Role-Based Access Control Custom Roles Beta

Additive Permissions Model (Beta Behavior) 

In this beta release, permissions are additive. This means that if a user receives multiple roles affecting the same network or product area: 

• The highest level of access granted by any assigned role becomes the user’s effective permission. 
• There is no explicit deny in the current beta. 

Example:  If a user receives: 

• Role A → No access to Wireless in Network X 
• Role B → Read-only access to Wireless in Network X 

Their resulting permission will be: Read-only access to Wireless in Network X 

An explicit deny function is planned for future iterations but is not available in the beta. 

This model supports flexibility while the feature is evolving and allows admins to compose access through multiple roles safely. 

Activating the Beta

Step 1. In the Meraki Dashboard, go to Organization > Early Access.

Step 2. Scroll to find Role-based Access Control and switch toggle to opt into the beta.

Navigating to the Custom Roles Feature 

1. In the left navigation pane, select Organization > Administrators. 

2. Within the Administrators page, switch to the Roles tab. 

3. The page displays two role groups: 

• Default roles (Full access, Observer, Switch port manager, SSID Manager, etc.) 
• Custom roles (roles created by your organization) 

To create a new custom role, click +Create custom role in the upper right corner. 

Defining Custom Role Name 

You will be taken to a guided 3-step workflow. Begin by providing: 

• Role name — choose a descriptive, concise name 
• Description (optional) — summarize the scope of the role for future reference 

Example: 

• Role name: MX read, MS write 
• Description: Read-only access to the security appliances and full access to switching 

Click Next to proceed. 

Defining Permissions 

In this step, you choose the permission level for each product family. Each resource category includes all features in the following Dashboard navigation items: 

• Security & SD-WAN 
• Switching 
• Wireless 

For each resource category, select one of the following: 

• No access (unless combined with other roles that grant access to this resource, user with this role cannot view or manage this product type.)
• Read only (unless combined with other roles that grant Read & write access to this resource, user with this role can view both Monitor and Configure feature groups for this product type but cannot make changes.)
• Read & write (user has full view and management capabilities for this product type.)

Example configuration: 

• Security & SD-WAN: Read only 
• Switching: Read & write 
• Wireless: No access 

Click Next once the selections reflect your intended permissions. 

Review and Confirmation 

The final step presents a summary of the custom role: 

• Role name and description 
• Permissions selected for each resource category 

Review the information carefully. If any adjustments are required, use the Edit links next to each section. 

Once satisfied, click Confirm and add new custom role. 

After confirmation, you will see a success message in the top right corner of the screen, and the newly created role now appears under the Custom roles section on the main Roles page. 

Editing a Custom Role 

1. Navigate to Organization > Administrators > Roles. 
2. Scroll to the Custom roles section. 
3. Click the three-dot (⋯) menu on the role card. 
4. Select Edit role to reopen the 3-step configuration flow. 

Use this to update permissions or rename the role. 

Deleting a Custom Role 

1. Open the ⋯ menu for the desired custom role. 
2. Select Delete role. 
3. A confirmation dialog will appear. 

You may only delete roles that are not currently assigned to any admins or SAML groups. Click Delete role to proceed. 

Assigning a Custom Role 

Once custom roles have been created, they can be assigned to new or existing administrators through the standard admin creation and editing workflow.

When adding a new admin:

1. Navigate to Organization → Administrators.
2. Click Add new admin, or select an existing admin to edit.
3. In the Role & Scope section, select Assign role.
4. A side panel will open, displaying two tabs:
   • Default - built-in system roles
   • Custom - custom roles created during the beta
5. Select the Custom tab to view all available custom roles.
6. Choose the role you want to assign by selecting its radio button.
7. Configure the scope as needed (organization-wide, specific networks, or network tags).
8. Review and save your changes.

This workflow allows you to assign one or more role-and-scope pairs to the same admin, enabling flexible and layered access - aligned with the beta’s additive permission model.