• View sign-on policy.

• Edit all configurations in sign-on policy.

  Exception: If the admin does not have the permission for “IP Locations - Full” or “IP Locations - View”, they are not allowed to access sign-on policy.

• View sign-on policy and rules.

  Exception: If the admin does not have the permission for “IP Locations - Full” or “IP Locations - View” they are not allowed to access sign-on policy.

• View password policy.
• Edit all configuration on password policy.
• Edit authentication methods.

• View password policy.
• View all configuration on password policy.
• View authentication methods.
• Not allowed to change any configuration value.

• View users and user groups.
• Add, edit, delete, activate, deactivate user.
• Add, edit, delete group.
• Import group details from a CSV file.
• Change group name, assign users to group.
• Add, edit, delete attribute.

• Access, view, and change security settings (all attributes and settings) only when admins have “Users and Groups - View” or “Users and Groups - Full” permissions.
• Admins without the "Users and Groups -Full" permission cannot change a user's primary and secondary email address even though they are used as credentials..

• View security settings (all attributes and settings) only when admins have “Users and Groups - View” or “Users and Groups - Full” permissions.

• View, add, edit, and delete roles.
• Admins with “Users and Groups - Full or View” permission can add or edit roles.

• View roles.
• View all configuration for roles.

• View external identities (both primary and secondary IdPs).
• Add and edit primary and secondary IdPs.
• Change all configuration per IdP.

• View external identities (both primary and secondary IdPs).
• View all configuration per IdP.

Restricted View

• View external identities (both primary and secondary IdPs).
• View configuration per IdP except for Provisioning > SCIM Provisioning > Bearer Token.

• View IP locations and location groups.
• Add location and location groups, import IP locations and location group details from a CSV file.
• Edit, delete IP locations and IP location groups.
• Change all configuration per IP location and IP location groups.

• View and change session timeout duration.
• View and change authentication session for service enrollment.
• View and change force authentication for private access reauthentication.

• View session timeout duration.
• View authentication session for service enrollment.
• View force authentication for private access reauthentication.

• View and search administrative entitlements.
• Access users and user groups.
• Assign users, user groups.
• Delete user assignments and user group assignments.
• Admin with "Roles - Full" or "Roles - View Only" permission can assign roles

• Access, view, and search administrative entitlements.
• Admin with “Users and Groups - Full” or “Users and Groups - View” permission can access the Users and User Groups tabs of individual tenants.
• View all users and user groups assignments.
• View the user list on the User Groups tab.
• Admin with "Roles -Full" permission can assign roles.
• Admin with "Roles -View Only" permission cannot assign roles.

If admin has permissions in individual tenants to administer administrators, they can:

• Assign users and user groups.
• Remove user assignments and user group assignments.

• View administrative entitlements
• View user and user group assignments

• View service entitlements
• Assign users, user groups, delete user assignments and user group assignments

• View service entitlements
• View user and user group assignments

• Add guest domains
• Edit guest domains
• Delete guest domains

• Enable remote access
• Disable remote access

• Add logo or email
• Edit logo or email

• Add API Clients
• Edit or Delete API Clients
• Manage Resources
• Revoke Access Tokens