platform-operators.html.md.erb

---
title: Pivotal Platform Operators
owners: CAPI, Identity
---

This topic describes the roles and permissions of the operator user type in a <%= vars.product_name %> deployment.

## <a id="overview"></a> Overview

There are various user types in a <%= vars.product_name %> deployment. Roles are assigned categories that more specifically define functions that a user can perform. For more information about user types in <%= vars.product_name %>, see [User Accounts and Communications](../adminguide/user-accounts-index.html). 

Operators are users who run a <%= vars.product_name %> deployment and have admin privileges. Operators are also referred to as <%= vars.product_name %> Ops Manager admins and runtime admins because they perform an admin role within these contexts.


## <a id="operator-tools-tasks"></a> Operator Tools and Tasks

 Operators fulfill system admin roles covering the entire <%= vars.product_name %> deployment. They work primarily with their IaaS and Ops Manager to configure and maintain <%= vars.product_name %> runtime component VMs. The component VMs support the VMs that host apps. 

Typical operator tasks include:

* Deploying and configuring Ops Manager, <%= vars.product_name %> runtimes, and other product and service tiles.
* Maintaining and upgrading <%= vars.product_name %> deployments.
* Creating user accounts for <%= vars.product_name %> users and the orgs that the users work within.
* Creating service plans that define the access granted to end users.

## <a id="operator-accounts"></a> Operator User Accounts

When Ops Manager starts up for the first time, the operator specifies one of the following authentication systems for operator user accounts:

* Internal authentication, using a new UAA database that Ops Manager creates.
* External authentication, through an existing identity provider accessed through SAML protocol.

The operator can then use the UAA CLI (UAAC) to create more operator accounts. For more information, see [Creating and Managing Ops Manager User and Client Accounts](https://docs.pivotal.io/platform/<%= vars.current_major_version.sub('.', '-') %>/customizing/opsman-users.html).

## <a id='table'></a> Operator Roles and Permissions

The following table summarizes the <%= vars.product_name %> operator user type, including their roles, the tools they use, the System of Record (SOR) that stores their accounts, and the accounts that they can provision.

<table id='users-summary' border='1' class='nice'>
	<col width="20%">
	<col width="20%">
	<col width="20%">
	<col width="20%">
	<col width="20%">
	<tr>
		<th>User Type</th>
		<th>Available Roles</th>
		<th>Tools They Use</th>
		<th>Account SOR</th>
		<th>Accounts They Can Provision</th>
	</tr><tr>
		<td>Operator</td>
		<td>
			<ul>
				<li>
					UAA Admin
				</li>
				<li>
					SSO Plan Admin
				</li>
				<li>
					Other system admins
				</li>
			</ul>
		</td>
		<td>
			<ul>
				<li>
					IaaS UI
				</li>
				<li>
					PivNet
				</li>
				<li>
					Ops Manager
				</li>
				<li>
					Cloud Foundry CLI (cf CLI)
				</li>
				<li>
					UAA CLI (UAAC)
				</li>
				<li>
					SSO Dashboard
				</li>
				<li>
					Marketplace
				</li>
			</ul>
		</td>
		<td>
			Ops Manager user store through UAA<br>
			&nbsp;&nbsp;<i>or</i><br>
			External store through SAML</td>
		<td>Operators and <%= vars.product_name %> runtime users</td>
	</tr>
</table>