You can add users to your Nebula console. You must be an Administrator or Super Admin to add new console users.
User roles are as follows:
- Super Admin: Unrestricted access to the Malwarebytes Nebula platform.
- Administrator: Full read and edit access to any groups they belong to. Administrators cannot adjust syslog logging, or change single sign-on settings.
- Read Only: Read access to any groups they belong to. They can create and generate reports and receive notifications, but cannot make any other system changes.
Note: Read Only users can access sensitive policy data, including Tamper Protection password, with Malwarebytes API's. This can be used to modify the endpoint agent on the machine.
| Super Admin | Administrator* | Read-Only | |
| Create Super Admins | ✓ | -- | -- |
| Create Administrators | ✓ | ✓ | -- |
| Create Read-Only Users | ✓ | ✓ | -- |
| Create and edit Groups | ✓ | ✓ | -- |
| Edit Users | ✓ | -- | -- |
| Deploy Endpoints | ✓ | ✓ | -- |
| Manage Endpoints | ✓ | ✓ | -- |
| Create and edit Policies | ✓ | ✓ | -- |
| Create and edit Exclusions | ✓ | -- | -- |
| Create and edit Scheduled scans | ✓ | ✓ | -- |
| Generate Reports | ✓ | ✓ | ✓ |
| Create Notifications | ✓ | ✓ | ✓ |
| Receive Notifications | ✓ | ✓ | ✓ |
| Create Support ticket | ✓ | ✓ | -- |
*=Applies only to assigned Groups
User role access for Malwarebytes Endpoint Detection and Response (EDR) features
The following table shows which User roles have visibility to Malwarebytes Endpoint Detection and Response features and settings in Nebula. Active Response Shell must be enabled by a Nebula Account Owner to provide access to a Super Admin. 
| Super Admin | Administrator* | Read Only | |
| Modify EDR Policy Settings | ✓** | ✓ | -- |
| Suspicious Activity Remediation | ✓** | ✓ | -- |
| Ransomware Rollback | ✓ | ✓ | -- |
| Close Suspicious Activity Incidents | ✓ | ✓ | -- |
| View Suspicious Activity | ✓ | ✓ | ✓ |
| View EDR Policy Settings | ✓ | ✓ | ✓ |
| Flight Recorder Search | ✓ | ✓ | ✓ |
*=Applies only to assigned Groups.
**=Active Response Shell permission must be set on each Super Admin so they can edit the policy settings and launch the command shell.
Add a new user
- On the left navigation pane, go to Configure > Users.
- In the top-right of the screen, click New.
- Enter the email address for the new user, choose a role, and select groups for them to belong to.
- Click Invite.
The user email must be uniquely registered with Malwarebytes and not currently in use. Creating task-specific emails or '+' plus addressing can act as a unique email for Malwarebytes.
For more information, see:
If you did not receive an invitation email, see Did not receive Malwarebytes Nebula emails.
If the invited user does not create an account within 14 days, the original link stops working. You can resend the invite to the user if needed. Return to this screen, check the email checkbox, and click Resend Invite.
When invited, the user receives an email that prompts them to create a login for their account. After creating their account, they may sign in and use the Malwarebytes Nebula platform.
Note: The initial administrator account is a unique account, and is the account owner. This account cannot be deleted. If you need to change the account owner, please contact Malwarebytes Support.
Delete a user
- On the left navigation pane, go to Configure > Users.
- Select Users. A list of users displays.
- Select a user.
- In the top right, click Delete.
- To delete the user, click Delete on the confirmation window.
Require two-factor authentication
Super Admins can require all users to use two-factor authentication when signing into Nebula. For more information, see Require two-factor authentication in Nebula.
Return to the Malwarebytes Nebula Administrator Guide.