[Yandex Cloud documentation](../../index.md) > [Yandex Cloud partner program](../index.md) > Partner portal > Access management

# Access management


## Roles this service has {#roles-list}

### Service roles {#service-roles}

#### billing.accounts.owner {#billing-accounts-owner}

When creating your billing account, you get the `billing.accounts.owner` role automatically. Any user with the `billing.accounts.owner` role can revoke this role from the billing account creator and change the owner.

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display [billing accounts](../../billing/concepts/billing-account.md) in the list of all accounts.
* View billing account data.
* View [client offers](../../billing/concepts/glossary.md#client-offer).
* View info on the [access permissions](../../iam/concepts/access-control/index.md) granted for the relevant billing accounts and modify such permissions.
* Activate, deactivate, or modify the [technical support](../../support/overview.md) service plan, as well as change the billing account from which the payment is debited.
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* Generate new [reconciliation reports](../../billing/concepts/act.md#reconciliation-report).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).
* [Export details](../../billing/operations/get-folder-report.md).
* Create [budgets](../../billing/concepts/budget.md).
* [Reserve resource usage](../../billing/concepts/cvos.md).
* Top up their [personal account](../../billing/concepts/personal-account.md) using a bank account.
* Top up their personal account using a credit or debit card.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to a billing account.
* Rename billing accounts.
* Changing payer contact details.
* Change payment details.
* Change their credit or debit card details.
* Change the payment method.
* Redeem promo codes.
* Activate the [trial period](../../billing/concepts/trial-period.md).
* Activate the [paid version](../../getting-started/free-trial/concepts/upgrade-to-paid.md).
* [Delete](../../billing/operations/delete-account.md) billing accounts.

{% endcut %}

{% cut "On the Yandex Cloud partner portal, users with this role can:" %}

* [Create](../operations/pin-client.md#client-entry) customer records ([subaccounts](../terms.md#sub-account)).
* View the list of subaccounts and info on them, including personal data.
* Update subaccount records.
* Activate subaccounts.
* Suspend subaccounts.
* Re-activate subaccounts.
* Delete subaccounts without customer confirmation.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to subaccounts.
* [Manage](../operations/access/partners-account.md) access permissions to subaccounts.
* [View](../operations/get-client-stat.md) the details of how the customers use services.
* View the list of [partner discounts](../portal.md#premium) and info on them.

{% endcut %}

This role includes the `billing.accounts.admin` and `billing.accounts.varWithoutDiscounts` permissions.

#### billing.accounts.viewer {#billing-accounts-viewer}

To use the `billing.accounts.viewer` role, you need to assign it for a billing account. This role enables you to view billing account data, get information about resource consumption, monitor expenses, and export reconciliation reports and reporting documents.

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display [billing accounts](../../billing/concepts/billing-account.md) in the list of all accounts.
* View billing account data.
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).

{% endcut %}

#### billing.accounts.accountant {#billing-accounts-accountant}

To use the `billing.accounts.accountant` role, you need to assign it for a billing account. This role enables you to view billing account data, get information about resource consumption, monitor expenses, export reconciliation reports and reporting documents, create new reconciliation reports, and top up your personal account using a bank account.

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display billing accounts in the list of all accounts.
* View billing account data.
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* Generate new [reconciliation reports](../../billing/concepts/act.md#reconciliation-report).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).
* Top up their [personal account](../../billing/concepts/personal-account.md) using a bank account.

{% endcut %}


This role includes the `billing.accounts.viewer` permissions.

#### billing.accounts.editor {#billing-accounts-editor}

To use the `billing.accounts.editor` role, you need to assign it for a billing account. It enables you to get payment invoices, redeem promo codes, link clouds and services to your billing account, create details export and budgets, generate reconciliation reports, and reserve resources.

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display [billing accounts](../../billing/concepts/billing-account.md) in the list of all accounts.
* View billing account data.
* View [client offers](../../billing/concepts/glossary.md#client-offer).
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* Generate new [reconciliation reports](../../billing/concepts/act.md#reconciliation-report).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).
* [Export details](../../billing/operations/get-folder-report.md).
* Create [budgets](../../billing/concepts/budget.md).
* [Reserve resource usage](../../billing/concepts/cvos.md).
* Top up their [personal account](../../billing/concepts/personal-account.md) using a bank account.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to a billing account.
* Rename billing accounts.
* Redeem promo codes.

{% endcut %}

{% cut "On the Yandex Cloud partner portal, users with this role can:" %}

* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to [subaccounts](../terms.md#sub-account).

{% endcut %}

This role includes the `billing.accounts.viewer` permissions.

#### billing.accounts.varWithoutDiscounts {#billing-accounts-var-without-discounts}

To use the `billing.accounts.varWithoutDiscounts` role, you need to assign it for a billing account. This role grants partner accounts all administrator privileges, except the permission to get information about discounts.

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display [billing accounts](../../billing/concepts/billing-account.md) in the list of all accounts.
* View billing account data.
* View info on the [access permissions](../../iam/concepts/access-control/index.md) granted for the relevant billing accounts.
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* Generate new [reconciliation reports](../../billing/concepts/act.md#reconciliation-report).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).
* [Export details](../../billing/operations/get-folder-report.md).
* Create [budgets](../../billing/concepts/budget.md).
* [Reserve resource usage](../../billing/concepts/cvos.md).
* Top up their [personal account](../../billing/concepts/personal-account.md) using a bank account.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to a billing account.
* Rename billing accounts.
* Redeem promo codes.

{% endcut %}

{% cut "On the Yandex Cloud partner portal, users with this role can:" %}

* [Create](../operations/pin-client.md#client-entry) customer records ([subaccounts](../terms.md#sub-account)).
* View the list of subaccounts and info on them.
* Activate subaccounts.
* Suspend subaccounts.
* Re-activate subaccounts.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to subaccounts.
* [Manage](../operations/access/partners-account.md) access permissions to subaccounts.
* [View](../operations/get-client-stat.md) the details of how the customers use services.

{% endcut %}

This role includes the `billing.partners.editor` permissions.

#### billing.accounts.admin {#billing-accounts-admin}

To use the `billing.accounts.admin` role, you need to assign it for a billing account. It enables managing access to a billing account (except for `billing.accounts.owner`).

{% cut "In Yandex Cloud Billing, users with this role can:" %}

* Display [billing accounts](../../billing/concepts/billing-account.md) in the list of all accounts.
* View billing account data.
* View [client offers](../../billing/concepts/glossary.md#client-offer).
* View info on the [access permissions](../../iam/concepts/access-control/index.md) granted for the relevant billing accounts and modify such permissions (except for assigning and revoking the `billing.accounts.owner` role).
* Activate, deactivate, or modify the [technical support](../../support/overview.md) service plan, as well as change the billing account from which the payment is debited.
* View and download [reporting (or closing) documents](../../billing/payment/documents.md).
* Generate new [reconciliation reports](../../billing/concepts/act.md#reconciliation-report).
* View and download generated reconciliation reports.
* Get and view notifications on consumption.
* Monitor expenses.
* [View usage details](../../billing/operations/check-charges.md).
* [Export details](../../billing/operations/get-folder-report.md).
* Create [budgets](../../billing/concepts/budget.md).
* [Reserve resource usage](../../billing/concepts/cvos.md).
* Top up their [personal account](../../billing/concepts/personal-account.md) using a bank account.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to a billing account.
* Rename billing accounts.
* Redeem promo codes.

{% endcut %}

{% cut "On the Yandex Cloud partner portal, users with this role can:" %}

* [Create](../operations/pin-client.md#client-entry) customer records ([subaccounts](../terms.md#sub-account)).
* View the list of subaccounts and info on them, including personal data.
* Activate subaccounts.
* Suspend subaccounts.
* Re-activate subaccounts.
* Link [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) to subaccounts.
* [Manage](../operations/access/partners-account.md) access permissions to subaccounts.
* [View](../operations/get-client-stat.md) the details of how the customers use services.
* View the list of [partner discounts](../portal.md#premium) and info on them.

{% endcut %}

This role includes the `billing.accounts.editor`, `billing.accounts.partnerAdmin`, and `billing.partners.editor` permissions.

#### billing.accounts.partnerViewer {#billing-accounts-partnerViewer}

To use the `billing.accounts.partnerViewer` role, you need to assign it for a billing account. It enables viewing partner info, except for personal data.

On the Yandex Cloud partner portal, users with this role can:
* View the list of [subaccounts](../terms.md#sub-account) and info on them (except for personal data).
* View the list of [partner discounts](../portal.md#premium).
* View the [partner tools](../program/var-tools.md) page.
* View the list of accounts and info on them (except for personal data).
* View the list of contacts and info on them (except for personal data).
* View the list of [partner deals](../terms.md#deal-reg) and info on them (except for personal data).

#### billing.accounts.piiPartnerViewer {#billing-accounts-piiPartnerViewer}

To use the `billing.accounts.piiPartnerViewer` role, you need to assign it for a billing account. It enables viewing subaccount and partner info, including personal data.

On the Yandex Cloud partner portal, users with this role can:
* View info on the partner balance, discounts, and [rebate](../terms.md#rebate) withdrawals.
* [View](../operations/get-client-stat.md) details on partner consumption, including consumption in partner [subaccounts](../terms.md#sub-account).
* View the list of [partner discounts](../portal.md#premium).
* View the [partner tools](../program/var-tools.md) page.
* View the list of accounts and info on them, including personal data.
* View the list of subaccounts and info on them, including personal data.
* View the list of contacts and info on them, including personal data.
* View the list of [partner deals](../terms.md#deal-reg) and info on them, including personal data.

This role includes the `billing.accounts.partnerViewer` permissions.

#### billing.accounts.partnerEditor {#billing-accounts-partnerEditor}

To use the `billing.accounts.partnerEditor` role, you need to assign it for a billing account. It enables managing accounts, subaccounts, contacts, and partner deals. This role does not provide access to personal data.

On the Yandex Cloud partner portal, users with this role can:
* Manage [subaccounts](../terms.md#sub-account) regardless of the [access permissions](../../iam/concepts/access-control/index.md) assigned at the [organization](../../organization/concepts/organization.md) level, excepting the permission to work with a partner.
* View the list of subaccounts and info on them (except for personal data).
* Create new subaccounts and update the existing ones, as well as suspend, resume, and delete subaccounts.
* View the list of accounts and info on them (except for personal data), as well as edit such info.
* View the list of contacts and info on them (except for personal data), as well as edit such contacts.
* View the list of [partner deals](../terms.md#deal-reg) and info on them (except for personal data), as well as edit such info.
* View the list of [partner discounts](../portal.md#premium).
* View the [partner tools](../program/var-tools.md) page.

This role includes the `billing.accounts.partnerViewer` permissions.

#### billing.accounts.piiPartnerEditor {#billing-accounts-piiPartnerEditor}

To use the `billing.accounts.piiPartnerEditor` role, you need to assign it for a billing account. It enables managing partner rebate withdrawals, as well as viewing subaccount and partner info, including personal data.

On the Yandex Cloud partner portal, users with this role can:
* View info on the partner balance, discounts, and [rebate](../terms.md#rebate) withdrawals.
* Create spending agreements for partner rebates and withdraw such rebates.
* [View](../operations/get-client-stat.md) details on partner consumption, including consumption in partner [subaccounts](../terms.md#sub-account).
* View the list of [partner discounts](../portal.md#premium).
* View the [partner tools](../program/var-tools.md) page.
* View the list of accounts and info on them, including personal data.
* View the list of subaccounts and info on them, including personal data.
* View the list of contacts and info on them, including personal data.
* View the list of [partner deals](../terms.md#deal-reg) and info on them, including personal data.

This role includes the `billing.accounts.piiPartnerViewer` permissions.

#### billing.accounts.partnerAdmin {#billing-accounts-partnerAdmin}

To use the `billing.accounts.partnerAdmin` role, you need to assign it to a billing account. It enables access to all partner portal tools and all info stored on the portal, including personal data.

On the Yandex Cloud partner portal, users with this role can:
* Manage [subaccounts](../terms.md#sub-account) regardless of the [access permissions](../../iam/concepts/access-control/index.md) assigned at the [organization](../../organization/concepts/organization.md) level, excepting the permission to work with a partner.
* View the list of subaccounts and info on them, including personal data.
* Create new subaccounts and update the existing ones, as well as suspend, resume, and delete subaccounts.
* View the list of accounts and info on them, including personal data, as well as edit such info.
* View the list of contacts and info on them, including personal data, as well as edit such contacts.
* View the list of [partner deals](../terms.md#deal-reg) and info on them, including personal data, as well as edit such info.
* View info on the partner balance, discounts, and [rebate](../terms.md#rebate) withdrawals.
* Create spending agreements for partner rebates and withdraw such rebates.
* [View](../operations/get-client-stat.md) details on partner consumption, including consumption in partner subaccounts.
* View the list of [partner discounts](../portal.md#premium).
* View the [partner tools](../program/var-tools.md) page.

This role includes the `billing.accounts.partnerEditor` and `billing.accounts.piiPartnerEditor` permissions.

### Primitive roles {#primitive-roles}

Primitive roles are aggregator roles that define user permissions to access services. In Yandex Cloud Billing, these roles match the following `billing.accounts.*` roles:

* `auditor`: Same as `billing.accounts.viewer` (with some limitations).
* `viewer`: Same as `billing.accounts.viewer`.
* `editor`: Same as `billing.accounts.editor`.
* `admin`: Same as `billing.accounts.admin`.

Primitive roles can only be assigned to users in the **Users** list.

## Available operations for a partner account {#partner-available-operations}

The tables below provide a list of operations available to each role type. Full names of the listed roles start with `billing.accounts.*`.

### General operations for an account {#general}

#|
|| **Operations** |
`owner` |
`viewer` |
`accountant` |
`editor` |
`admin` |
`varWithoutDiscounts` ||
|| View billing account details |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Link a cloud to an account |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Manage billing account access permissions |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Activate the paid version |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|| Deleting a billing account |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|#

### Operations for the VAR program {#var-operations}

#|
|| **Operations** |
`owner` |
`viewer` |
`accountant` |
`editor` |
`admin` |
`varWithoutDiscounts` ||
|| View a list of customers (subaccounts) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| View the customer service usage |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Create a customer record (subaccount) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Suspend a subaccount |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Reactivate a subaccount |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| View the list of partner bonuses and info on them |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) ||
|| Update customer record (subaccount) data |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|#


## Available operations for a subaccount {#subaccount-available-operations}

The table below provides a list of operations available to each role type. Full names of the listed roles start with `billing.accounts.*`.

#|
|| **Operations** |
`customer` ^1^ |
`owner` |
`viewer` |
`accountant` |
`editor` |
`admin` |
`varWithoutDiscounts` ||
|| View subaccount details |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Link a cloud to an account |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Activate a subaccount |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Manage subaccount access permissions |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/yes.svg) ||
|| Delete a subaccount (without customer confirmation) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|| Accept partner invitation |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|| Decline partner invitation |
![image](../../_assets/common/yes.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) |
![image](../../_assets/common/no.svg) ||
|#

^1^ The `billing.accounts.customer` role is assigned to a user automatically when you create their subaccount. You cannot assign it manually.