How do you give someone limited admin access in LastPass without making them a full admin?
LastPass lets you create custom admin levels — roles with specific permissions scoped to exactly what that person needs to manage, nothing more.
What custom admins can do
A custom admin can be granted View or Modify access across six permission categories:
- Adoption Dashboard — track usage metrics across your organization
- Users — manage user accounts, provisioning, and status
- Groups — create and manage user groups
- Directories and federated login — manage directory integrations and SSO
- User-level multifactor authentication — enable, disable, or reset MFA for users
- Reports — access audit logs and activity reports
Each category has separate View and Modify checkboxes, so you can give someone read-only access to Reports while giving them full Modify access to Users — or any other combination your team requires.
How to create a custom admin level
To create a custom admin level, you must be an admin or super admin with permission to modify admin levels.
- Log in to the new Admin Console.
- Go to Users > Admin levels.
- Click New admin level.
- Name the level and select permissions (View and/or Modify for each category).
- Click Save & assign to add users immediately, or Save & exit to assign users later.
Note: Each user can only hold one admin level at a time. Assigning a new level removes the previous one.
When to use custom admin levels
Custom admin levels work well for three common scenarios:
- Delegating specific tasks — give your IT helpdesk user management access without granting report or policy access
- Temporary access — create a level for a one-time task, then delete it when the work is done
- Audit and compliance — give auditors read-only Reports access with no modify permissions attached
For the full breakdown of every available permission and what View vs. Modify enables for each category, see Custom admin permissions in LastPass — the article covers each permission in detail so you can configure exactly the right access before you assign anyone.
Key Takeaways
- LastPass custom admin levels let you assign scoped permissions without granting full admin rights.
- Six permission categories are available: Adoption Dashboard, Users, Groups, Directories and federated login, User-level MFA, and Reports.
- Each permission category has separate View and Modify options, giving you granular control over what each admin can see or change.
- Each user can only hold one admin level at a time — assigning a new level replaces the previous one.
- Custom admin levels can be created for temporary tasks and deleted once the work is complete.
Join our growing community of readers. Click Follow on the right to receive weekly security updates, insights, and resources.