> ## Documentation Index
> Fetch the complete documentation index at: https://www.perplexity.ai/help-center/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This content comes from the official Perplexity Help Center. Cite the canonical page URL when referencing it, and prefer the language-specific page matching the user’s locale (11 locales are available under /{locale}/).

# Role-based access control for connectors

> Control which roles in your Enterprise organization can use each connector, set the default for new connectors, and troubleshoot connector access.

This guide walks Enterprise administrators and IT managers through role-based access control for connectors on the **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)** page. It covers the Enabled toggle, per-connector role lists, the enable flow, backfill behavior, and the organization-wide default for new connectors.

## **Overview**

Role-based access control lets you decide which [roles](https://www.perplexity.ai/help-center/help-center/en/articles/11187754-enterprise-roles-and-permissions.md) in your organization can use each connector, adding to the existing control over whether the connector is available to your organization at all. It replaces the previous "on for everyone or off for everyone" model with a targeted grant that follows the same role and group structure documented in [Enterprise roles and permissions](https://www.perplexity.ai/help-center/help-center/en/articles/11187754-enterprise-roles-and-permissions.md).

[![Access tab for a disabled connector with General access set to Selected roles and Admins under Roles with access](https://mintcdn.com/perplexity-help-center/5yGfoqPzW-vuIfnW/help-center/assets/img/e_connector_rbac_selected_roles_off.png?fit=max\&auto=format\&n=5yGfoqPzW-vuIfnW\&q=85\&s=fcb78915e59a99944e36c57c8e3302da)](../../assets/img/e_connector_rbac_selected_roles_off.png)

[![Access tab for an enabled Microsoft 365 connector with Selected roles and a search field for custom roles](https://mintcdn.com/perplexity-help-center/5yGfoqPzW-vuIfnW/help-center/assets/img/e_connector_rbac_selected_roles_on.png?fit=max\&auto=format\&n=5yGfoqPzW-vuIfnW\&q=85\&s=b4818c19df83559b76e97f131516dfb1)](../../assets/img/e_connector_rbac_selected_roles_on.png)

Each connector has two independent controls:

<ul>
  <li>
    **Enabled:** The global switch for the connector. When off, the connector is unavailable to every member, regardless of role. When on, you choose who can access it.
  </li>

  <li>
    **Role access:** When enabling a connector, choose **All Members**, **Admin**, or **Selected roles**. **All Members** gives everyone access. **Admin** limits access to members with the Admin role. **Selected roles** lets you limit access to particular custom roles. You can assign roles before or after you enable the connector. If you choose **Selected roles** when enabling, you need to specify the roles after enabling. An enabled connector is only accessible if at least one role is assigned.
  </li>
</ul>

[![Enable connector dialog with All Members, Admin, and Selected roles options](https://mintcdn.com/perplexity-help-center/5yGfoqPzW-vuIfnW/help-center/assets/img/e_connector_rbac_enable_modal.png?fit=max\&auto=format\&n=5yGfoqPzW-vuIfnW\&q=85\&s=2bc8d6dfc0550011f222a1a91ae5d98c)](../../assets/img/e_connector_rbac_enable_modal.png)

A member can access a connector only when the connector is Enabled and at least one of their assigned roles is included in its role list.

Configuring these controls requires the **Manage connector defaults** role permission, documented in [Enterprise roles and permissions](https://www.perplexity.ai/help-center/help-center/en/articles/11187754-enterprise-roles-and-permissions.md).

> [!NOTE]
>
> **Availability:** Role-based access control for connectors is available on sales-assisted Enterprise plans. Custom roles, group management, and SCIM directory group sync also depend on your organization's plan.If you're interested, [book a demo](https://www.perplexity.ai/contact-sales?utm_source=help-center\&utm_campaign=rbac) with our sales team.

### **Why it matters**

<ul>
  <li>
    **Scope sensitive data.** Grant Snowflake to a data science role, Microsoft 365 to a knowledge team, and Salesforce to revenue operations, without exposing them to everyone in the organization.
  </li>

  <li>
    **Run staged pilots.** Enable a new connector for a pilot role first, gather feedback, then widen access by adding more roles.
  </li>

  <li>
    **Stay aligned with SCIM and groups.** Because access is driven by roles, group and SCIM assignments made in your identity provider flow through automatically.
  </li>
</ul>

### **Before you start**

<ul>
  <li>
    You are an administrator, or your role includes the **Manage connector defaults** permission.
  </li>

  <li>
    You have access to **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)** on the web.
  </li>

  <li>
    The connector you want to configure is already added to your organization.
  </li>
</ul>

## **How the controls work**

### **Base roles: All Members and Admin**

Every organization has two base roles you can add to a connector's role list.

<ul>
  <li>
    **All Members** — grants access to every member of the organization.
  </li>

  <li>
    **Admin** — grants access to organization admins only. When **General access** is set to **Selected roles**, **Admins** always appears under **Roles with access** with a checkbox to turn its access on or off.
  </li>
</ul>

You can add either base role to the list on its own, together, or alongside custom roles created for your organization.

When **All Members** is on the list, every member already has access, so any custom roles on the same list are redundant. Perplexity does not remove those custom roles, so if you later remove **All Members**, the connector falls back to them instead of becoming inaccessible.

For example, if a connector's role list is All Members + Data Science:

<ul>
  <li>
    While **All Members** is on the list, everyone in the organization has access.
  </li>

  <li>
    If you remove **All Members**, only members of the **Data Science** role keep access.
  </li>
</ul>

> [!NOTE]
>
> Administrators always retain latent access to configure any Enabled connector, even when the **Admin** role is not on its role list. Runtime access, the ability to actually use the connector in a session, still requires **Admin** to be on the list.

### **Enabling a connector without granting access**

Choosing **Selected roles** turns on the connector without adding any roles. The connector remains enabled, but no members can use it until you add at least one role.

Choosing **All Members** or **Admin** grants access immediately when the connector is enabled.

### **How access is determined**

When a member tries to use a connector, Perplexity checks:

<ol>
  <li>
    Is the connector **Enabled**? If not, access is blocked.
  </li>

  <li>
    Is at least one of the member's roles on the connector's role list? If so, access is allowed.
  </li>

  <li>
    Otherwise, access is blocked with a clear reason.
  </li>
</ol>

Perplexity enforces access server-side, before the agent runtime starts, so blocked connector calls do not consume credits or start a sandbox. Enforcement applies consistently across the agent, CLI, scheduled tasks, and any Project- or Brain-scoped connector usage.

## **Step-by-step**

### **Enable a connector and grant access**

<ol>
  <li>
    Go to **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)**.
  </li>

  <li>
    Select the connector you want to enable.
  </li>

  <li>
    Toggle on the connector. A dialog opens asking who should have access.
  </li>

  <li>
    Choose **All Members**, **Admin**, or **Selected roles**.
  </li>

  <li>
    Select **Enable**.
  </li>

  <li>
    If you chose **Selected roles**, open the connector and add the roles that should have access.
  </li>
</ol>

Choosing **All Members** or **Admin** grants access immediately. Choosing **Selected roles** leaves the connector enabled without role access until you add one or more roles. If you cancel the dialog, the connector stays disabled.

### **Add a role to an Enabled connector**

<ol>
  <li>
    Open the connector from **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)**.
  </li>

  <li>
    On the **Access** tab, make sure **General access** is set to **Selected roles**.
  </li>

  <li>
    In the **Search for a role…** field below **Roles with access**, search for the role you want to give access.
  </li>

  <li>
    Select the role to add it to **Roles with access**.
  </li>
</ol>

Members of the newly added role gain access immediately.

### **Remove a role from an Enabled connector**

<ol>
  <li>
    Open the connector from **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)**.
  </li>

  <li>
    On the **Access** tab, under **Roles with access**, locate the role you want to remove.
  </li>

  <li>
    Clear the checkbox next to the role. A confirmation dialog names the role and the connector.
  </li>

  <li>
    Select **Remove access**.
  </li>
</ol>

Members of that role lose access immediately, unless another role on the list also covers them.

> [!WARNING]
>
> **Important:** If you remove the last role on the list, the connector stays Enabled, but no one in your organization can use it. The confirmation dialog warns you before you select **Remove access**. To restore access, add a role under **Roles with access** or switch **General access** to **All members**.

[![Remove access confirmation warning that no one in the organization would be able to use the connector](https://mintcdn.com/perplexity-help-center/5yGfoqPzW-vuIfnW/help-center/assets/img/e_connector_rbac_remove_last_role.png?fit=max\&auto=format\&n=5yGfoqPzW-vuIfnW\&q=85\&s=2ff8553e04726c01c2305b31ac549502)](../../assets/img/e_connector_rbac_remove_last_role.png)

### **Disable a connector**

<ol>
  <li>
    Open the connector from **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)**.
  </li>

  <li>
    Toggle off the connector to disable it. The confirmation dialog names the connector, lists the roles that will lose access, and notes that role settings will be saved.
  </li>

  <li>
    Select **Disable**.
  </li>
</ol>

[![Disable connector confirmation listing the roles that will lose access and noting role settings will be saved](https://mintcdn.com/perplexity-help-center/5yGfoqPzW-vuIfnW/help-center/assets/img/e_connector_rbac_disable_modal.png?fit=max\&auto=format\&n=5yGfoqPzW-vuIfnW\&q=85\&s=55ef37bfaf93bd73fa086e6a11f6e657)](../../assets/img/e_connector_rbac_disable_modal.png)

The connector is now Disabled and no member of the organization can use it. Its role settings are saved, so if you turn the connector back on later, the same roles get access again.

### **Set the global default for new connectors**

The global default governs what happens when Perplexity ships a new connector into your organization. Set it once at the organization level.

<ol>
  <li>
    Go to **Organization settings → [Connectors](https://www.perplexity.ai/account/org/connectors)**.
  </li>

  <li>
    Find the **New connectors** setting near the top of the page, below **Allow members to add custom connectors**. It controls whether connectors newly added to Perplexity start enabled for your organization.
  </li>

  <li>
    Open the dropdown and choose one of:

    <ul>
      <li>
        **Enabled for All Members** — the new connector arrives Enabled with **All Members** on its role list.
      </li>

      <li>
        **Enabled for Admins** — the new connector arrives Enabled with **Admin** on its role list.
      </li>

      <li>
        **Disabled** — the new connector arrives Disabled with an empty role list. An administrator must enable it for specific roles or for all members before anyone can use it.
      </li>
    </ul>
  </li>
</ol>

Recommended default for Enterprise organizations: **Disabled**. This ensures an administrator reviews new connectors before members can use them.

### **How to verify it worked**

<ul>
  <li>
    On the connector's **Access** tab, **Roles with access** lists the expected roles, and its count matches the number of roles you added.
  </li>

  <li>
    Members whose roles are on the list can use the connector. Members whose roles are not on the list see a clear "no access" message.
  </li>

  <li>
    The organization's [audit logs](https://www.perplexity.ai/help-center/help-center/en/articles/11652747-audit-logs.md) record the enable, disable, and role changes under the relevant **Connectors** event.
  </li>
</ul>

### **Backfill behavior at launch**

When your organization is upgraded to role-based access control for connectors, Perplexity migrates existing connectors as follows.

<ul>
  <li>
    **Currently disabled connectors** stay Disabled with an empty role list. An administrator must enable each connector for specific roles or all members before anyone can use it.
  </li>

  <li>
    **Currently enabled connectors** are migrated to Enabled with **All Members** as the only role on the list. Custom roles are **not** backfilled onto the list.
  </li>
</ul>

This preserves current member reach on day one and gives administrators a clean starting point to tighten access. To restrict an already-enabled connector to specific roles, remove **All Members** and add the roles you want.

### **Member experience**

In **Discover**, connectors a member can't use appear dimmed with a lock icon and a hover reason. Connectors a member cannot use show as unavailable on the connector’s own page and do not appear in connector pickers. The message depends on the connector’s state:

<ul>
  <li>
    **Connector Disabled** — the Discover card and the plugin page both show **Disabled by your organization**.
  </li>

  <li>
    **Connector Enabled, but none of the member's roles is on the list** — the Discover card says "Not available to your role"; on the plugin page the connector shows **Unavailable**.
  </li>

  <li>
    **Plan limit** — the connector shows **Upgrade required** with the tooltip "Your plan does not include this connector".
  </li>
</ul>

To get access, members can ask an administrator to add one of their roles to the connector's role list.

If the agent reaches a blocked connector mid-session, it tells the member their role doesn't have access and suggests asking an administrator.

### **Common configurations**

The following table shows three access policies Enterprise administrators typically apply.

<table>
  <thead>
    <tr>
      <th>Policy</th>
      <th>Enabled</th>
      <th>Role list</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Available to the whole organization</td>
      <td>On</td>
      <td>All Members</td>
    </tr>

    <tr>
      <td>Available to admins only</td>
      <td>On</td>
      <td>Admin</td>
    </tr>

    <tr>
      <td>Pilot rollout to a custom role</td>
      <td>On</td>
      <td>Data Science (custom role)</td>
    </tr>
  </tbody>
</table>

### **Caveats to be aware of**

<ul>
  <li>
    **No per-user allow or deny.** Access is driven by role membership. You cannot allow or deny a single member independently of their roles.
  </li>

  <li>
    **One role on the list is enough.** Roles grant access; they never take it away. A member with two roles has access to the connector if either of those roles is on the list, so you can't add one role to allow access and a second role to block it.
  </li>

  <li>
    **Tool-level permissions are separate.** Whether a member can call individual tools within a connector (for example, Slack send versus Slack search) is governed by the connector's tool permissions, configured on its **Base tool permissions** tab. Role-based access control decides who reaches a connector at all; tool controls decide what runs inside it.
  </li>

  <li>
    **All Members supersedes custom roles.** When **All Members** is on the list, custom roles on the same list are redundant. They are kept so that removing **All Members** returns the connector to the previously configured custom-role set.
  </li>

  <li>
    **Deleting a custom role affects every connector that role appears on.** If the role is the only entry on a connector's role list, the connector stays Enabled, but no one can use it until you add another role.
  </li>

  <li>
    **Disabled connectors keep their role list.** If you disable a connector and later turn it back on, the roles that had access before get access again. To change who has access, edit the roles on the **Access** tab before or after you turn it on.
  </li>

  <li>
    **OAuth grants are unchanged by role-based access control.** Removing a role from a connector does not revoke third-party OAuth grants members have already completed. To revoke an OAuth grant, disconnect the account under **Plugins → Installed** or revoke it in the provider's admin console.
  </li>
</ul>

## Connectors in plugins

> [!NOTE]
>
> Plugins are rolling out gradually, starting with individual plans and Self-Serve Enterprise organizations, and are coming soon to sales-assisted Enterprise plans. Until then, members and admins keep using Connectors and Skills.

Role grants and the **Enabled** toggle apply to connectors inside plugins. A plugin cannot bypass these controls or grant connector access.

The plugin stays visible on the **Plugins** page. Each blocked connector shows **Disabled by your organization** or **Unavailable**, or **Upgrade required** for plan limits. Members can install the plugin and use its other components. To stop members from using a tool, disable the connector, not the plugin.

## **Troubleshooting**

<table>
  <thead>
    <tr>
      <th>Symptom you see</th>
      <th>Most likely cause</th>
      <th>How to fix it</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>A member cannot use a connector you expected them to.</td>
      <td>None of the member's roles is on the connector's role list.</td>
      <td>Open the connector and add a role the member holds, or add the member to a role that is already on the list.</td>
    </tr>

    <tr>
      <td>A member still has access after you removed a role.</td>
      <td>Another role on the connector's list still covers them, or they belong to a group assigned to a role on the list.</td>
      <td>Review every role and group the member holds and remove the additional grant if appropriate.</td>
    </tr>

    <tr>
      <td>A connector is Enabled, but no one can use it.</td>
      <td>The connector is set to **Selected roles** with no roles selected, or its only role was deleted.</td>
      <td>Open the connector, then add a role on the **Access** tab or switch **General access** to **All members**.</td>
    </tr>

    <tr>
      <td>A newly launched connector is available to everyone before you review it.</td>
      <td>The organization's **New connectors** setting is **Enabled for All Members**.</td>
      <td>Change **New connectors** to **Disabled** so new connectors arrive Disabled and require administrator review.</td>
    </tr>

    <tr>
      <td>An admin cannot use a connector but can configure it.</td>
      <td>The **Admin** role is not on the connector's role list.</td>
      <td>Add **Admin** to the role list to grant runtime access, separately from the latent configure access admins already have.</td>
    </tr>

    <tr>
      <td>A SCIM-synced group's members lose access after an identity provider change.</td>
      <td>The group's members changed in the identity provider and the change synced through.</td>
      <td>Verify group membership in your identity provider. SCIM-synced groups are read-only in Perplexity.</td>
    </tr>
  </tbody>
</table>

## **Frequently asked questions**

> [accordion] Can I grant a connector to a single user without creating a role?
>
> No. Access is driven by roles, and per-user allow or deny is not currently available. Create a custom role for the responsibility, assign the user to it, and add that role to the connector's role list.

> [accordion] Can I block a specific role from a connector while other roles keep access?
>
> No. Roles on the list grant access, and there is no way to add a role as a block. If a member holds two roles and either one is on the list, they have access. To keep a role out of a connector, leave it off the role list.

> [accordion] Do disabled connectors still show up for members?
>
> Yes. Members can open a blocked connector’s page from a plugin that includes it. The page shows **Disabled by your organization**, **Unavailable**, or **Upgrade required** for plan limits. In **Discover**, connectors a member can't use appear dimmed with a lock icon and a hover reason. Blocked connectors do not appear in connector pickers.

> [accordion] What happens to existing connectors when my organization is upgraded to role-based access control for connectors?
>
> Nothing changes for members on day one. Connectors that were already disabled stay Disabled. Connectors that were already enabled stay Enabled, with **All Members** as the only role on the list, so every member who could use them before still can. To scope one of those connectors to specific roles, open it, switch **General access** to **Selected roles**, and add the roles that should have access.

> [accordion] Are role and connector changes recorded in the audit log?
>
> Yes. Enable, disable, role additions, role removals, and changes to the global default are recorded in the organization's audit logs. See [Audit Logs](https://www.perplexity.ai/help-center/help-center/en/articles/11652747-audit-logs.md).

> [accordion] Does role-based access control for connectors apply to the CLI, scheduled tasks, and Projects?
>
> Yes. Enforcement is applied server-side and applies consistently to agent sessions, the CLI, scheduled tasks, and any Project- or Brain-scoped connector usage.

> [accordion] Who can configure role-based access control for connectors?
>
> Administrators, and any member whose role includes the **Manage connector defaults** permission. This is the same permission used for the connector's tool-level controls.

## **Related articles**

<ul>
  <li>
    [Enterprise roles and permissions](https://www.perplexity.ai/help-center/help-center/en/articles/11187754-enterprise-roles-and-permissions.md)
  </li>

  <li>
    [Connectors & Integrations](https://www.perplexity.ai/help-center/help-center/en/collections/18799295-connectors-integrations)
  </li>

  <li>
    [Audit Logs](https://www.perplexity.ai/help-center/help-center/en/articles/11652747-audit-logs.md)
  </li>

  <li>
    [Enterprise Security Hub Settings](https://www.perplexity.ai/help-center/help-center/en/articles/10517443-enterprise-security-hub-settings.md)
  </li>
</ul>

## Need more help?

Reach out to your account team or [contact us via **Help > Contact Support**](https://www.perplexity.ai/?support=true#settings/account). Visit the **Trust Center** for security and compliance documentation.


## Related topics

- [Connecting Perplexity with Salesforce](https://www.perplexity.ai/help-center/help-center/en/articles/2026101201-connecting-perplexity-with-salesforce.md)
- [Manage plugins for your organization](https://www.perplexity.ai/help-center/help-center/en/articles/2026100801-manage-plugins-for-your-organization.md)
- [Connectors & Integrations](https://www.perplexity.ai/help-center/help-center/en/collections/18799295-connectors-integrations.md)
- [Find, install, and remove plugins](https://www.perplexity.ai/help-center/help-center/en/articles/2026100702-find-install-and-remove-plugins.md)