Build your first agent in just a few minutes with [Rasa Copilot](https://hello.rasa.com/?utm_source=docs&utm_medium=referral&utm_campaign=docs_cta).

Studio uses [Keycloak](https://www.keycloak.org/) to manage user authentication, roles, and permissions. This guide explains how to set up user roles for your team, including two main authentication options:

1. **[Simple Authentication](/content/docs/studio/installation/setup-guides/authorization-guide/#simple-authentication-setup/index.html)**: Users log in with a username and password.
2. **[Single Sign On](/content/docs/studio/installation/setup-guides/authorization-guide/#sso-setup/index.html)**: Centralized login using an identity provider.

## Roles Overview

Studio includes eight default roles to tailor access levels to your team's needs. You can choose which ones make the most sense for your team and organization:

- **SuperUser**: Oversees all of Studio’s functionality — from configuring settings to building the assistant and reviewing conversations.
- **Lead Annotator**: Oversees and reviews annotations, manages CMS content.
- **Annotator**: Annotates data and creates NLU annotations.
- **Flow Builder**: Designs conversational flows and manages NLU data.
- **NLU Editor**: Creates and edits NLU models for training.
- **Business User**: Tests assistants and interacts with flows for business insights.
- **Developer**: Handles technical tasks like exporting annotations and configuring settings.
- **Conversation Analyst**: Analyzes conversation data and manages tags.
- **Conversation Viewer**: Views conversation data and tags.

## Simple Authentication Setup

Follow these steps to set up users with username/password login:

1. **Log in to Keycloak**:
   Navigate to `https://<your-studio-url>/auth` and log in using admin credentials (`KEYCLOAK_ADMIN_USERNAME` and `KEYCLOAK_ADMIN_PASSWORD`).

2. **Select the Realm**:
   Choose the `rasa-studio` realm from the dropdown menu.

3. **Add a New User**:
   - Navigate to `Users` > `Add user`.
   - Enter user details and click **Create**.

4. **Assign Roles**:
   - Go to the `Groups` tab and add the user to the relevant groups to assign roles.
   
   
5. **Set the Password**:
   - Go to `Credentials` and set a password.
   - Enable the "Temporary password" toggle if the user needs to reset their password on first login.

## SSO Setup

To configure SSO for your users:

1. **Log in to Keycloak**:
   Access the `Administration Console` and select the `rasa-studio` realm.

2. **Configure Identity Providers**:
   - Navigate to the `Identity Providers` section.
   - Select and configure your desired provider (e.g., Google, Azure AD).

3. **Follow Provider Instructions**:
   Refer to [Keycloak SSO Documentation](https://www.keycloak.org/docs/latest/server_admin/#sso-protocols) for specific setup steps.

You can read more details on authorization in our [API Authorization Guide](/content/docs/studio/security/authorization/index.html) or [Managing Users Guide](/content/docs/studio/security/managing-users/index.html).