---
title: "User Role Assigned or Removed"
description: "Sent when a role is assigned to or removed from a user. Event ID: vdc.org_v0.user_v0.roleChanged_v0 Event message details: Sent with data.roleChanged.action set to ADDED or REMOVED. Severity: Info Workloads: Control Plane"
canonical: "https://helpcenter.veeam.com/docs/vdc/events/vdc_events_user_role_assigned_or_removed.html"
breadcrumb: "Event Reference > Access and Identity > User Role Assigned or Removed"
dateModified: "2026-11-02"
---

# User Role Assigned or Removed

Sent when a role is assigned to or removed from a user.

## General Information

**Event ID**: `vdc.org_v0.user_v0.roleChanged_v0`

**Event message details**: Sent with `data.roleChanged.action` set to `ADDED` or `REMOVED`.

**Severity**: Info

**Workloads**: Control Plane

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">specversion</span></p>
    </td>
    <td>
      Event schema version.
    </td>
    <td>
      <p><span class="T_Filenames">ev20260814</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">source</span></p>
    </td>
    <td>
      System that sent the event. Possible values: `CONTROLPLANE`, `M365`, `AZURE`.
    </td>
    <td>
      <p><span class="T_Filenames">CONTROLPLANE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">timestamp</span></p>
    </td>
    <td>
      Time when the event happened, in RFC3339Nano format and the UTC time zone.
    </td>
    <td>
      <p><span class="T_Filenames">2026-08-04T09:18:42Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">type</span></p>
    </td>
    <td>
      Event ID.
    </td>
    <td>
      <p><span class="T_Filenames">vdc.org_v0.user_v0.roleChanged_v0</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">severity</span></p>
    </td>
    <td>
      Event severity. Possible values: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </td>
    <td>
      <p><span class="T_Filenames">INFO</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">visibility</span></p>
    </td>
    <td>
      Intended visibility scope of the event. Only events with the `CUSTOMER_ACCESSIBLE` value are forwarded to SIEM platforms, so a forwarded event always carries this value.
    </td>
    <td>
      <p><span class="T_Filenames">CUSTOMER_ACCESSIBLE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">category</span></p>
    </td>
    <td>
      Event category. Possible values: `BACKUP`, `RESTORE`, `LOGIN`, `USER_MANAGEMENT`, `TENANT_MANAGEMENT`, `ORGANIZATION_MANAGEMENT`, `SUBSCRIPTION_MANAGEMENT`, `SECURITY_ALERT`, `INTERNAL`.
    </td>
    <td>
      <p><span class="T_Filenames">USER_MANAGEMENT</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.identifier</span></p>
    </td>
    <td>
      Actor identifier.
    </td>
    <td>
      <p><span class="T_Filenames">admin@bob.networking</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.kind</span></p>
    </td>
    <td>
      Actor type that triggered the event. Possible values: `user`, `system`, `service_account`.
    </td>
    <td>
      <p><span class="T_Filenames">user</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">organizationReference.organizationId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">orgId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.roleChanged.action</span></p>
    </td>
    <td>
      <p>Action performed on the role assignment. Possible values: <code>ADDED</code>, <code>REMOVED</code>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">ADDED</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.roleChanged.roleId</span></p>
    </td>
    <td>
      <p>Role ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">007</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.roleChanged.roleName</span></p>
    </td>
    <td>
      <p>Role name.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Audit Log Read Only</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.user.id</span></p>
    </td>
    <td>
      <p>User ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">user_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.user.primaryEmail</span></p>
    </td>
    <td>
      <p>User primary email address.</p>
    </td>
    <td>
      <p><span class="T_Filenames">alice@bob.networking</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.org.id</span></p>
    </td>
    <td>
      <p>ID of the Veeam Data Cloud organization.</p>
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.org.name</span></p>
    </td>
    <td>
      <p>Name of the Veeam Data Cloud organization.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Alice and Bob's Networking</span></p>
    </td>
  </tr>
</table>

## Event Example

### User Role Assigned

```json
{
  "specversion": "ev20260814",
  "source": "CONTROLPLANE",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.org_v0.user_v0.roleChanged_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "USER_MANAGEMENT",
  "actor": {
    "identifier": "admin@bob.networking",
    "kind": "user"
  },
  "organizationReference": {
    "organizationId": "org_12345"
  },
  "orgId": "org_12345",
  "data": {
    "roleChanged": {
      "action": "ADDED",
      "roleId": "007",
      "roleName": "Audit Log Read Only"
    },
    "user": {
      "id": "user_12345",
      "primaryEmail": "alice@bob.networking"
    },
    "org": {
      "id": "org_12345",
      "name": "Alice and Bob's Networking"
    }
  }
}
```

### User Role Removed

```json
{
  "specversion": "ev20260814",
  "source": "CONTROLPLANE",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.org_v0.user_v0.roleChanged_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "USER_MANAGEMENT",
  "actor": {
    "identifier": "admin@bob.networking",
    "kind": "user"
  },
  "organizationReference": {
    "organizationId": "org_12345"
  },
  "orgId": "org_12345",
  "data": {
    "roleChanged": {
      "action": "REMOVED",
      "roleId": "007",
      "roleName": "Audit Log Read Only"
    },
    "user": {
      "id": "user_12345",
      "primaryEmail": "alice@bob.networking"
    },
    "org": {
      "id": "org_12345",
      "name": "Alice and Bob's Networking"
    }
  }
}
```