trust reporting data. |
| DNS | Can edit DNS records. |
| Firewall | Can edit WAF, IP Firewall, and Zone Lockdown settings. |
| Load Balancer | Can edit Load Balancers, Pools, Origins, and Health Checks. |
| Log Share | Can edit Log Share configuration. |
| Log Share Reader | Can read Enterprise Log Share. |
| SSL/TLS, Caching, Performance, Page Rules, and Customization | Can edit most Cloudflare settings except for DNS and Firewall. |
| Zaraz Admin | Can edit Zaraz configuration. |
| Zaraz Read | Can read Zaraz configuration. |