---
title: Permissions and roles
source: https://docs.newrelic.com/docs/cci/configure-cci/cci-permissions
---

> #### ⚠️ IMPORTANT
>
> To access Cloud Cost Intelligence, you need an **Advanced CCU SKU**, a **full platform user** license, and access enabled through [Feature Control Manager](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/feature-control-manager/). This page covers configuration access — who can modify CCI settings once the product is enabled for your organization.

Our standard authorization system controls access to Cloud Cost Intelligence surfaces (Settings, Integrations, and Custom Facets). It splits access into read (view configuration) and write (create, update, delete), per account, not organization-wide.

## Default access [#default-access]

All users with account access get view-only access by default.

Only an Organization Admin can grant modify or delete access — to themselves, to other individual users, or to a role.

## Permissions reference [#permissions-reference]

The following table lists the available permissions for each CCI surface. All users receive read access by default. Modify and Delete access require a [custom role](#grant-modify-access).

| CCI surface   | Read                  | Modify               | Delete               |
| ------------- | --------------------- | -------------------- | -------------------- |
| Custom Facets | Default for all users | Requires custom role | Requires custom role |
| Integrations  | Default for all users | Requires custom role | —                    |
| Settings      | Default for all users | Requires custom role | —                    |

## Grant modify access [#grant-modify-access]

An Organization Admin grants CCI write access through a [custom role](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/account-user-mgmt-tutorial/#roles). Two options are available:

### Add CCI permissions to an existing custom role [#option-existing-role]

If a custom role already exists for a team (for example, a "FinOps" role), add the CCI write permissions to it. Everyone already assigned that role automatically gains CCI write access. You don't need to reassign individual users.

### Create a dedicated custom role for CCI [#option-new-role]

Create a custom role containing only the CCI modify permissions (Settings, Integrations, Custom Facets), then assign it to the specific users, groups, or yourself who need it. Use this option to keep CCI administration separate from any other role's responsibilities.

## Related topics [#related-topics]

[User management concepts](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts)

Understand roles, groups, and permissions in New Relic

[Tutorial: Add and manage users](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/account-user-mgmt-tutorial)

Step-by-step guide to creating and assigning custom roles