Support access

Reproducing a user-specific problem — a permissions gap, missing data, a UI issue only one person sees — usually means seeing Lightdash as that user. Impersonation does that without needing their credentials. There are two separate consents: your own organization admins impersonating your users, and the Lightdash support team impersonating them. Each is controlled independently, and both are off until someone turns them on.

​

How impersonation works

When a user is impersonated:

• The impersonator sees Lightdash exactly as that user sees it, including their permissions, spaces, and data access.
• A banner appears at the top of the screen indicating an impersonation session is active.
• Each session has a hard limit of 15 minutes, after which it ends automatically.
• The impersonator can stop at any time from the banner.

Every impersonation session is audit-logged and time-limited: Lightdash records when the session starts and ends, and each request made during it carries both the impersonating user’s userUuid and the impersonated user’s userUuid. If the project requires users to provide their own personal warehouse credentials, queries run with the impersonated user’s credentials, including SSO-backed credentials.

​

Impersonation by your admins

Organization admins can impersonate other users, and only users inside their own organization. A custom role at the organization level can grant the same ability with the impersonate:User scope, together with manage:OrganizationMemberProfile so the user can open Users & groups to pick someone. Once the feature is available, an organization admin goes to Settings → General (under Organization settings) and turns on Enable user impersonation in the User impersonation section. Turn it off there at any time. Self-hosted instances turn on the feature flag themselves:

1. Add user-impersonation to the LIGHTDASH_ENABLE_FEATURE_FLAGS environment variable. The value is a comma-separated list of flag IDs, so if you already set it, append the ID, for example LIGHTDASH_ENABLE_FEATURE_FLAGS=embedding,user-impersonation. See feature flags.
2. Restart Lightdash so the new value takes effect.

An organization admin then enables impersonation in the organization settings, as described above. If the User impersonation section doesn’t appear, reload the page: a tab opened before the restart keeps the old flag value.

​

Starting a session

You can only impersonate a user who has accepted their invite and signed in at least once. For a pending user, the … menu shows Send new invite (or Get new link) instead of Impersonate user.

1. Go to Settings → Users & groups (User management when groups aren’t enabled).
2. Find the user you want to impersonate.
3. Click the … menu next to their name.
4. Select Impersonate user.

You switch immediately to viewing Lightdash as that user, with a banner showing the active session.

​

Stopping a session

Click Stop impersonating in the banner to return to your normal admin view.

​

Impersonation by the Lightdash support team

Lightdash support access is an organization-wide consent toggle, off by default. Until an admin opts in, the support team cannot impersonate anyone in your organization. Turn it on when you have an open support ticket and need the team to reproduce a user-specific issue without granting consent each time they investigate. Turn it off once the issue is resolved. When it is on, support impersonation follows the same mechanics described above. Only organization admins can change the setting.

​

Enabling support access

1. Go to Settings → General.
2. Find the Lightdash support access card.
3. Switch Allow Lightdash support to impersonate users on.

The setting saves immediately. Flip the same switch off to revoke access.