topic Re: Permissions for creating and editing synthetic monitoring in Synthetic Monitoring

Permissions for creating and editing synthetic monitoring

Ilya7 — Thu, 22 Dec 2022 11:12:22 GMT

Hello,

we would like to give permission for making and editing synthetic monitors to a specific user group for the whole environment.

As far as I'm concerned there is no way to give permission for creating/editing synthetic monitorings without checking "change monitoring settings" for the whole environment or management-zone.

Am I overlooking something? If not will there be a way (i.e. through a schemaId) to give editing permissions for synthetics in the future?

Best regards,
Ilya

Re: Permissions for creating and editing synthetic monitoring

AurelienGravier — Wed, 21 Dec 2022 14:07:44 GMT

Hello @Ilya7 ,

IAM policies is what you need ! You can configure custom IAM through the Dynatrace web UI or REST API :

https://www.dynatrace.com/support/help/shortlink/iam#how-to-configure-iam

Some examples of IAM policies here :

https://www.dynatrace.com/support/help/shortlink/iam-policystatement-syntax

And the list of REST API calls is available here :

https://api.dynatrace.com/spec/#/Policy%20management

Regards Aurélien.

Re: Permissions for creating and editing synthetic monitoring

Ilya7 — Wed, 21 Dec 2022 14:28:00 GMT

Hello @AurelienGravier,

thanks for your response.

I was looking into IAM policies but couldn't find a fitting policy. At first I thought I can go with https://www.dynatrace.com/support/help/shortlink/iam-policystatements#settings-objects-write but the synthetic tab doesn't seem to have a schemaId.

This one might be fitting, I'm not sure though: https://www.dynatrace.com/support/help/shortlink/iam-policystatements#environment-roles-configure-request-capture-data.

Please let me know if you know the right way of doing this.

Best regards,
Ilya

Re: Permissions for creating and editing synthetic monitoring

AurelienGravier — Wed, 21 Dec 2022 15:19:17 GMT

First of all, I have extracted the list of available schemas through the Environment API V2 :

https://{environmentid}.live.dynatrace.com/rest-api-doc/index.jsp#/Settings%20-%20Schemas/getAvailableSchemaDefinitions

And I select on the response a schemaID related to the synthetic feature:

{
"schemaId": "builtin:synthetic.browser.name",
"displayName": "Monitor name",
"latestSchemaVersion": "1.0.1"
},

Afterwards, I use this schemaId as parameter in the following endpoint : /settings/schemas/{schemaId}

https://{environmentid}.live.dynatrace.com/rest-api-doc/index.jsp#/Settings%20-%20Schemas/getSchemaDefinition

{
"dynatrace": "1",
"schemaId": "builtin:synthetic.browser.name",
"displayName": "Monitor name",
"description": "Define the display name of your browser monitor",
"documentation": "",
"schemaGroups": [
"group:synthetic.browser"
],

And a schemaGroups exists "group:synthetic.browser" on the response.

So I suppose that you can use it in your custom IAM :

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaGroups = "group:synthetic.browser"

Let me know if it works.

Re: Permissions for creating and editing synthetic monitoring

AurelienGravier — Wed, 28 Dec 2022 08:38:13 GMT

Hello @Ilya7

The synthetic monitors configuration is only partially migrated to settings 2.0, so the permissions regarding creation of the monitors (browser and HTTP) are still not available. I have created the following RFE : https://community.dynatrace.com/t5/Dynatrace-product-ideas/IAM-policy-gt-the-settings-schemaId-related-to-synthetic-monitor/idi-p/201143 I suggest you voting on it to help.

Instead, I have found the way to give permissions on existing synthetic monitors and on settings related to synthetic monitoring :

1st, create your custom policy with the statements below :

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:synthetic.browser.name","builtin:synthetic.browser.scheduling","builtin:synthetic.http.name","builtin:synthetic.synthetic-availability-settings","builtin:synthetic.synthetic-availability-settings","builtin:synthetic.browser.outage-handling","builtin:synthetic.http.scheduling","builtin:synthetic.browser.assigned-applications","builtin:synthetic.http.performance-thresholds","builtin:synthetic.browser.kpms","builtin:synthetic.http.assigned-applications","builtin:synthetic.http.outage-handling","builtin:synthetic.http.cookies","builtin:synthetic.browser.performance-thresholds");

2nd, create a new group and bind it the previous policy :

3rd add a use as member of this group.

The user will have the rights to edit each monitors and a limited acces on settings menu :

Regards Aurélien.

Re: Permissions for creating and editing synthetic monitoring

Ilya7 — Wed, 28 Dec 2022 09:51:53 GMT

Hello Aurélien,

thanks for your effort!

It's really unfortunate that we can't set permissions to create synthetics. With the current options we can't even allow to edit the recorded clickpath for existing browser monitors.

Thanks for creating the RFE. It's a really important feature in my opinion.

Best regards,
Ilya

Re: Permissions for creating and editing synthetic monitoring

dan_m_smith — Mon, 09 Feb 2026 20:15:58 GMT

Hi @AurelienGravier . Thanks for your help. When I try to add this to my Policy:
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read
WHERE settings:schemaGroups = "group:synthetic.browser";
I get an error when trying to save:

Policy saving failed

Invalid condition name for permission settings:objects:read : settings:schemaGroups Invalid condition name for permission settings:objects:write : settings:schemaGroups Invalid condition name for permission settings:schemas:read : settings:schemaGroups

Re: Permissions for creating and editing synthetic monitoring

dan_m_smith — Mon, 09 Feb 2026 22:32:53 GMT

I tried to post this once, but here it is again:

I added this to my POlicy:
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read
WHERE settings:schemaGroups = "group:synthetic.browser";

But I get an error:

Policy saving failed

Re: Permissions for creating and editing synthetic monitoring

PatrykAdamowicz — Thu, 19 Feb 2026 10:21:01 GMT

Hi @dan_m_smith,

Please use the following statement instead:
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaGroup = "group:synthetic.browser";

The condition supported is settings:schemaGroup (without "s" at the end).
https://docs.dynatrace.com/docs/manage/identity-access-management/permission-management/manage-user-permissions-policies/advanced/iam-policystatements#settings-objects-read

Thanks.

Re: Permissions for creating and editing synthetic monitoring

PatrykAdamowicz — Thu, 19 Feb 2026 10:21:30 GMT

Hi @dan_m_smith,

Please use the following statement instead:
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaGroup = "group:synthetic.browser";

The condition supported is settings:schemaGroup (without "s" at the end).
https://docs.dynatrace.com/docs/manage/identity-access-management/permission-management/manage-user-...

Thanks.