Configure custom admin roles for ITP

Early Access release. See Enable self-service features.

This configuration creates a custom admin with all permissions required to manage ITP policies, user risk, and the Shared Signals Framework, and to browse and view ITP reports. You can adjust your selections if you want to limit a role to view-only permissions or specific resource sets. Refer to Use custom admin roles.

Permissions

You must be a super admin to configure custom admin roles for ITP.

Create the role

1. In the Admin Console, go to SecurityAdministrators.

2. Go to the Roles tab.

3. Click Create new role.

4. In the Role name field, enter ITP admin.

5. In the Role description field, enter Manage permissions for ITP.

6. Select the following permissions:

   • Clear users' sessions: Gives admins the ability to clear user sessions.

   • Manage users' risk: Grants access to user risk details and lets admins elevate user risk.

   • Clear API tokens: Gives admins the ability to configure Universal Logout for a specific user.

   • View groups and their details: Required for admins to see group assignments in the entity risk policy and the session protection policy.

   • Manage applications: Gives admins the ability to configure Universal Logout for an app.

   • Run delegated flow: Gives admins the ability to run a delegated flow for use in the entity risk policy or the session protection policy.

   • View delegated flow: Gives admins the ability to view and select a delegated flow for use in the entity risk policy or the session protection policy.

   • Manage Shared Signals Framework Receiver: Gives admins the ability to configure SSF receiver streams.

   • Manage policies: Gives admins the ability to configure the entity risk policy and the session protection policy.

7. Click Save role.

Create the resource sets

You can only select one policy per resource set. If you want to include both the entity risk and session protection policies, you must create two resource sets.

1. In the Admin Console, go to SecurityAdministrators.
2. Go to the Resources tab.
3. Click Create new resource set.
4. In the Name field, enter ITP resources.
5. In the Description field, enter Resources for ITP admins.
6. Click Add Resources, and then configure the following sets:
   • Users: Select the users that you want the ITP admin to manage.
   • Groups: Select the groups that you want the ITP admin to manage.
   • Applications: Select the apps that you want the ITP admin to manage.
   • Shared Signals Framework receiver: Select All Shared Signals Framework receivers.
   • Policies: Select Entity risk policy.
   • Workflows: Select the flows that you want the ITP admin to manage.
7. Click Save selection, and then click Create.
8. On the Resources tab, click Create new resource set.
9. In the Name field, enter Session protection.
10. In the Description field, enter Session protection policy for ITP admins.
11. Click Add Resources.
12. For the Policies resource set, select Session protection policy.
13. Click Save selection, and then click Create.

All of these resources are required for the roles you set. ITP tasks may fail without an error message if a resource is missing.

Assign the custom role and resource sets to a user

1. In the Admin Console, go to SecurityAdministrators.
2. Go to the Admins tab.
3. Click Add administrator.
4. Search for the user or group that you want to assign.
5. In the Role dropdown menu, select ITP Admin.
6. In the Resource set dropdown menu, select ITP resources.
7. In the Role dropdown menu, select ITP Admin.
8. In the Resource set dropdown menu, select Session protection.
9. On the Administrator assignment by admin page, click Add assignment.
10. In the Role dropdown menu, select Report Administrator. This role lets the admin view ITP reports and dashboard widgets.
11. Optional. Click Preview next to the Role or Resource set menu to verify the permissions you're assigning.
12. Click Save Changes.

Related topics

Admin roles for ITP

Custom admin roles