Change the Scope of an Administrative Role

Document created by RSA Information Design and Development Employee on Jun 13, 2017Last modified by RSA Information Design and Development Employee on Jul 27, 2020
Version 14Show Document
  • View in full screen mode

The scope of an administrative role determines which security domains and identity sources an administrator can manage. You can only modify the scope of a role that has the same or narrower scope as the role assigned to you.

If you change the scope, so that it does not include the entire deployment and only includes lower-level security domains, when you assign permissions to the role, you cannot grant any system-level permissions to the role, such as logging configuration. You cannot edit the Super Admin role.


  1. In the Security Console, click Administration > Administrative Roles > Manage Existing.

  2. Click the administrative role that you want to edit, and select Edit.

  3. In the Security Domain Scope tree, select the security domains in which the new role grants permissions.

    The security domain scope determines where an administrator assigned this role has administrative permissions. When a role grants permissions in a security domain, permissions are also granted in each of its lower-level security domains in the security domain hierarchy.

  4. In the Identity Source Scope field, select the identity sources where you want this role to grant permissions.

  5. Click Save and Finish.




You are here
Table of Contents > Administrative Roles > Change the Scope of an Administrative Role