Create, assign, and manage roles

1.      Go to > Members > Roles. The Roles List page appears.

2.      Click . The Add Role page appears.                                                                                                     

3.      Enter a Name for your custom role.

4.      Enter a Description for your custom role.

5.      Select the Managed Roles, as follows:

●       Select the All Roles to allow those assigned this role to manage all users.

●       Select the Selected Roles and from the Select Roles to Manage drop-down list, select the roles that you want the users assigned this role to manage. Repeat this procedure to add more roles.

For example, if you want to create a custom role called Super Auditor that allows the role to manage all users assigned the Auditor role, select Auditor from the drop-down list. When you select a role, it appears in the Administrator is allowed to manage these roles list.

6.      Select the Managed Groups the role can manage, as follows:

●       Select All Groups to allow the an administrator with this role to administer all groups.

●       Select Own Groups to allow the administrator to administer only the groups to which it belongs.

●       Select Selected Groups and from the drop-down list select the groups the administrator with this role can administer. Repeat this procedure to add more groups.

7.      Select the System Entities and permissions for the custom role.  

The system entities define the functionality the role can access. For example, if you create a custom role called Marketing and want to only allow users with the Marketing role to have access to the Theme page, you would set the Account Branding Customization system entity to All to allow users with the Marketing role access and edit the Theme page.

8.      Click Add to create the role.

 

You can create a copy of an existing role.

1.      Go to > Members > Roles. The Roles List page appears.

2.      Click next to the role you want to clone.

3.      Click . The Add Role page appears.                                                                                                     

4.      By default, Copy is appended to the name of the role you are cloning.

5.      Change the role Name, as required.

6.      Edit the role Description, as required.

7.      Choose one of the following options:

●       Select Manage All Roles to allow those assigned this role to manage all users.

–or–

●       Do not select Manage All Roles and from the select Roles to Manage drop-down list, select the roles that you want the users assigned this role to manage.

For example, if you want to create a custom role called Super Auditor that allows the role to manage all users assigned the Auditor role, select Auditor from the drop-down list.

Note: You can select more than one role to manage.

8.      Select the Managed Groups the role can manage, as follows:

●       Select All Groups to allow the an administrator with this role to administer all groups.

●       Select Own Groups to allow the administrator to administer only the groups to which it belongs.

●       Select Selected Groups and from the drop-down list select the groups the administrator with this role can administer. Repeat this procedure to add more groups.

9.      Edit the System Entities, as required.  

The system entities define the functionality the role can access. For example, if you create a custom role called Marketing and want to only allow users with the Marketing role to have access to the Theme page, you would set the Account Branding Customization system entity to All to allow users with the Marketing role access and edit the Theme page.

10.  Click Add to create the role.

 

1.      Click > Members > Roles. The Roles List page appears.

2.      Click the name of the custom role you want to edit. The Edit Role page appears.

3.      Modify the settings as required.

4.      Click Save.

 

1.      Click > Members > Roles. The Role List page appears.

2.      Click next to the role you want to delete.

3.      Click Delete on the confirmation prompt.

 

A system entity is the functionality available to the assigned role in Identity as a Service. Click the system entity for more details about its function.

System Entity	System Entity
Access Management Roles ManagementAllows administrators to manage Role-Based Access Control (RBAC) for protected OAuth resources.	OTP ManagementAllows administrators to create and obtain an OTP value for a user using an Admin API.
Account and Authenticator SettingsControls the settings of the different authenticators available on Identity as a Service. This permission is required to access the KBA WordMaps feature.	Outbound Provisioning ManagementAllows administrators to create and manage provisioners for user provisioning with a third-party service.
Account Branding CustomizationAllows administrators to customize the appearance of their Identity as a Service account and email templates.	Phone/Email OTP VerificationAllows administrators to manage phone and email OTPs.
Account Entitlement StatusAllows administrators to see the number of entitlements assigned to their account. Account entitlements define how many users can be created within an account.	Resource Rules ManagementAllows administrators to define the resource rules for application access restrictions.
Account ReportsAllows administrators to monitor their account activity. Users can generate reports on specific account metrics.	Roles ManagementControls the level of access each user has to the features on their Identity as a Service account. Note: Selecting the Role Management system entity automatically enables the Manage All Roles setting.
ActiveSync Device ManagementAllows administrators to manage ActiveSync access.	Scheduled Task ManagementAllows administrators to schedule tasks, such as report generation.
APIs/URLs ManagementAllows administrators to manage OAuth resource server APIs.	Scopes ManagementAllows administrators to manage OAuth APIs/URLs scopes.
Application Template ManagementAllows access to the configuration settings needed to add an application to your Identity as a Service account.	Smart Credential Definition ManagementAllows administrators to access to the smart credential definitions configured in an Identity as a Service account. The smart credential definition contains information that a mobile smart credential needs to be properly configured.
Applications ManagementAllows administrators to configure their application accounts so that they are accessible after authenticating to Identity as a Service.	User Attribute ManagementAllows administrators to manage the information fields available in the user profile information.
Archive ManagementAllows administrators to view and download archived audits.	User Desktop Management Allows an administrator to view and remove Desktop entities in the users’s Devices tab.
Bulk Group OperationsAllows administrators to add a large number of groups to their account by uploading group information from a CSV file.	User Face Biometric ManagementAdministrators can manage Face Biometric authenticators.
Bulk Hardware Token OperationsAllows administrators to bulk import token data files and bulk assign hardware tokens to users.	User Passkey/FIDO2 Token ManagementAllows administrators to manage Passkey/ FIDO2 tokens.
Bulk IdentityGuard OperationsAllows administrators to bulk import Entrust IdentityGuard authenticators into Identity as a Service. Supported authenticators are KBA, Entrust Soft Tokens, and Hardware Tokens.	User Grid Card Content ManagementAllows administrator to print, export, and view grid cards.
Bulk User OperationsAllows administrators to add a large number of users to their account by uploading user account information from a CSV file.	User Grid Card ManagementAllows administrators to assign, delete, view, edit, and disable or enable user grid cards.
Certificate Authority ManagementAllows administrators to access the certificate authorities configured on an Identity as a Service account. Certificate authorities (CA) contain information needed to configure a mobile smart credential.	User Knowledge-based Authenticator ManagementAllows administrators to manage KBA authenticators.
Digital ID Management for Smart CredentialsAllows administrators to access each digital ID configuration within a configured CA.	User Knowledge-based Authenticator View AnswersControls the ability to see the answers entered for the questions included in a user's KBA from the administrator portal. Answers registered for a KBA cannot be viewed from the user portal regardless of a user's role permissions. The answers registered for a user's KBA can be accessed from the administrator portal when Updating a knowledge-based authenticator. Note: All is the only option available for this system entity because the feature only controls whether a user's answers can be viewed.
Directories and Directory SyncControls which corporate directories are synchronized with an Identity as a Service account. Synchronizing a directory allows for user or group information on a corporate directory to be auto-populated in an Identity as a Service account. When synchronized, any user or group information altered on the company server is automatically updated in Identity as a Service.	User Machine ID Authenticator ManagementAllows administrators to manage the machine authenticators listed on each user's authenticators page. Note: Administrators cannot assign Machine Authenticators to other users. Each user must assign Machine Authenticators from their own user portal or when they login.
Directory PasswordAllows a administrators to read the directory account password for AD Connector directories through the API.	User ManagementAllows administrators to manage users of their IDaaS accounts.
Domain Controller CertificatesAllows administrators to configure domain controllers.	User OAuth Token ManagementAllows administrators to view and revoke OAuth tokens.
Email Template ManagementAllows a administrators to manage custom email templates.	User Password Authenticator ManagementAllows administrators to manage user passwords.
Enterprise Gateway and Agents ManagementControls the Gateways and Gateway instances on your account. Each gateway instance contains a Directory Synchronization, RADIUS Proxy, Password, and Identity Guard agent that supports secure access to account features.	User Risk-based Authentication ManagementAllows administrators to manage user risk-based authenticator settings.
Entrust Soft Token Manual Activation DetailsAllows administrators to view the activation code for an Entrust Soft Token authenticator.	User Role ManagementAllows administrators to manage user roles.
Export ReportsAllows users to export user, grid card, and audit reports.	User Smart Credential Authenticator ManagementAllows administrators  to access to the Mobile Smart Credentials assigned to each user.
Groups ManagementControls the groups available on an account.	User Smart Credential SignatureAllows users to access APIs that support smart credential push signature.
Identity Provider ManagementType your expanding text here.	User Temporary Access Code ManagementAllows administrators to view or create a temporary access code for a user. The temporary access code information can be seen except for the code itself (a character string). Accessing the code value requires a role with the User Temporary Access Code View Value.
Issue CredentialsAllows administrators to issue credentials.	User Temporary Access Code View ValueAllows administrators to view a user's Temporary Access Code value (a character string).
Magic Link ManagementAllows administrators to manage Magic Links.	User Token Authenticator ManagementAllows administrators to control the hardware and soft token authenticators assigned to other users in their account.
Magic Link Content ManagementAllows administrators to manage the content of Magic Links.	Webhooks ManagementAllows administrators to management webhooks.
OrganizationsAllows administrators to manage organizations and  Domain-Based Identity Providers for OIDC applications.