---
title: "IBM MQ - Permissions"
slug: "ibm-mq-permissions"
updated: 2025-01-01T07:47:15Z
published: 2025-01-01T07:47:15Z
canonical: "docs.biztalk360.com/ibm-mq-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.biztalk360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM MQ - Permissions

Before configuring the IBM MQ monitoring in BizTalk360, please follow the below mentioned instructions to ensure that the necessary permissions are in place for smooth functioning.

| **Areas/Components** | **Permissions / Requirements** |
| --- | --- |
| Users and Groups | - Create **MUSR_MQADMIN** and **BizTalk service accounts** in the Active Directory at the Domain machine. - Associate the MUSR_ADMIN and user accounts which is used during installation to **mqm** group - **In the IBM MQ Installation machine,** Map the user MUSR_MQADMIN and BizTalk360 service account in the mqm group. ![](https://cdn.document360.io/253f6006-3994-42d0-98cd-fdc637f51791/Images/Documentation/image-1722426974347.png) |
| Queue manager | Use the below commands to update object authorization of Queue Manager and its queues. - setmqaut -m <queueManagerName> -t queue -n <queueName> -g mqm +set - setmqaut -m <queueManagerName> -t queue -n <queueName> -g mqm +inq ![](https://cdn.document360.io/253f6006-3994-42d0-98cd-fdc637f51791/Images/Documentation/image-1722426888344.png) References: [https://www.ibm.com/docs/en/ibm-mq/9.0?topic=reference-dspmqaut-display-object-authorization](https://www.ibm.com/docs/en/ibm-mq/9.0?topic=reference-dspmqaut-display-object-authorization) |

**Note:**

- Start an MQ Explorer as an Administrator
- QM's Listener must be started for connection.
- Check the block user list in the Queue Manager -> Channels-> Channel Authentication Records. Delete the Record if UserList has the MQADMIN . This might help to resolve the Error (2033 – MQRC_NO_MSG_AVAILABLE , 2035 – MQRC_NOT_AUTHORIZED ,2538 – MQRC_HOST_NOT_AVAILABLE , 2540 - MQRC_UNKNOWN_CHANNEL_NAME)

![](https://cdn.document360.io/253f6006-3994-42d0-98cd-fdc637f51791/Images/Documentation/image-1722426943782.png)

## MQ-admin Override default rule

**IBM has suggested the following steps to override this default rule for a particular MQ-admin user:**

- In the MQ Server machine, Open command prompt in administrator mode
- Enter the following command to connect to the respective Queue Manager ( Replace YourQueueManagerName with your actual Queue manager name)

```shell
runmqsc YourQueueManagerName
```

- Create a new dedicated server connection channel (E.g. BizTalk360.Channel) for overriding purpose:

```shell
DEFINE CHANNEL ('BIZTALK360.CHANNEL') CHLTYPE (SVRCONN) TRPTYPE (TCP)
```

- Create a rule to Block all access on this channel:

```shell
SET CHLAUTH ('BIZTALK360.CHANNEL') TYPE(ADDRESSMAP) DESCR('Block all access to this channel') ADDRESS('*') USERSRC(NOACCESS)
```

- Create a rule to Override the default block access of *MQADMIN:

```shell
SET CHLAUTH('BIZTALK360.CHANNEL') TYPE(BLOCKUSER) DESCR('Rule to override *MQADMIN block user on this channel') USERLIST('nobody') ACTION(replace)
```

- Create a rule to Allow particular user to access the new channel ( Replace YourUserName with your actual username for which the access is to be given)

```shell
SET CHLAUTH('BIZTALK360.CHANNEL') TYPE(USERMAP) CLNTUSER('YourUserName') USERSRC(MAP) MCAUSER('YourUserName') DESCR('Allow BizTalk360 Account to access the channel') ACTION(ADD)
```