Role-based access control (RBAC) allows customer (tenant) admins responsible for account creation (Super Admin) to assign more refined role permissions to individual admins as their enterprise requirements dictate. Though KME utilizes admin roles unique to the KME service, a Super Admin cuts across all services.
With RBAC, existing customers have their administrators migrated automatically. Administrators with their own unique set of permissions (manage administrators, delete devices etc.) are assigned new roles that map to their current permissions. If needed, new roles beyond what the migrated admins are currently assigned, can be created based on a list of permissions unique for each service.
KME has different permissions available to its administrators. Every combination of service permissions is mapped to a different role. The role names are generic by default, but can be modified based on your organization’s naming requirements.
For example, a KME admin with the ability to invite other admins will be mapped to “KME Role 1”. Or a KME Admin with the ability to both (i) delete and (ii) un-assign profiles from devices will be mapped to “KME Role 2”.
Each Knox Cloud Service, including KME, has different permissions that can be combined and assigned a role.
Once the required Role name is defined, specific permissions can be selected by category as needed for the particular role. New administrator roles receive some basic permissions by default, but additional permissions require assignment for individual roles. Keep in mind, a role must be first created before an administrator can be invited to that role.
Existing users require an invitation to become an administrator. However, as noted previously, a role must first be created that can be assigned to the administrator. A different Invite administrator screen could display stating that before an administrator can be invited a role must be first created and available for assignment.
Ensure appropriate roles and permissions are created and available before proceeding with an administrator invitation.
Once an appropriate role is available, provide the name and Email address serving as the administrator’s contact resource, then select the Role assignment for this specific administrator.
Once roles have been created and assigned to administrators, they can be reviewed to assess whether the role name requires modification or its permissions need refinement.
If needed, more than one administrator can be assigned the same role. The number of administrators assigned a particular role displays as a numeric link that can selected to view the names of the assigned administrators.
The KME console is customized for each role, depending on the permissions granted. For example, an Admin without Administration Privileges will not display “Administrators & Roles” in the left-hand navigation menu.