# Assign a Role to a User

Roles control which parts of the management portal an extension user can reach and what they are allowed to do there. Assigning a role is how you give one user (identified by their extension) access to those admin features without handing over full control of the system. To grant that access, attach a role to the user's extension.

:::note
The management portal is the web admin area of your PBX (Private Branch Exchange, the phone system that routes your calls). A role is a named set of permissions. Cloud Voice ships with several built-in roles, and you can also build your own.
:::

## Before you begin

The role you want to assign must already exist. If none of the built-in roles fit your needs, [create a user role](/pbx/administrator-guide/create-a-user-role/) with the exact permissions you want first, then come back to this page.

:::tip
Check the built-in roles before creating a new one. If an existing role already grants the right permissions, you can assign it directly and skip the extra setup.
:::

## Assign the role

1. Sign in to the PBX web portal and open **Extension and Trunk > Extension**.
2. Find the extension in the list and click the edit icon.

   ![Edit icon used to open an extension's settings](/images/pbx/edit.png)
3. On the **User** tab, open the **User Role** drop-down list and choose the role you want to assign.
4. Click **Save**, then **Apply** to put the change into effect.

   :::caution
   The change is not live until you click **Apply**. **Save** only stores it as a pending edit, so if you leave without applying, the user will not receive the new access.
   :::

## What the user sees

If the role carries permissions, the user gains a way into the management portal the next time they sign in to the Cloud Voice App. From there they can open the portal and use only the system features their role allows.

:::note
Two things to keep in mind:

- The new access appears the next time the user signs in, not while they are already signed in.
- A role with no permissions grants no portal access at all. If the user cannot reach the portal, confirm that the assigned role actually has permissions.
:::

![Cloud Voice, the management portal a user can reach after being assigned a role](/images/pbx/access-management-portal.png)