Team and roles

From 0.3.1: Members in every edition

Since 0.3.1 (0.3.0 was tagged but never published) the provider team is part of the open-source core: every edition, Community included, has several administrators with these four roles, and the page is called Members. Limiting a member to chosen tenants stays part of Service Provider. Owners can also Reset access, see below.

Edition

Since 0.3.1 several provider administrators with roles are part of every edition. Before 0.3.1 (0.1.0 to 0.2.2) the provider team was part of Business and Service Provider only, and Community had one provider administrator, the first administrator created by the setup wizard. Limiting a member to chosen tenants is Service Provider. Tenant administrators and users can be invited in every edition. See License and editions.

Under Installation → Members, owners invite further provider administrators and decide what each may do. The administrator created by the setup wizard is an owner.

The four roles

Role	May
Owner	Everything, including the team, the license, the installation settings and deleting a tenant.
Administrator	Set up and run tenants, sources, storage, schedules, integrations and legal holds. Not the team, the license or the installation settings, with the exceptions in What the roles reach.
Technician	Run backups, checks and restores, and open backed-up and archived content, files of machines and Proxmox VE guests included. Changes no configuration.
Read only	See status, reports and the audit log. No backed-up or archived content, no changes.

The rules are enforced by the server for every request, not only by what the interface shows. A request a role does not cover is refused with “Your role in the provider team does not allow this.”

Tenants (Service Provider)

Each member other than an owner has either all tenants, including tenants created later, or selected tenants. A member limited to selected tenants sees only those in the tenant list and the tenant switcher; other tenants answer as if they did not exist. Such a member cannot use views that span every tenant, such as Overview (tab Status) across all tenants, the Statistics of all tenants, the installation audit log or the team itself. Owners always have every tenant.

What the roles reach (since 0.4.0)

Release 0.4.0 added areas to the provider roles. This is what each role may do there. The server decides for every request, not only the web app.

Area	Read only	Technician	Administrator	Owner
Servers and clients: see machines, their restore points and whether they are immutable	Yes	Yes	Yes	Yes
Servers and clients: browse, download and restore files, Back up now, restore checks	No	Yes	Yes	Yes
Servers and clients: settings, install commands, jobs, revoking, uninstalling and (since 0.4.5) removing a machine, repository password	No	No	Yes	Yes
Proxmox VE: see the overview, guests and their restore points	Yes	Yes	Yes	Yes
Proxmox VE: browse and download files of container and VM restore points, back up, verify, boot tests, restore a whole guest	No	Yes	Yes	Yes
Proxmox VE: nodes, tokens and jobs	No	No	Yes	Yes
Proxmox VE: exclude a guest from backup, include it again (since 0.4.7)	No	No	Yes	Yes
Agent policy of the installation (Installation → Agent policy)	Read	Read	Change, with every tenant	Change
Agent policy of a tenant (Tenant settings → Agents) and of a job	Read	Read	Change	Change
Ransomware detection: see findings	Yes	Yes	Yes	Yes
Ransomware detection: mark a finding as a false alarm	No	Yes	Yes	Yes
Ransomware detection: release a retention hold (with a recent sign-in)	No	No	Yes	Yes
Ransomware detection: thresholds and switches (Installation → Ransomware detection)	Read	Read	Read	Change
Immutable backups: raise the protection of a repository	No	No	Yes	Yes
Immutable backups: lower it or switch it off (with a recent sign-in)	No	No	No	Yes
Database (Installation → Database): see it, move it to another disk	Read	Read	Read	Change
Enable network shares, downloading or deleting kept database dumps	No	No	No	Yes
File shares: add and change shares, and the installation switch Tenants may add file shares in private networks	No	No	Yes (the switch with every tenant)	Yes
Microsoft 365: confirm objects that are no longer backed up with Yes, intended, note or change the expiry date of a source’s own app (since 0.4.7)	No	No	Yes	Yes
Prices for the tenant overview (Installation → Prices, since 0.4.7)	Read	Read	Read	Change

A member limited to selected tenants does not reach the installation-wide rows (Service Provider). Backup of file shares is described under File shares, Proxmox VE under Proxmox VE.

Inviting a member

1. Installation → Members → Invite member: email address, name, role and, with Service Provider, the tenants.
2. The person receives a single-use link, valid for 72 hours, to choose a password. With a mail transport configured (Installation → Notification mail) the link is emailed; otherwise it is shown once for you to hand over.
3. After choosing the password they set up an authenticator app, as every password sign-in in Restow requires; a passkey can be added afterwards.

An address that already belongs to an account cannot be invited, so an account of a customer’s own tenant never turns into an administrator of the installation unnoticed. An invitation that expired can be renewed with New invitation link.

Changing and removing

• Change role takes effect with the member’s next request; no sign-out is needed.
• Remove ends the member’s sessions at once and invalidates an open invitation. An account that belongs to no tenant is deleted.
• The team always keeps at least one owner: the last owner can neither be given another role nor be removed. Make someone else an owner first.
• If an owner loses their passkey, authenticator app or password, the access is recovered on the server with docker compose exec api restow admin recover --email <owner> (owners only; see Setup wizard → Recovering administrator access).

Every invitation, change and removal is written to the installation’s audit log.

Resetting access (from 0.3.1)

From 0.3.1 an owner can reset another administrator’s access in Installation → Members with Reset access: in one step the password, passkeys and authenticator app are removed, every session ends, and the administrator gets a new link to choose a password (shown for copying when it could not be mailed, with the email address as username). It needs a recent sign-in, refuses your own access and the last owner, and is audited as provider_team.access_reset. Your own lost access as an owner is still recovered on the server with restow admin recover.

Roles inside a tenant (from 0.3.5)

The four roles above belong to the provider team and apply to the whole installation. Inside one tenant, people have a tenant role:

Role	May
Tenant admin	Manages that tenant’s setup (protection, sources, schedules), repositories, members, the tenant’s agent policy and restores, including restoring on behalf of another user (always audited). Can be invited in every edition.
Restore operator (from 0.3.5)	Sees and restores every backup of the tenant, without administering it: no jobs, no storage, no users. Since 0.4.0 this includes the files of machines and Proxmox VE guests and SharePoint sites, see below.
User	Signs in, restores and downloads only their own mailbox, OneDrive or IMAP account. Does not see SharePoint sites.

A role is always chosen (from 0.3.5). Creating a user or an invitation in a tenant needs a role to be chosen. No role is preselected any more, so pick the one the person needs, and a form that is missing the role reports it as an error. See also Ports and roles and Multi-tenancy.

What a restore operator reaches (since 0.4.0)

The membership role “restore” (tenant_restore) now covers everything that is backed up in the tenant, and still nothing that changes the tenant’s setup.

• Mail & SaaS → Restore explorer: the people of the tenant, one entry each with their mailbox, OneDrive and IMAP account together (since 0.4.2), and, since 0.4.0, the SharePoint sites and, since 0.4.5, the Microsoft 365 groups, in a section of their own (SharePoint & Teams). Sites and groups are shown to restore operators and administrators only, never to a user. Restore operators download them as a ZIP and restore files and list items as the explorer offers. See SharePoint.
• Servers & clients → File restore: the tenant’s machines, with their restore points and whether they are immutable. They browse, download files as a ZIP and restore files onto the machine. Backing up (Back up now) answers 403. See Restore.
• Proxmox VE guests, also in File restore: the overview, a guest’s restore points, and the files of container and VM restore points (browse and download). Not: backing up, verify and boot tests, restoring a whole guest, nodes, tokens and jobs. See Files of a guest.
• What they do not get: a machine’s settings, tokens, jobs, the repository password, revoking or deleting, and the pages of the administrators. The web app leaves out the links to pages a restore operator may not open (no Inventory, no machine page, no VMs & containers), and the server refuses the requests anyway.
• Audit: every read, download and restore is recorded with the operator as actor.