# OPC-UA ReadOnly User Role **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [August 21, 2023, 9:03pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183 "2023-08-21T21:03:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kgoodwin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kgoodwin/32/9734_2.png) [@kgoodwin](https://forum.inductiveautomation.com/u/kgoodwin)\ **Post date:** [August 21, 2023, 9:03pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183/1 "2023-08-21T21:03:14Z")
This has been discussed before but didn't see anything recently. Apparently prior to 8.0 there was an undocumented feature where a role of "ReadOnly" would not allow that OPC-UA user to write to a tag. In 2020 @Kevin.Herron Said: "Tags from configured devices (i.e. tags under the Devices folder) still do not have any access control and likely won’t in the near term." > [@Restrict OPC-UA Clients to Read Only](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/11): > > Those tag security changes landed in an 8.0.x release. What this means is that when accessing Exposed Tags (i.e. tags under the Tag Providers folder, when this feature is enabled) through the server the user the connecting client authenticated with is passed through to the tag system and any security settings on your tags will be applied. The auth profile the server is configured to use and the roles assigned to the user the client authenticates with may start to matter to you. Tags from confi… My questions are: - Do the user roles for the OPC-UA server still do nothing? - Is there another way to enforce readonly access to OPC-UA tags under the `Devices` folder? I have an application where I would like to read tags from a device in the OPC-UA server but have no need or desire for the application to be able to write to the PLC. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 21, 2023, 9:04pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183/2 "2023-08-21T21:04:34Z")
No, won't change until sometime in the Ignition 8.3 series, after OPC UA 1.05 support. ---
**Author:** ![kgoodwin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kgoodwin/32/9734_2.png) [@kgoodwin](https://forum.inductiveautomation.com/u/kgoodwin)\ **Post date:** [August 21, 2023, 9:08pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183/3 "2023-08-21T21:08:33Z")
That makes me sad, but thanks for the info. ---
**Author:** ![msteele](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/msteele/32/77889_2.png) [@msteele](https://forum.inductiveautomation.com/u/msteele)\ **Post date:** [March 29, 2024, 5:41pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183/4 "2024-03-29T17:41:40Z")
Is there still a possibility or expectation that we'll have role-based OPC-UA connectivity in ver. 8.3? Similarly, would there ever be a way to filter access to specific parts of the hierarchy such as tag providers, folders, etc? Trying to figure out if it makes sense to keep hacking our way through third-party OPC-UA support until we get to 8.3, or pick up another piece of software as an intermediary between Ignition's OPC-UA server and other clients/offtakers. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 29, 2024, 5:58pm UTC](https://forum.inductiveautomation.com/t/opc-ua-readonly-user-role/78183/5 "2024-03-29T17:58:56Z")
I'm actually working on implementing OPC UA Roles and Permissions in both the Milo SDK and Ignition right now. The granularity is only going to be per-device and per-provider though, at least for the initial release of the feature. That is, for any device, or any tag provider, you'll be able to configure whether a role has access to Browse, Read, Write, or Call methods within that device or provider.