Role-based access control (RBAC)

Role-based access control (RBAC) allows customer (tenant) admins responsible for account creation (Super Admin) to assign more refined role permissions to individual admins as their enterprise requirements dictate. Though KME utilizes admin roles unique to the KME service, a Super Admin cuts across all services.

With RBAC, existing customers have their administrators migrated automatically. Administrators with their own unique set of permissions (manage administrators, delete devices etc.) are assigned new roles that map to their current permissions. If needed, new roles beyond what the migrated admins are currently assigned, can be created based on a list of permissions unique for each service.

NOTE - The only role that cannot be assigned is the Super Admin role, which applies across all supported services. Only one person can assume a Super Admin role per company.

NOTE - For detailed information on adding an administrator and assigning them their required roles and permissions, go to: Adding an admin and assigning roles and permissions.

Migrate existing admins to RBAC

KME has different permissions available to its administrators. Every combination of service permissions is mapped to a different role. The role names are generic by default, but can be modified based on your organization’s naming requirements.

For example, a KME admin with the ability to invite other admins will be mapped to “KME Role 1”. Or a KME Admin with the ability to both (i) delete and (ii) un-assign profiles from devices will be mapped to “KME Role 2”.

Create a role and assign permissions

Each Knox Cloud Service, including KME, has different permissions that can be combined and assigned a role.

NOTE - Most permission categories within the Create role screen have a View only option that only permit an admin with this role to view items with no configuration, device or reseller administration permitted. New roles have the view only permission enabled by default. Existing roles that inherit a View only permission have it turned off by default, to prevent issues.

Once the required Role name is defined, specific permissions can be selected by category as needed for the particular role. New administrator roles receive some basic permissions by default, but additional permissions require assignment for individual roles. Keep in mind, a role must be first created before an administrator can be invited to that role.

NOTE - Enable Allow access to Knox Deployment Application to use the Knox Deployment App (KDA) exclusively for device enrollment into KME, without the use of the KME console. When relying on the KDA without the KME console an admin must login to the KDA, choose a service (KME, KC, KG, etc.), select a profile, pair the master/admin device with a target device, and assign the profile to the target device. For more information on using the KDA, go to: Knox Deployment App (KDA).

Invite a user to be an administrator with a defined role

Existing users require an invitation to become an administrator. However, as noted previously, a role must first be created that can be assigned to the administrator. A different Invite administrator screen could display stating that before an administrator can be invited a role must be first created and available for assignment.

Ensure appropriate roles and permissions are created and available before proceeding with an administrator invitation.

Once an appropriate role is available, provide the name and Email address serving as the administrator’s contact resource, then select the Role assignment for this specific administrator.

View roles

Once roles have been created and assigned to administrators, they can be reviewed to assess whether the role name requires modification or its permissions need refinement.

If needed, more than one administrator can be assigned the same role. The number of administrators assigned a particular role displays as a numeric link that can selected to view the names of the assigned administrators.

User interface customization for particular roles

The KME console is customized for each role, depending on the permissions granted. For example, an Admin without Administration Privileges will not display “Administrators & Roles” in the left-hand navigation menu.