# Enable SOAR access

Supported in:

This document is for Google Security Operations admins who want to provide users with access to
SOAR features in Google SecOps (such as managing cases).

## Before you begin

These procedures are based on the assumption that you have already onboarded
to the Google SecOps platform, enabled the Chronicle API, and started
working with IAM permissions. The following procedures may vary slightly,
depending on whether you configured a [Cloud Identity provider](https://docs.cloud.google.com/chronicle/docs/onboard/configure-cloud-authentication)
or a [third-party identity provider](https://docs.cloud.google.com/chronicle/docs/onboard/configure-authentication).

## Enable access

1. Define either a [predefined role](https://docs.cloud.google.com/chronicle/docs/onboard/configure-feature-access#predefined-roles)
   or a [custom role](https://docs.cloud.google.com/chronicle/docs/onboard/configure-feature-access#custom-role).
   The custom role must contain the following minimum baseline permissions:

   - `chronicle.dataAccessScopes.list`
   - `chronicle.preferenceSets.get`
   - `chronicle.preferenceSets.update`
   - `chronicle.instances.get`
   - `chronicle.socRoles.get`
   - `chronicle.userNotifications.get`
   - `chronicle.userLocalizations.get`
   - `chronicle.moduleSettings.rebranding`
   - `chronicle.integrations.get`
   - `chronicle.legacySoarAdvancedReports.get`
   - `chronicle.environmentGroups.get`
   - `chronicle.moduleSettingsProperties.get`
   - `chronicle.legacySoarUsers.get`

   For more information about baseline permissions and mapping to specific SOAR actions, see
   [Required permissions for every role](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/map-soar-permissions-to-iam#required_permissions_for_every_role).
2. If you're using the Cloud Identity provider, map user email groups into the [email group mapping page](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/user-secops/map-users-in-the-secops-platform-first-party).

3. If you're using a third-party identity provider, map IdP groups into the [IdP group mapping page](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/user-secops/map-users-in-the-secops-platform).

You can choose the control access parameters that meet your needs. For more
information, see [SOAR access overview](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/control-access-to-platform).

**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/)