All XenServer users must have an RBAC role. When new users are added, they are automatically assigned the Pool Administrator role. In XenServer Enterprise and higher, when you add new users, XenServer does not assign newly added user accounts roles automatically. You must assign roles to new accounts separately.
Before you can assign a role to a user or group, you must add the user or group's Active Directory account to XenServer after joining the associated domain as described in Join a domain and add RBAC users.
You can assign a user a different role by one of the following methods:
If, on separate occasions, an administrator indirectly applies multiple roles to a user (for example, by the user being a member of multiple groups), XenServer grants the user the permissions from the highest role to which he or she was assigned.