Team Management

Query controls access on two levels that work together:

• Tenant roles — every user is a Team Admin or a Team Member, which sets their baseline capabilities across the tenant.
• Fine-grained permissions — on top of those roles, you can grant or revoke access to individual connectors and detections, and to tenant-wide capabilities such as creating connectors or reading the audit log. These permissions are granted to groups (recommended) or to individual users.

Roles get a team up and running quickly; fine-grained permissions let you say exactly which groups can use or edit which resources as your deployment grows.

Roles

User management in Query is organized at the tenant level. Every user is assigned one of two roles:

Team Admins can:

• Invite team members to join the tenant,
• Add, edit, and delete connection sources,
• Create and edit detections,
• Read the tenant's audit log,
• Grant and revoke permissions for other groups and users, and
• Use and edit every connector and detection in the tenant automatically — admins never need to be granted access to a specific resource.

Team Members can:

• Perform searches against the connectors and detections they've been granted access to, and
• Save searches.

Beyond this baseline, a Team Member can be granted any of the fine-grained permissions below — for example, the ability to edit a particular detection or to create new connectors — without being promoted to Team Admin.

Groups

Permissions are granted to groups wherever possible. Granting to a group lets you manage access for many people at once, and access stays in sync as group membership changes. Query draws groups from two sources:

• Entra / Active Directory groups — when your tenant is federated with Microsoft Entra ID, your existing directory groups (for example, SOC Analysts or Detection Engineers) become available in Query automatically. You grant access to the same groups you already manage in your directory; membership is resolved from Entra, so there's nothing to maintain twice.
• Query-native groups — groups defined within Query. Every tenant has two built-in Query-native groups, Tenant Admins and Tenant Members, corresponding to the two roles above.

When you reference a group, you can disambiguate its source with a prefix — entra:detection-engineers or query:compliance-readers — which is required only when the same name exists in both sources.

📘

Discovering group names

Use the FSQL EXPLAIN GROUPS statement to list the groups available to grant to in your tenant, along with each group's source.

Permissions

There are two kinds of permission. Resource permissions apply to a specific connector or detection. Tenant permissions apply to the tenant as a whole.

Granting can_edit on a resource also grants can_use on it — if someone can modify a connector or detection, they can also run queries against it. Team Admins hold all of these permissions across the entire tenant automatically.

Managing access

Fine-grained permissions are managed with FSQL permission statements — GRANT, REVOKE, EXPLAIN GRANTS, and EXPLAIN GROUPS. For example:

-- Let the SOC Analysts group run queries against a connector
GRANT can_use ON CONNECTOR splunk-prod TO GROUP 'SOC Analysts'

-- Let the Detection Engineers group edit a detection
GRANT can_edit ON DETECTION 'Brute force AD' TO GROUP entra:detection-engineers

-- Let a group create new detections in the tenant
GRANT can_create_detection TO GROUP detection-engineers

-- Review who has access to a connector
EXPLAIN GRANTS ON CONNECTOR splunk-prod

See Permission Statements for the full command reference, including resource and identity reference forms, the #tag shortcut for granting across many connectors at once, and REVOKE semantics.

Safeguards

• You can't lock yourself out. Query rejects any change that would leave the tenant with no Team Admin, so there is always at least one administrator who can manage access.
• The audit log is tamper-proof. Every grant and revoke is recorded in an append-only audit log that administrators cannot edit or delete. Users with can_read_audit can review this history.

Inviting team members

As a Team Admin, you can invite users from your organization to join your tenant and use Query to search security data across the connection sources you've established.

How to invite users to your team

1. Locate the user profile menu link at the bottom of the menu bar and click on it.
2. Choose Settings → Organization. Here, you'll see the first team created by Query.
3. Click on Invite to add your team members to the team.

Renaming your team

When you sign up as a Team Admin, Query generates a tenant and a team name for you. You can rename them by following these steps:

1. Click on the user profile menu link at the bottom of the menu bar.
2. Choose Settings → Organization. Here, you'll see the initial team created by Query.
3. Click on the three dots on the right side and select 'Rename Team'. In the popup that appears, you can rename the team name and click Save.