Deep-dive on the Next Gen Platform. Join the Webinar!

Skip Navigation
Show nav
Dev Center
  • Get Started
  • Documentation
  • Changelog
  • Search
  • Get Started
    • Node.js
    • Ruby on Rails
    • Ruby
    • Python
    • Java
    • PHP
    • Go
    • Scala
    • Clojure
    • .NET
  • Documentation
  • Changelog
  • More
    Additional Resources
    • Home
    • Elements
    • Products
    • Pricing
    • Careers
    • Help
    • Status
    • Events
    • Podcasts
    • Compliance Center
    Heroku Blog

    Heroku Blog

    Find out what's new with Heroku on our blog.

    Visit Blog
  • Log inorSign up
Hide categories

Categories

  • Heroku Architecture
    • Compute (Dynos)
      • Dyno Management
      • Dyno Concepts
      • Dyno Behavior
      • Dyno Reference
      • Dyno Troubleshooting
    • Stacks (operating system images)
    • Networking & DNS
    • Platform Policies
    • Platform Principles
  • Developer Tools
    • Command Line
    • Heroku VS Code Extension
  • Deployment
    • Deploying with Git
    • Deploying with Docker
    • Deployment Integrations
  • Continuous Delivery & Integration (Heroku Flow)
    • Continuous Integration
  • Language Support
    • Node.js
      • Working with Node.js
      • Troubleshooting Node.js Apps
      • Node.js Behavior in Heroku
    • Ruby
      • Rails Support
      • Working with Bundler
      • Working with Ruby
      • Ruby Behavior in Heroku
      • Troubleshooting Ruby Apps
    • Python
      • Working with Python
      • Background Jobs in Python
      • Python Behavior in Heroku
      • Working with Django
    • Java
      • Java Behavior in Heroku
      • Working with Java
      • Working with Maven
      • Working with Spring Boot
      • Troubleshooting Java Apps
    • PHP
      • PHP Behavior in Heroku
      • Working with PHP
    • Go
      • Go Dependency Management
    • Scala
    • Clojure
    • .NET
      • Working with .NET
  • Databases & Data Management
    • Heroku Postgres
      • Postgres Basics
      • Postgres Getting Started
      • Postgres Performance
      • Postgres Data Transfer & Preservation
      • Postgres Availability
      • Postgres Special Topics
      • Migrating to Heroku Postgres
    • Heroku Key-Value Store
    • Apache Kafka on Heroku
    • Other Data Stores
  • AI
    • Working with AI
  • Monitoring & Metrics
    • Logging
  • App Performance
  • Add-ons
    • All Add-ons
  • Collaboration
  • Security
    • App Security
    • Identities & Authentication
      • Single Sign-on (SSO)
    • Private Spaces
      • Infrastructure Networking
    • Compliance
  • Heroku Enterprise
    • Enterprise Accounts
    • Enterprise Teams
    • Heroku Connect (Salesforce sync)
      • Heroku Connect Administration
      • Heroku Connect Reference
      • Heroku Connect Troubleshooting
  • Patterns & Best Practices
  • Extending Heroku
    • Platform API
    • App Webhooks
    • Heroku Labs
    • Building Add-ons
      • Add-on Development Tasks
      • Add-on APIs
      • Add-on Guidelines & Requirements
    • Building CLI Plugins
    • Developing Buildpacks
    • Dev Center
  • Accounts & Billing
  • Troubleshooting & Support
  • Integrating with Salesforce
  • Heroku Enterprise
  • Enterprise Teams
  • Using App Permissions in Enterprise Teams

Using App Permissions in Enterprise Teams

English — 日本語に切り替える

Last updated January 27, 2022

Table of Contents

  • Viewing and setting app permissions
  • Adding and removing team apps

This feature is currently available in Heroku Enterprise.

Enterprise Team app permissions enable you to grant fine-grained permissions to team members on a per-app basis, ensuring that the right people have access to the right operations and resources.

App permissions provide access controls for:

  • Guarding and monitoring changes to production apps
  • Restricting which changes can be made to an app
  • Managing the types of resources that users can access

Viewing and setting app permissions

You can view and set user-specific permissions for a given app from the app’s Access tab:

App access page

By default, all team members have the view permission for all of the team’s apps. This permission allows team members to:

  • See basic information about the app
  • View the app’s Access tab, which displays app members and their respective permissions
  • View application activity, including builds and releases
  • See dynos and information about an app’s processes

In addition to the view permission, you can assign any combination of the following permissions to team members from the app’s Access tab:

  • deploy
  • operate
  • manage

You can also set app permissions with the heroku access set of CLI commands.

To set app permissions, you must either:

  • Already have the manage permission for the app
  • Have the admin role for your team

Team members with the admin role always have all permissions for all of the team’s apps. Learn more about Enterprise Team roles.

A complete list of the actions enabled by each app permission is available here. The following subsections provide high-level summaries of these actions.

The deploy permission

The deploy permission gives access to the application’s code and allows team members to:

  • Fetch code
  • Push code
  • View and edit config vars
  • Add and remove free add-ons
  • Run one-off dynos
  • Roll back releases

The operate permission

The operate permission gives access to the operational aspects of an application’s availability and resource consumption. It allows team members to:

  • View and edit config vars
  • Add and remove free and paid add-ons
  • Run one-off dynos
  • Manage add-on configurations
  • Restart the app
  • Roll back releases
  • Manage process scaling and stacks

The manage permission

The manage permission enables team members to control access to the application:

  • Add users to the app
  • Assign or edit permissions for any user on the app
  • Restrict access to the app
  • Rename or delete the app
  • Transfer the app
  • Manage custom domains

Adding and removing team apps

When a team member adds a new app or transfers an existing app into the team, they automatically receive all permissions for that app. Because this includes the manage permission, the team member can then add other members to the app and assign them the appropriate combination of permissions.

Apps belonging to a team can only be removed from the team (or deleted) by:

  • Team members with the manage permission for the app
  • Team members with the admin permission for the team

Keep reading

  • Enterprise Teams

Feedback

Log in to submit feedback.

Information & Support

  • Getting Started
  • Documentation
  • Changelog
  • Compliance Center
  • Training & Education
  • Blog
  • Support Channels
  • Status

Language Reference

  • Node.js
  • Ruby
  • Java
  • PHP
  • Python
  • Go
  • Scala
  • Clojure
  • .NET

Other Resources

  • Careers
  • Elements
  • Products
  • Pricing
  • RSS
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku Blog
    • Heroku News Blog
    • Heroku Engineering Blog
  • Twitter
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku
    • Heroku Status
  • Github
  • LinkedIn
  • © 2025 Salesforce, Inc. All rights reserved. Various trademarks held by their respective owners. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States
  • heroku.com
  • Legal
  • Terms of Service
  • Privacy Information
  • Responsible Disclosure
  • Trust
  • Contact
  • Cookie Preferences
  • Your Privacy Choices