Grant Read-Only Access to All Tenant Data

Give a group of analysts read access to all tenant entities and telemetry without allowing any writes. This uses a single Generic role assigned at Tenant level.

Prerequisites: Basic familiarity with Roles and RBAC.

1. Navigate to Security ⇾ Roles.
2. Click + Add role.
3. Name: Analyst Read-only — Role type: Generic.
4. Add one permission entry: Resource All, Operations Read, Read Attributes, Read Telemetry.
5. Click Add.

1. Navigate to Users ⇾ Groups.
2. Click Add entity group, name it Analysts.
3. Open the group details ⇾ Roles tab ⇾ Add.
4. Select: Role type Generic, Role Analyst Read-only.
5. Click Add.

Any user added to the Analysts group can view all tenant entities and telemetry but cannot create, modify, or delete anything.