---
title: "User Delegation"
slug: "user-delegation"
updated: 2025-06-08T11:28:36Z
published: 2025-06-08T11:28:36Z
canonical: "support.controlup.com/user-delegation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Delegation

To delegate permissions within the ControlUp Real-Time DX Console according to the needs of your organization, perform the following steps:

1. In the [**Security Policy**](/tim-reorg/docs/security-policy-pane) pane, on the **Home** ribbon, click **Manage Roles**. ![Manage Roles button in the Home ribbon](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ManageRoles.png)

The **Security** section of the **Settings** dialog box opens.

By default, the first user of an organization to login to the console becomes the organization's **Owner** and **Roles Manager**. For best practice, change the default user to a group of users.

1. Optionally, to change the default user to a group of users for the **Owner** and **Roles Manager** roles, perform the following steps:
  1. On the right of the **New Owner** field, click the settings icon. The **Account Browse** dialog box opens.
  2. Select a group from the list to designate as the **New Owner** and click **OK**.
  3. Repeat steps **a** - **b** for the **New Manager** field and click **Apply** to implement the changes.
2. In the **Security** section of the **Settings** dialog box, click **Add New Role**. The **Add New Role** dialog box opens.
3. Provide a **Role Name** for the role you want to add.
4. Click **Add Users / Groups** to assign users and/or user groups to the new role.
5. Click **OK**.
6. Repeat steps **2** - **6** until you have completed configuring all the new roles to add as needed.
7. Click **Apply** to implement the changes.

## Setting Permissions in the Security Policy

To ensure that only you (the administrator) has access and permissions, it is best practice to change the different actions to **Not Set** for Local Admins and Organization Members. This allows you to delegate permissions with a clean slate.

1.. In the **Security Policy** pane, set the permissions for all of the actions for all of the roles to **Not Set**. 2. Set the permissions for all of the actions for the ControlUp Admins group to **Allow**. 3. For roles requiring permission to perform particular actions, change the permission for the particular actions from **Not Set** to **Allow**. 4. Click **Apply** to implement the permission settings changes.

You can now change permissions as needed from **Not Set** to **Allow**. For more details about user permissions, see [User Roles](/tim-reorg/docs/security-policy-pane#organization-ownership-and-user-roles).

Watch the following video to help you set up your security policy, learn best practices for **user delegation**, and delegate permissions:

[Embedded content](https://www.youtube.com/embed/LNwXq2FYb3U)

Additionally, you can lock the Real-Time Console UI with Group Policy. To learn how, see [Configure UI Using a Group Policy](/tim-reorg/docs/locking-ui-with-group-policy).