# Set User Privileges via the DCD

By default, only contract administrators and owners can manage the Cloud DNS records and zones using the Cloud DNS API and the DCD.

{% hint style="info" %}
**Prerequisites:**

* To facilitate additional users with privilege to manage the primary and secondary zones and records, the [<mark style="color:blue;">DCD</mark>](https://docs.ionos.com/cloud/support/general-information/glossary-of-terms#data-center-designer-dcd) offers a group privilege called **Access and manage DNS** in the **User Manager**, under the **Privileges** tab. Assigning this privilege to a group grants all users within the group the ability to manage Cloud DNS zones and records via the Cloud DNS API or the DCD.
* Ensure you have one or more **Groups** in the **User Manager**. To create one, see [<mark style="color:blue;">Create a group</mark>](https://docs.ionos.com/sections-test/guides/set-up-ionos-cloud/management/identity-access-management/user-management#create-a-group).
  {% endhint %}

To set user privileges to manage primary and secondary zones and records, follow these steps:

1\. In the **DCD**, go to **Menu** > **Management** > **Users & Groups**. 2. Select the **Groups** tab in the **User Manager** window. 3. Select the target group name from the **Groups** list. 4. Select **Access and manage DNS** in the **Privileges** tab.

![Set privilege](https://1737632334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MifAzdGvKLDTtvJP8sm%2Fuploads%2Fgit-blob-b924a2587d0db836710c87df253d7c11f92d0adb%2Faccess-manage-dns.png?alt=media)

{% hint style="success" %}
\*\*Result:\*\* The privilege is granted to all the members in the selected group.
{% endhint %}

## Revoke user privileges

You can revoke a user's **Access and manage DNS** privilege by removing the user from all the groups that have this privilege enabled.

{% hint style="warning" %}
**Warning:** You can revoke a user from this privilege by disabling **Access and manage DNS** for every group the user belongs to. In this case, all the members in the respective groups would also be revoked from this privilege.
{% endhint %}

To revoke this privilege from a contract administrator, disable the administrator option on the user account. On performing this action, the contract administrator gets the role of a contract user, and the privileges that were set up for the user before being an administrator will then be in effect.