---
schema_version: "1"
id: 6ce7320e161f8918768319997731026f45b95dd6294665c7f743b79f1a1ad21e
title: Administrator Roles in Own Government Cloud
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/platform_o_fedramp_admin_roles.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.platform_o_fedramp_admin_roles.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1da06ad77c0be26332e92b90ed4fb6fe897e9f9f533d9af8ae18ce87ece0963a
description: See what actions privileged administrative users can take in each role.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Administrator Roles in Own Government Cloud

See what actions privileged administrative users can take in each role.

## Master Administrator Role

The Master Administrator is the top-level user that is in charge of managing an entire organization. The Master Admin is responsible for setting up the organization and making sure it runs smoothly.

A Master Admin can:

- Do anything that a Security Admin can, but can’t be demoted or deleted by a Security Admin.
- Manage advanced key and set IP Restrictions.
- Do anything that an Admin can, but can’t be demoted or deleted by an Admin.
- Manage the account settings.
- Manage the account security settings.
- Create, clone, edit, and delete seeding templates.
- Seed to any instance using templates of data.
- Export and import the seeding template object hierarchy.
- Manage anonymization templates and run anonymization jobs on sandbox services.
- Manage Bring Your Own Key (BYOK) capabilities for Archive.
- Submit Data Privacy requests.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_note.png)

Note We recommend limiting the Master Administrator role to a single user.

Own organizations can also assign users the Administrator, Security Administrator, or Audit Viewer role. These roles are considered privileged due to the permissions they contain.

## Administrator Role

Users with the Administrator role serve as administrators for a specific business units. Business units are groups of users that are assigned specific access permissions for environments.

Users with the Admin role can:

- Add, rename, archive and delete services in the business unit they administer.
- Submit all jobs on production and sandbox services.
- Access the account settings in read-only mode.
- Add and remove users from the business unit they administer.
- Manage users and their roles in the business unit they administer.
- Manage services in the business unit they administer.
- Create, clone, edit, and delete seeding templates.
- Seed aandboxes and non-production instances using templates of data.
- Export and import the seeding template object hierarchy.
- Manage anonymization templates and run anonymization jobs on sandbox services.
- Add, remove, and edit services in their business unit for Archive.
- Import records from other services in their business unit for Archive.
- Submit Data Privacy requests.

## Security Administrator Role

The Security Administrator role manages account and security settings restricting access to sensitive data, such as backups or services ensuring data integrity.

Users with the Security Admin role can:

- Manage advanced keys (Archive key management is excluded).
- Manage Account Settings.
- Manage Account Security Settings.
- Replace the Master Admin.

## Audit Viewer Role

Users with Audit Viewer role can view, filter, and export relevant audit logs, including those for:

- User logins and logouts.
- Jobs or reports viewed by users.
- On-demand backups.
- Creation of smart alerts.
- Data Privacy subject requests.
- Adding, deleting, and archiving services.
- Initiations of jobs for data restore, data compare, and replicate.

#### See Also

- [User Roles](https://help.salesforce.com/s/articleView?id=platform.platform_o_user_roles.htm&release=264.0.0&type=5 "Roles are assigned to users per business unit to provide them permission to perform specific actions. Users can be assigned to one or more specific business units with a different role in each business unit.")
- [User Roles FAQs](https://help.salesforce.com/s/articleView?id=platform.platform_o_user_roles_faqs.htm&release=264.0.0&type=5 "Find answers to frequently asked questions about visibility and access permissions related to user roles.")
- [Roles & Permissions](https://help.salesforce.com/s/articleView?id=platform.platform_o_permissions_per_role.htm&release=264.0.0&type=5 "The available permissions depend on the user's role. With the exceptions of Master Admin, Security Admin, and Account Level Audit-Log-Viewers, permissions are limited within the users' Business Units.")