Skip to main content

A user cannot do something they should

You granted the access, the person still gets a permission error. Work through these in order — the first two explain most cases.

1. The change has not reached them yet​

Permissions are read at sign-in and refreshed periodically, so a change takes up to about five minutes to apply.

Ask them to sign out and back in. If it works after that, this was it.

2. The permission is at the wrong scope​

This is the most common real cause. A permission granted at tenant scope does not let someone act on resources inside a VDC — a VM, a disk, a firewall rule, a backup.

To operate inside a VDC, the permission has to be granted:

  • on that VDC, or
  • on the customer that owns it.

Open the Permissions tab on the user and check the scope next to the permission, not just its presence.

3. They have the permission, but not the one being checked​

Reading is usually covered by a broad <section>:view key, but sensitive actions have their own. Someone with vm:view still cannot open the console without vm:console:view, and cannot see the audit trail without iam:audit:view.

Check the permission catalog for the exact key the action needs.

4. The grant expired​

Direct grants always have an expiry date. Look at the Grants tab — an expired grant still appears in the list, so it is easy to mistake for active access. Renew it, or move the permission into a group if the need turned out to be permanent.

5. The account is blocked or pending​

A blocked user is refused at sign-in regardless of permissions. A pending user never accepted the invite. Both show on the Users tab.

Errors you may see when granting access​

MessageMeaning
Expiry date in the pastA direct grant needs a future date.
Renewal does not extendThe new date must be later than the current one.
Scope requires a targetCustomer and VDC scopes need you to pick which one.
Permission not allowed at this scopeSome keys cannot be granted at every level — see the catalog.
Cannot modify a system groupBuilt-in groups are read-only. Duplicate it, or create your own.
User is not pendingYou tried to resend an invite that was already accepted.