The actions that a user is allowed to perform are specified by the **role** that is assigned to that user. A role is a named set of permissions that allows a user to perform some set of actions.

The administrator roles are:

## Company administrator

Performs all functions of a domain administrator in all domains within their company, and can edit their company information and suspend accounts. They can also add or remove domains and create and assign administrators, including Company mail, Company read only, and Company view admins.

## Company mail

Can view and edit non-billable mailbox settings, cannot create or delete mailboxes or edit domain settings.

## Company read only

Can view everything that a company administrator can, but does not have the ability to make changes.

## Company token only

Can generate SSO (Single Sign On) tokens for users in any domains in their company. This is their only responsibility; they cannot view or change settings for domains or users.

## Company view

Can view all domains in the company, and can make non-billable changes to mailboxes and domains, but does not have the ability to create or delete mailboxes or domains.

## Domain administrator

Performs all functions of a workgroup administrator. In addition, they can add or remove workgroups and workgroup administrators as well as manage their domain. If you enable Mailbox Admin in the Branding tool, Domain Administrators can also create and edit mailbox accounts through the Webmail interface.

## Mail administrator

Manages mailboxes within the domain for which they are administrators. Typical tasks may be changing passwords, setting forwarding, adding or removing nicknames, and setting autoresponders.

## Workgroup administrator

Creates, deletes, and manages mailboxes within the workgroups for which they are administrators.