Carbonio Email Service provider

Have a Question?

User accounts established on the Directory Server can be awarded administrative privileges, allowing them to control the permissions provided to other accounts, domain settings, or a mix of the two.

This article describes the key pre-built roles and their corresponding rights. Users in these groups immediately inherit the group’s rights. Pre-built roles are hierarchical, which means that each position has certain unique rights in addition to the rights of the roles below: for example, a Delegated Domain Admin has all of the rights of a User, Group, and Help Desk Administrator.

Except for Global Administrators, who have access to all domains and settings created in the Carbonio Admin Panel, all other pre-built roles enable you to control the settings of a single domain or a portion of a domain.


These prerequisites must be met before you may control privileges.

To utilise correctly, a domain must be initialised via Domains ‣ Manage ‣ Delegated Domain Admins.

Alternatively, you can initialise a domain using the CLI:

To initialise, replace with your domain.

Users qualified to become Administrators must have the property zimbraIsDelegationAdminAccount set to True.

How to Create an Administrator.

The technique for creating Administrators differs slightly from that of Global Admins.

Global Administrators

They, also known as Infrastructure Administrators, have full access to the Carbonio Admin Panel and API, allowing them to administer all aspects of the Carbonio Infrastructure.

This is a list of rights reserved solely for the Global Administrator. These are connected to the overall Carbonio CE infrastructure.

  • Manage domains.
  • Manage Class of Service.
  • Manage administrators and their duties.
  • Manage Global Configuration.
  • Theme and Whitelabel settings
  • Default Domain
  • Manage the MTA setup.
  • Blocked extension
  • Enable or disable authentication for each node.
  • Relay for external delivery.
  • Trusted Network
  • Max Size
  • MTA restriction and RBL (smtpd_recipient_restrictions).
  • AS/AV Configuration
  • Kill/Tag Score
  • Subject Prefix:
  • Update Frequency
  • AV Archives
  • AV notification settings
  • Proxy Configuration
  • Manage other users, including administrators, by changing their passwords, authenticating them, and managing their files and settings.
  • Manage the infrastructure licence and subscription.
  • Manage storage configurations.
  • S3 Bucket
  • Server Volumes (Primary, Secondary, Index).
  • HSM Policy and Settings
  • Manage Backup Configuration.
Domain administrators

A Domain Admin has full authority over the domain and the lifespan of the domain’s objects, and they have the following rights:

  • View and change domain properties except for
  • Assigned Class of Service
  • Maximum Account Number.
  • Quota (max account quota and aggregate quota)
  • Manage Domain Theme.
  • Create, amend, and delete other Domain Administrators.
  • Assign permissions to other Domain Administrators. Manage GALSync users and configuration.
  • Manage Domain Authentication Settings
  • Manage the Domain VirtualHost and Certificate.
  • In addition, all the rights of a Delegated (Domain) Administrator
Delegated Domain Administrators

Delegated (Domain) Administrators have complete access to a domain’s settings, with the exception of infrastructure settings, which are reserved for the Domain Administrator. In detail, these are the rights of a Delegated Administrator.

  • View Domain Attributes.
  • In addition, all the rights of a User Management (Domain) Administrator.
User Management (Domain) Administrators

A User Management Admin has authority over the lifespan of users in the domain. These rights are reserved to a User Management Administrator.

  • View Domain Attributes.
  • Create, change, and remove regular accounts, except for
  • Mailstore utilised for the account.
  • Manage User Aliases
  • Manage the user password policy settings.
  • Create, alter, and remove regular resources, except for
  • The account uses Mailstore, and the login user may manage other users.
  • Restore Accounts From Backup
  • In addition, all the rights of a Help Desk (Domain) Administrator.
  • In addition, all the rights of a Group Management (Domain) Administrator
Group Management (Domain) Administrator
  • A Group Management Administrator has management over the lifespan of the domain’s distribution list and holds these rights.
  • View Domain Attributes.
  • Create, change, and remove distribution lists, with the exception of Dynamic Distribution Lists.
  • Manage DL Aliases.
Help Desk (Domain) Administrators

Help Desk (Domain) Admins can change passwords for all users except administrators and manage some user information using the Carbonio Admin Panel and API. Specifically, they enjoy these rights.

  • View Domain Attributes.
  • Modify user information like this:
  • Personal data
  • User Preferences
  • Activate or deactivate active sync access.
  • Reset and assign user passwords, app credentials, and OTP codes.
  • Suspend and Reset ActiveSync Sessions.
  • Suspend and reset HTTP/IMAP sessions.
  • Undelete emails, calendars, and contacts.