Observability Cloud feature access requires UPDATE_CONFIG capability

Applicability

Description

A custom role was created and assigned to an affected user for new Observability Cloud capabilities. The user still could not access the related new features after logging out, logging back in, and clearing cache.

Sample capabilities assigned to the custom role:

• o11y_create_business_transaction_config
• o11y_create_endpoint_config
• o11y_create_global_data_link

The reported goal was to use these capabilities within Splunk Observability Cloud.

Investigation

Confirm that the affected user has the expected Observability Cloud capabilities assigned through the custom role.

An organisation member API check showed that the listed capabilities were assigned to the affected user.

API endpoint format used for validation:

https://[HOST]/v2/organization/member/xxx

Resolution

1. Add the UPDATE_CONFIG capability to the same custom role.
2. Ensure the custom role still includes the required Observability Cloud capabilities.
3. Confirm that the affected user can access the required Observability Cloud configuration features.

The UPDATE_CONFIG capability is required for creating endpoint rules and other configuration.