# Access control for tenants

Identity Platform provides Admin APIs to manage your tenants, users, and
authentication tokens. You can leverage
[Identity and Access Management](https://docs.cloud.google.com/iam) to prevent unwanted access using these APIs.

## Granting, changing, and revoking access

Follow these steps to grant a user a role on a tenant resource:

1. Open the Identity Platform Tenants page in the Google Cloud console.  

   [Go to the tenants page](https://console.cloud.google.com/customer-identity/tenants)

2. Select a tenant from the list.

3. Switch to the **Permissions** tab in the info panel on the right.

   ![Access control pane](https://docs.cloud.google.com/static/identity-platform/img/multi-tenancy-access-control.png)
4. Click **Add principal** to grant a user a new role, or use the list to
   modify or revoke access for an existing user.

To learn more about access control using IAM, see the
[IAM documentation](https://docs.cloud.google.com/iam/docs.md.txt). To set the access control policy
for a resource, use the [`setIamPolicy` method](https://docs.cloud.google.com/identity-platform/docs/reference/rest/v2/projects.tenants/setIamPolicy.md.txt).

## API permissions

This table lists the role required to call each method in the
Identity Platform API. The role should be assigned on the tenant resource.

| Service | Method | Role |
|---|---|---|
| `google.cloud.identitytoolkit.v1.AccountManagementService` | GetOobCode | Editor |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | SetAccountInfo | Editor |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | UploadAccount | Editor |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | DeleteAccount | Editor |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | DownloadAccount | Viewer |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | GetAccountInfo | Viewer |
| `google.cloud.identitytoolkit.v1.AccountManagementService` | QueryUserInfo | Viewer |
| `google.cloud.identitytoolkit.v1.AuthenticationService` | SignUp | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | CreateDefaultSupportedIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | CreateInboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | CreateOAuthIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | CreateOutboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | DeleteDefaultSupportedIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | DeleteInboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | DeleteOAuthIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | DeleteOutboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | GetDefaultSupportedIdpConfig | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | GetInboundSamlConfig | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | GetOAuthIdpConfig | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | GetOutboundSamlConfig | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | ListDefaultSupportedIdpConfigs | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | ListInboundSamlConfigs | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | ListOAuthIdpConfigs | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | ListOutboundSamlConfigs | Viewer |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | UpdateDefaultSupportedIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | UpdateInboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | UpdateOAuthIdpConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.ProjectConfigService` | UpdateOutboundSamlConfig | Editor |
| `google.cloud.identitytoolkit.admin.v2.TenantManagementService` | CreateTenant | Editor (on the parent project) |
| `google.cloud.identitytoolkit.admin.v2.TenantManagementService` | DeleteTenant | Editor |
| `google.cloud.identitytoolkit.admin.v2.TenantManagementService` | UpdateTenant | Editor |
| `google.cloud.identitytoolkit.admin.v2.TenantManagementService` | GetTenant | Viewer |
| `google.cloud.identitytoolkit.admin.v2.TenantManagementService` | ListTenants | Viewer (on the parent project) |