> # Authorization

> The following authorization roles exist in all Cisco MDS switches:

> - Network operator (network-operator)—Has permission to view the configuration only. The operator cannot make any configuration changes.
> - Network administrator (network-admin)— Has permission to execute all commands and make configuration changes. The administrator can also create and customize up to 64 additional roles.
> - Default-role—Has permission to use the GUI (DCNM-SAN and Device Manager). This access is automatically granted to all users for accessing the GUI.

> These roles cannot be changed or deleted. You can create additional roles and configure the following options:

> - Configure role-based authorization by assigning user roles locally or using remote AAA servers.
> - Configure user profiles on a remote AAA server to contain role information. This role information is automatically downloaded and used when the user is authenticated through the remote AAA server.

> Note If a user belongs only to one of the newly created roles and that role is subsequently deleted, then the user immediately defaults to the network-operator role.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.