# Anonymous Access

Unauthenticated users who access the User Interface (UI) or download components are treated as anonymous users.

**Tip**  
Before you configure the anonymous user profile and role, read [Access Control Best Practices](https://help.sonatype.com/en/administration-best-practices.html#access-control-162206 "Access Control").

## Enable or Disable Anonymous Access

**Note**  
You need `nx-settings` read and update privileges to view and change the _Anonymous Access_ in Sonatype Nexus Repository settings.

To enable or disable the anonymous access, take the following steps:

1. Go to _Settings_→ _Security_→ _Anonymous Access_.
2. To enable anonymous access, select the _Allow anonymous users to access the server_ checkbox. To disable it, clear the checkbox.
3. (Optional) Set a name for the anonymous user profile in the _Username_ field.
4. Choose a security realm for the anonymous user under _Realm_dropdown list.

**About Realms**  
Realms specify where a user is defined. For example, use _LDAP Realm_ if you have a guest account in your LDAP system and want to use that account and its permissions. Do not use a format specific realm for anonymous users.

## Permissions for Anonymous Users

When anonymous access is enabled, any user accessing the UI or attempting to download components will be granted the anonymous user's permissions. By default, the anonymous user is assigned with `nx-anonymous` role, which has the following privileges:

- `nx-healthcheck-read`: Read permissions for Health Check  
- `nx-search-read`: Read permissions for search  
- `nx-repository-view-*-*-read`: Read permissions for repositories of all formats  
- `nx-repository-view-*-*-browse`: Browse permissions for repositories of all formats

The default anonymous role is read only. To change the privileges assigned to the anonymous user, create a new role and assign it to the user.

**Note for Docker Repositories**  
Global Anonymous Access controls most of the anonymous actions across formats. Along with Anonymous Access, Docker pulls also require enabling a repository-level setting on each Docker repository. For more details, refer to [Docker Authentication](https://help.sonatype.com/en/docker-authentication.html "Docker Authentication").