With the changes in IdentityNow to allow the direct assignment of entitlements to Roles, that seems to impact how Role Sub-Admin User level could restrict scope of role management.
“they can create, manage, and edit roles with access profiles only on sources that are associated with the governance groups they are members of”
If we have roles where we want to only use direct addition of entitlements, and no access profiles. What are or will be our options to restrict management of those Roles to specific sets of users? As is a role with no Access Profiles can be modified by any Role sub-admin.
Thank you for bringing this to our attention. It appears that our documentation is out of date with this new change to roles, and we have a ticket (SAASDOCS-6754) to update the docs. In the meantime, here is what the documentation will say regarding this new functionality.
A user with the Role Sub-admin user level has the same permissions for Search and reports as Role Admins. However, they can create, manage, and edit roles with access profiles and entitlements only on sources that are associated with the governance groups they are members of. Role Sub-admins can also view and work with roles that do not have access profiles or entitlements.
I opened a support case on this as well, and still waiting for validation.
But from what I have experienced a Role Subadmin can change ANY aspect of any role, where the only limitation is the ability to add entitlements or profiles from a source they own. They can otherwise change name, description, remove entitlements, change criteria, change approvals.
Curious if anyone else is able to replicate this. I have been able to do so in both our Sandbox and Production environments:
1 - Create a Role
2 - Add 1+ entitlements to the role, no Access Profiles
3 - Have an Identity with Role Subadmin, who neither owns that role, or has Governance Group ownership of the source from where the entitlements orignate login
4 - See what of the Role you created that individual is able to modify. Expect it to be name, description, criteria, approvals