# I want to provide only OneAgent Enable/Disable access to a QA team. They already have Env Read Only access. How this is possible?

**URL:** <https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328>\
**Category:** Open Q&A\
**Tags:** user-management, oneagent\
**Created:** [May 14, 2020, 8:58am UTC](https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328 "2020-05-14T08:58:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![skanchalwar2](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@skanchalwar2](https://community.dynatrace.com/u/skanchalwar2)\
**Post date:** [May 14, 2020, 8:58am UTC](https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328/1 "2020-05-14T08:58:11Z")

</div>

I want to provide only OneAgent Enable/Disable access to a QA team. They already have Env Read Only access. How this is possible?

---

<div class="post-metadata">

**Author:** ![rastislav\_danis](https://avatars.discourse-cdn.com/v4/letter/r/b9bd4f/32.png) [@rastislav\_danis](https://community.dynatrace.com/u/rastislav_danis)\
**Post date:** [May 14, 2020, 9:29am UTC](https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328/2 "2020-05-14T09:29:19Z")

</div>

check this api out, actually it’s not GA

> **[OneAgent monitoring configuration API - PUT configuration](https://docs.dynatrace.com/docs/dynatrace-api/configuration-api/oneagent-configuration/oneagent-on-host/oneagent-monitoring/put-monitoring-configuration)**
>
> Update the monitoring configuration of a OneAgent instance via the Dynatrace API.

---

<div class="post-metadata">

**Author:** ![ChadTurner](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/chadturner/32/161_2.png) [@ChadTurner](https://community.dynatrace.com/u/ChadTurner)\
**Post date:** [May 14, 2020, 12:16pm UTC](https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328/3 "2020-05-14T12:16:27Z")

</div>

If you are a managed user and have AD intrgrated, its quite simple as you can assign them AD groups and roles which will allow certain people to have certain accesses. SaaS customers, its going to be a tad bit harder as youll need saml for AD integration

---

<div class="post-metadata">

**Author:** ![JamesKitson](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/jameskitson/32/22460_2.png) [@JamesKitson](https://community.dynatrace.com/u/JamesKitson)\
**Post date:** [May 14, 2020, 3:37pm UTC](https://community.dynatrace.com/t/i-want-to-provide-only-oneagent-enable-disable-access-to-a-qa-team-they-already-have-env-read-only-access-how-this-is-possible/19328/4 "2020-05-14T15:37:11Z")

</div>

For the specific question though, right now you wouldn’t be able to do this purely through permissions. Disabling an agent through the UI is considered to be changing monitoring settings so the users would need that level of permissions.

The closest you can likely get at this time is to define management zones that _only_ have the desired host entities in scope. Then you can create a group with change monitoring settings permissions that only has that management zone in scope. Then those users could disable monitoring through the UI by navigating to the settings page for individual hosts. This would also allow them to make any of the changes displayed in that page.

 ![24997-1589470606257.png](https://global.discourse-cdn.com/dynatrace/original/3X/e/8/e8599543555d960b22acf86b2afb3d664ac6133f.png)