Restricting token assignment between Security Domains

[DavidStreeter]

Good afternoon,

Is it possible to restrict token assignment between Security Domains?

IE: User1 belongs to Security Domain1 and therefore can not be assigned a token from Security Domain2.

Thanks!

[StevenSpicer · Accepted solution]

You can scope the admin roles to specific Security Domains.  Don't get too granular, though, or you'll wind up with many, many roles to maintain. 

The HDAP (Help Desk Admin Portal) component of SecurID Access Prime can be be configured to do this automatically, so that HDAP admins only see users and tokens in the same Security Domain as the admin.

[DavidStreeter]

Thank you for the reply.

Is there an article that goes more in-depth in regards to using an administrative role to restrict the assignment of tokens outside of their designated security domain? 

We have a centralized help desk, so admins handle both users from SecurityDomain1 and SecurityDomain2. Will these admins require separate administrative accounts (within SecurityDomain1/SecurityDomain2) in order to enforce this restriction of assignment between the two security domains and maintain the ability to administrate within both security domains?