Skip to content

Datadog access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Datadog, Black Cat runs 20 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Datadog connector needs.

Checks (20)

severity: high SSO Disabled fix difficulty: medium #

Enable SAML SSO in Datadog organization settings

  1. Navigate to Organization Settings > Login Methods
  2. Click the SAML tab
  3. Toggle "Enable SAML" to on
  4. Upload your IdP metadata XML or enter the IdP SSO URL and certificate
  5. Save the configuration and verify the IdP connection is active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SSO Not Enforced fix difficulty: medium #

Enable SAML strict mode to require SSO for all users

  1. Navigate to Organization Settings > Login Methods
  2. Click the SAML tab
  3. Ensure SAML is already enabled and configured with a valid IdP
  4. Enable "SAML Strict" mode to prevent username/password login
  5. Save the configuration
  6. Notify all users that SSO is now required for login

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Admin Redundancy fix difficulty: easy #

Assign the Datadog Admin role to at least two users for redundancy

  1. Navigate to Organization Settings > Users
  2. Identify users who should serve as backup administrators
  3. Click the user's name to open their profile
  4. Under Roles, add the Datadog Admin role
  5. Save and verify the user now appears with the Admin role
  6. Repeat for any additional backup administrators required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Admins fix difficulty: easy #

Reduce the number of admin users to limit blast radius of compromised accounts

  1. Navigate to Organization Settings > Users
  2. Filter users by the Datadog Admin role
  3. Review each admin's business justification for that level of access
  4. For users who do not require full admin, click their name and edit their roles
  5. Remove the Datadog Admin role and assign a least-privilege role (e.g., Standard or Read-Only)
  6. Save changes and notify the affected users

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high External Admin fix difficulty: easy #

Remove admin privileges from users outside the organization's email domain

  1. Navigate to Organization Settings > Users
  2. Filter or sort users to identify those with email addresses outside the corporate domain
  3. Review each external admin's role and business justification
  4. Click the user's name and edit their roles to remove the Datadog Admin role
  5. If the external user no longer requires access, disable or delete the account
  6. Save changes and document the decision

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Unverified User fix difficulty: easy #

Ensure all active users have completed email verification or re-send the invitation

  1. Navigate to Organization Settings > Users
  2. Identify users shown as pending or unverified
  3. Confirm the user's email address is correct
  4. Click the user's name and select "Resend Invite" to trigger a new verification email
  5. If the user is no longer expected to join, delete the pending invitation
  6. Follow up with the user to confirm they have completed verification

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Disabled User Present fix difficulty: easy #

Remove disabled users from the organization directory to reduce attack surface

  1. Navigate to Organization Settings > Users
  2. Filter or search for disabled users
  3. Review each disabled account to confirm it is no longer needed
  4. Click the user's name and select "Delete User" to permanently remove them
  5. Revoke any API or application keys associated with the deleted user
  6. Document the offboarding action in your access review records

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low External User Access fix difficulty: easy #

Review and justify external user accounts or remove those no longer required

  1. Navigate to Organization Settings > Users
  2. Identify users whose email domain differs from the corporate domain
  3. Review each external user's role, last login date, and business justification
  4. For users who no longer require access, click their name and select "Delete User"
  5. For retained external users, ensure they are assigned the minimum required role (Read-Only or Standard)
  6. Document the review outcome and schedule a recurring access review for external accounts

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Dashboard Permissions Open fix difficulty: easy #

Restrict dashboard access by limiting edit permissions to specific roles

  1. Open the flagged dashboard in Datadog
  2. Click the Settings (gear) icon in the top-right corner of the dashboard
  3. Navigate to the Permissions section
  4. Change the edit permission from "Everyone" to specific roles or teams
  5. Optionally restrict view access as well if the dashboard contains sensitive data
  6. Save the updated permissions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Dashboard Read-Only Without Role Restriction fix difficulty: easy #

Add role-based restrictions to read-only dashboards that may contain sensitive data

  1. Open the flagged dashboard in Datadog
  2. Click the Settings (gear) icon in the top-right corner of the dashboard
  3. Navigate to the Permissions section
  4. Under viewer access, change the setting from "Everyone" to specific roles or teams
  5. Select the appropriate roles that should be permitted to view this dashboard
  6. Save the updated permissions and verify access with a test account if possible

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high External Admin Service Account fix difficulty: medium #

Remove admin privileges from service accounts with external email domains

  1. Navigate to Organization Settings > Service Accounts
  2. Identify service accounts whose email address is outside the corporate domain
  3. Click the service account name to open its detail page
  4. Edit the roles to remove the Datadog Admin role
  5. If the service account is no longer needed, disable or delete it
  6. Rotate any API or application keys associated with the account if compromise is suspected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Service Account Admin Privileges fix difficulty: medium #

Remove admin privileges from service accounts and assign a least-privilege role

  1. Navigate to Organization Settings > Service Accounts
  2. Click the flagged service account name to open its detail page
  3. Review which integrations or pipelines use this service account
  4. Edit the roles to remove the Datadog Admin role
  5. Assign the minimum role required for the service account's function (e.g., Standard or a custom scoped role)
  6. Rotate the service account's API keys to ensure no active sessions carry the old permissions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Service Account Custom Role fix difficulty: medium #

Review service account custom roles and replace with least-privilege built-in roles where possible

  1. Navigate to Organization Settings > Service Accounts
  2. Identify service accounts assigned custom roles
  3. Click the service account name to review the permissions granted by the custom role
  4. Determine whether a built-in role (Standard, Read-Only) would satisfy the service account's requirements
  5. Edit the service account roles to replace the custom role with the appropriate built-in role
  6. If a custom role is required, audit the permissions to remove any that are not needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Application Key Write Scopes fix difficulty: medium #

Restrict application key scopes to read-only permissions where write access is not required

  1. Navigate to Organization Settings > Application Keys
  2. Identify application keys with write-level scopes
  3. Click the application key name to view its current scopes
  4. Assess whether each write scope is actively needed by the integration or script using the key
  5. Edit the key to remove unnecessary write scopes, retaining only the minimum required
  6. Regenerate the key if it may have been exposed or shared

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Application Key Has No Scopes fix difficulty: medium #

Add explicit scopes to application keys to prevent implicit full-permission inheritance from the key owner

  1. Navigate to Organization Settings > Application Keys
  2. Click the flagged application key name to open its settings
  3. Review the key's intended use case and determine the minimum required scopes
  4. Edit the key and add only the scopes that the consuming integration genuinely needs
  5. Save the updated key configuration
  6. Test the integration to confirm it functions correctly with the restricted scopes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium External Service Account fix difficulty: easy #

Review and justify external service accounts or remove those no longer required

  1. Navigate to Organization Settings > Service Accounts
  2. Identify service accounts whose email address is outside the corporate domain
  3. Review each external service account's role and business justification
  4. If no longer needed, disable or delete the service account
  5. Rotate any API or application keys associated with the account

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Admin User Not Verified fix difficulty: easy #

Ensure admin users complete email verification or remove unverified admin accounts

  1. Navigate to Organization Settings > Users
  2. Identify the unverified admin user
  3. Resend the verification email if the user is expected to join
  4. If the user is not recognized, remove their admin role immediately
  5. If the invitation is stale, delete the pending user account

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Disabled Admin User fix difficulty: easy #

Remove the admin role from disabled users or delete the account entirely

  1. Navigate to Organization Settings > Users
  2. Locate the disabled admin user
  3. Remove the Datadog Admin role from the user
  4. If the user is no longer needed, delete the account
  5. Revoke any API or application keys owned by the user

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Application Key Excessive Scopes fix difficulty: medium #

Reduce application key scopes to the minimum required set

  1. Navigate to Organization Settings > Application Keys
  2. Click the flagged application key to view its scopes
  3. Review which scopes are actively used by the consuming integration
  4. Remove unnecessary scopes to reduce the key's blast radius
  5. Save the updated key configuration and test the integration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high API Key Critical Age fix difficulty: medium #

Immediately rotate API keys older than two years

  1. Navigate to Organization Settings > API Keys
  2. Identify the flagged key by name and note which integrations use it
  3. Create a new API key with an appropriate descriptive name
  4. Update all integrations using the old key with the new key value
  5. Verify the new key works in all affected systems
  6. Revoke the old API key immediately

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Datadog checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial