Change the Scope of an Administrative Role

The scope of an administrative role determines which security domains and identity sources an administrator can manage. You can only modify the scope of a role that has the same or narrower scope as the role assigned to you.

If you change the scope, so that it does not include the entire deployment and only includes lower-level security domains, when you assign permissions to the role, you cannot grant any system-level permissions to the role, such as logging configuration. You cannot edit the Super Admin role.

Procedure 

1. In the Security Console, click Administration > Administrative Roles > Manage Existing.

2. Click the administrative role that you want to edit, and select Edit.

3. In the Security Domain Scope tree, select the security domains in which the new role grants permissions.

   The security domain scope determines where an administrator assigned this role has administrative permissions. When a role grants permissions in a security domain, permissions are also granted in each of its lower-level security domains in the security domain hierarchy.

4. In the Identity Source Scope field, select the identity sources where you want this role to grant permissions.

5. Click Saveand Finish.