Skip to main content

Assign Access Levels to Management Role Definitions

Assign Access Levels to Management Role Definitions to establish the baseline permissions that child Management Roles automatically inherit when created from the definition. Access Levels added at the definition level apply to all child roles, while individual child roles can receive additional Access Levels as needed for specific use cases.

Prerequisites​

Before assigning Access Levels to Management Role Definitions, ensure you have:

  • Access to Role Management with permissions to modify Management Role Definitions

Procedure​

  1. In the EmpowerID web application, navigate to Role Management > Management Roles.
  2. Select the Role Definitions tab.
  3. Search for and locate the Management Role Definition to which you want to assign Access Levels.
  4. Click the Display Name link for the definition to open its View One page. Role Definition Display Name
    The View One page displays all configuration options for the role definition. Role Definition View One Page
  5. Expand the Access Assignments accordion.
  6. Click Add. Add Access Assignment
    The Grant Actor Access page opens, allowing you to configure the Access Level assignment and its scope. Grant Actor Access Page
  7. In the Which Type of Access panel, configure the assignment parameters:
    • Assign Direct to Resource or Other Method: Select the assignment scoping method:
      • Direct — Assigns access to specific individual resources, such as a particular group or account
      • By Location — Assigns access to all resources within a location and its child locations, such as all groups in the Boston location
      • Relative — Assigns access to resources based on the person's location assignment, such as all groups in locations where the person is assigned
      • Belonging to which group — Assigns access to all users and people who are members of the selected groups
      • Belonging to which Management Role — Assigns access to all people assigned to the selected Management Roles
      • Belonging to which Query-Based Collection — Assigns access to all objects in the selected Query-Based Collection
    • Resource Type: Select the type of resource for which you are assigning access, such as Group (Security), Account, or Mailbox
    • Access Level: Select the Access Level that defines the permissions being granted, such as Member, Owner, or Administrator
  8. In the Where: Select Resources or a Location panel, define the scope of the assignment:
    • For Direct assignments, search for and select specific resources
    • For By Location assignments, search for and select the location that defines the resource scope
    • For other assignment types, search for and select the appropriate groups, roles, or collections
  9. In the Why & for How Long? panel, configure justification and temporal settings:
    • Comment or Justification: Enter a comment explaining the purpose of the assignment (optional but recommended for audit purposes)
    • Access Starts: Select a start date and time from the calendar picker (leave blank for immediate activation)
    • Access Ends: Select an end date and time from the calendar picker (leave blank for permanent assignment)
    • Click Add to add the assignment to your pending changes
  10. Repeat steps 7 through 9 to add additional Access Level assignments as needed.
  11. When you have configured all desired assignments, click Submit to commit your changes.

Verify the Results​

After submitting your Access Level assignments:

  1. The View One page refreshes and displays the updated role definition.
  2. Expand the Access Assignments accordion to confirm your assignments appear in the list.
  3. Verify each assignment displays the correct:
    • Resource Type — The type of resource the Access Level applies to
    • Access Level — The specific permissions granted
    • Scope — The assignment method (Direct, By Location, etc.) and target resources
    • Temporal settings — Start and end dates if configured
  4. (Optional) To verify inheritance, create a test child Management Role from this definition and confirm it receives the Access Level assignments automatically.