Remote access reference

Reference
3-min read

The following sections list the remote access scopes and the permissions that each remote-access role carries when you authorize Dynatrace product experts to access your Managed Cluster.

Remote access scopes

After you turn on Dynatrace remote access, you can set remote access permissions for Dynatrace product experts with one of the following scopes.

Scope	Description
All	Entire Dynatrace product expert team can access the Managed Cluster for full proactive support and Managed Cluster settings optimization
Read-only access to all	Entire Dynatrace product expert team can access the Managed Cluster but cannot edit any settings; only the Viewer role is available; significantly limits proactive support, and Dynatrace product experts contact you when changes are required
Approved	Only approved Dynatrace product experts can access the Managed Cluster; each request needs administrator approval; gives you maximum control over who can access the Managed Cluster but significantly limits proactive support

Remote access role permissions

You can assign the Admin, User, or Viewer role for a remote-access user. See the following table for details on the permissions each role is assigned.

Permissions	Description	Admin	User	Viewer
Environment	Allows read-only access to an environment. Specifically, Dynatrace employees have access to: User-related settings—Signed-in user profile and signed-in user settings (for example, scheduled reports, favorite dashboards, and menu entries). Dynatrace Hub pages - Installation pages for OneAgent or ActiveGate. Settings in read-only mode. Reports. CMC in read-only mode. Request data capture rules configuration in read-only mode. Internal-only diagnostic data. Audit log reading. Support archive access. Synthetic credential vault access and update/delete actions for credentials owned by the user. Dynatrace employees cannot change settings or install OneAgent with this permission alone.
Settings write	Allows the user to change monitoring settings of an environment.
Download OneAgent and ActiveGate	Allows the user to download OneAgent and ActiveGate from Hub and install on hosts.
CMC configuration change	Allows the user to change Managed Cluster settings in CMC.
Logs	Allows the user to access the Logs page and log content of your applications. Logs may have sensitive information.
Configure capture of sensitive data	Allows the user to configure request-attribute capture rules. These can be used to capture elements such as HTTP headers or Post parameters for storage, filtering, and search. Also allows the user to manually trigger memory dumps.
View sensitive request data	Allows the user to view personal data captured by Dynatrace, including permission to download memory dumps. Users who don't have this permission see that the data point exists, but the personal data is masked by asterisks (*****). Also allows the user to manually trigger memory dumps.
Enable OneAgent debug flags	Allows the user to run read-only diagnostic operations and set OneAgent debug flags.
Run diagnostic operations	Allows the user to run diagnostic operations such as service restarts, run diagnostic scripts on Cluster node hosts, and access the database.
Replay session data with masking	Allows the user to replay recorded user sessions with playback masking rules applied at the time of replay. Note that data masked during recording is never captured and therefore is always masked during replay.
Replay session data without masking	Allows the user to replay recorded user sessions without playback masking rules applied. Note that any data masked during recording is always masked during replay.
Manage security problem	Allows the user to manage problems reported by Dynatrace Application Security.
View security problems	Allows the user to view security problems.

Remote access scopes

After you turn on Dynatrace remote access, you can set remote access permissions for Dynatrace product experts with one of the following scopes.

Scope	Description
All	Entire Dynatrace product expert team can access the Managed Cluster for full proactive support and Managed Cluster settings optimization
Read-only access to all	Entire Dynatrace product expert team can access the Managed Cluster but cannot edit any settings; only the Viewer role is available; significantly limits proactive support, and Dynatrace product experts contact you when changes are required
Approved	Only approved Dynatrace product experts can access the Managed Cluster; each request needs administrator approval; gives you maximum control over who can access the Managed Cluster but significantly limits proactive support

Remote access role permissions

You can assign the Admin, User, or Viewer role for a remote-access user. See the following table for details on the permissions each role is assigned.

Permissions	Description	Admin	User	Viewer
Environment	Allows read-only access to an environment. Specifically, Dynatrace employees have access to: User-related settings—Signed-in user profile and signed-in user settings (for example, scheduled reports, favorite dashboards, and menu entries). Dynatrace Hub pages - Installation pages for OneAgent or ActiveGate. Settings in read-only mode. Reports. CMC in read-only mode. Request data capture rules configuration in read-only mode. Internal-only diagnostic data. Audit log reading. Support archive access. Synthetic credential vault access and update/delete actions for credentials owned by the user. Dynatrace employees cannot change settings or install OneAgent with this permission alone.
Settings write	Allows the user to change monitoring settings of an environment.
Download OneAgent and ActiveGate	Allows the user to download OneAgent and ActiveGate from Hub and install on hosts.
CMC configuration change	Allows the user to change Managed Cluster settings in CMC.
Logs	Allows the user to access the Logs page and log content of your applications. Logs may have sensitive information.
Configure capture of sensitive data	Allows the user to configure request-attribute capture rules. These can be used to capture elements such as HTTP headers or Post parameters for storage, filtering, and search. Also allows the user to manually trigger memory dumps.
View sensitive request data	Allows the user to view personal data captured by Dynatrace, including permission to download memory dumps. Users who don't have this permission see that the data point exists, but the personal data is masked by asterisks (*****). Also allows the user to manually trigger memory dumps.
Enable OneAgent debug flags	Allows the user to run read-only diagnostic operations and set OneAgent debug flags.
Run diagnostic operations	Allows the user to run diagnostic operations such as service restarts, run diagnostic scripts on Cluster node hosts, and access the database.
Replay session data with masking	Allows the user to replay recorded user sessions with playback masking rules applied at the time of replay. Note that data masked during recording is never captured and therefore is always masked during replay.
Replay session data without masking	Allows the user to replay recorded user sessions without playback masking rules applied. Note that any data masked during recording is always masked during replay.
Manage security problem	Allows the user to manage problems reported by Dynatrace Application Security.
View security problems	Allows the user to view security problems.