Create an admin role assignment using an admin

There are several important things to note when creating admin role assignments.

• You can save an admin assignment even if it includes resources that aren't affected by the permissions. It doesn't break the admin assignment.

• You can assign both standard and custom roles to individual admins, groups of admins, and apps.

• You can only assign three standard roles to a group at a time. You can add more roles after saving your changes.

Before you begin

• Ensure that you're signed in as a super admin.

• If you want to create an admin role assignment for a role that doesn't exist, you can create it from the Roles tab. See Create a role.

• If you want to create an admin role assignment for a resource set that doesn't exist, you can create it from the Resources tab. See Create a resource set.

• See Best practices for creating a custom role assignment.

Start this task

You can begin creating an admin role assignment from any of the following places in the Admin Console:

• From the Admin tab

• From the Overview tab

• From the People page

• From the Groups page

• From the Applications page

From the Admins tab

1. In the Admin Console, go to Security > Administrators.

2. On the Administrators page, go to the Admins tab.

3. Click Add administrator.

4. On the Administrator assignment by admin page, in the Admin field, enter the user's or group's name.

5. Optional. Select Auditor (Read-Only) mode to apply a read-only restriction to their admin assignments. This restriction takes effect when the target user or group is assigned at least one admin role. See Auditor (Read-Only) mode.

From the Overview tab

1. In the Admin Console, go to Security > Administrators.

2. On the Administrators page, go to the Overview tab.

3. Click Add administrator.

4. On the Administrator assignment by admin page, in the Admin field, enter the user's or group's name.

5. Optional. Select Auditor (Read-Only) mode to apply a read-only restriction to their admin assignments. This restriction takes effect when the target user or group is assigned at least one admin role. See Auditor (Read-Only) mode.

From the People page

1. In the Admin Console, go to Directory > People.

2. Select the required user and go to the user's profile page. Alternatively, go directly to the user's profile by searching for the user from the search bar on the Overview tab of the Administrators page.

3. Go to the Admin Roles tab.

4. If the user doesn't have any existing admin role assignments, click Add admin assignment. If the user already has existing admin assignments, click Edit individual assignments.

   The Administrator assignment by admin page opens with the username populated in the Admin field.

5. Optional. Select Auditor (Read-Only) mode to apply a read-only restriction to their admin assignments. This restriction takes effect when the target user or group is assigned at least one admin role. See Auditor (Read-Only) mode.

From the Groups page

1. In the Admin Console, go to Directory > Groups.

   Go to the group's profile page. Alternatively, go directly to the group's profile by searching for the group from the search bar on the Overview tab of the Administrators page.

2. Go to the Admin Roles tab.

3. If the group doesn't have any existing admin role assignments, click Add admin assignment. If the group already has existing admin assignments, click Edit group assignments.

   The Administrator assignment by admin page opens with the group name populated in the Admin field.

4. Optional. Select Auditor (Read-Only) mode to apply a read-only restriction to their admin assignments. This restriction takes effect when the target user or group is assigned at least one admin role. See Auditor (Read-Only) mode.

From the Applications page

1. In the Admin Console, go to Applications > Applications.

   Go to the app's profile page. Alternatively, go directly to the app's profile by searching for the app from the search bar on the Overview tab of the Administrators page.

2. Go to the Admin Roles tab.

3. If the app doesn't have any existing admin role assignments, click Add admin assignment. If the app already has existing admin assignments, click Edit group assignments.

   The Administrator assignment by admin page opens with the app name populated in the App field.

Continue with the task

1. On the Administrator assignment by admin page, go to the Complete the assignment section.
2. Select the role that you want to assign to your admin. You can also create a new role by selecting Create role from the dropdown menu.
3. Select the resource set that you want to constrain the admin to. You can create a new resource set by selecting Create resource set from the dropdown menu. You can also preview the resources assigned here.
   Note:

   You can't assign Okta Admin Console to users if Govern Okta admin roles is enabled for your org.

4. Click Save changes.