Chat now with support
Chat with Support

Active Roles 8.0 LTS - Built-in Access Templates Reference Guide

Introduction

This document lists the built-in Access Templates (ATs) installed with Active Roles 8.0 LTS.

About built-in Active Roles Access Templates

To help delegating administrative permissions for Active Directory (AD), Azure Active Directory (Azure AD), Exchange, Starling, or other miscellaneous resources in your organization, the Active Roles Console provides a set of built-in Access Templates (ATs).

With ATs, you can simplify the delegation of administrative tasks by assigning low-level permissions to your organizational resources, allowing administrators to manage them in the scope of the assigned ATs as a single unit.

With the built-in ATs of the Active Roles Console, you can:

  • Delegate the most typical administrative roles within your organization. For more information on how to assign ATs, see Applying Access Templates in the Active Roles Administration Guide.

  • Create your own custom ATs by using the built-in ones as a baseline. For more information, see Creating an Access Template in the Active Roles Administration Guide.

Active Directory

The Configuration > Access Templates > Active Directory container of the Active Roles Console contains Access Templates (ATs) for delegating Active Directory (AD) service and data management tasks, for example:

  • User and group management.

  • Computer, printer queue and shared folder object management.

  • Forest and domain configuration management.

This container has two sub-containers:

  • Advanced contains special AD ATs with very granular permissions. For more information, see Active Directory – Advanced ATs.

  • Best Practices for Delegating Active Directory Administration contains ATs for delegating service management to the most typical AD service management roles. For the list of these ATs, see Active Directory – Best Practices ATs.

    • For more information about these best practices, their security sensitivity and impact, see the Microsoft Windows Server documentation.

    • For more information on how to configure these ATs within the Active Roles Console, see the Description of the applicable AT.

    IMPORTANT: Consider the following when configuring Active Directory ATs:

    • To ensure that all appropriate permission entries are added to AD when configuring service management-specific ATs, always select the Propagate permissions to Active Directory option in the Permissions Propagation step of the Delegation of Control Wizard.

      Figure 1: Delegation of Control Wizard – Permissions propagation

      For more information on how to configure ATs for resource objects in your organization with the Active Roles Console, see Applying Access Templates in the Active Roles Administration Guide.

    • Active Roles does not support configuring ATs for the Schema container. To do so, use native Microsoft tools, such as ADSI Edit.

Active Directory – General ATs

To delegate data management tasks for the resources stored in your Active Directory AD environment, use the Access Templates (ATs) in the root of the Configuration > Access Templates > Active Directory container of the Active Roles Console. Such data management tasks include managing users, groups, printers, or computers.

Table 1: Active Directory – General data management Access Templates

Access Template

Description

All Objects - Full Control

Grants full permission to perform any administrative operation on any object in AD.

TIP: Use this AT to delegate complete permission to data administrators who are expected to carry out any and all AD content management tasks in your organization.

All Objects - Read All Properties

Grants the following permissions:

  • List directory objects.

  • View all properties of any object in AD.

All Objects - View or Restore Deleted Objects

Grants the permission to view or restore AD objects deleted from a container.

TIP: Apply this AT to the container whose deleted objects the data administrators should be able to view or restore.

For more information on how to configure ATs for resource objects in your organization with the Active Roles Console, see Applying Access Templates in the Active Roles Administration Guide.

Claim Types - Full Control

Grants full permission to:

  • Create new claim types.

  • Perform all administrative operations on existing claim types.

Claim types determine the claims to issue for an AD security principal upon its authentication, and are used to define permissions when authoring claim-based access rules.

Claim Types - Modify All Properties

Grants permission to view or change all claim type properties.

Claim Types - Read All Properties

Grants permission to list claim types and view all claim type properties.

Computers - Create Computer Accounts

Grants the following permissions:

  • Create new computer accounts.

  • View all properties of computer accounts.

Computers - Full Control

Grants full permission to:

  • Create new computer accounts.

  • Perform all administrative tasks on existing computer accounts.

Computers - Modify All Properties

Grants permission to view or change all properties of computer accounts.

Computers - Move Computer Accounts

Grants the following permissions:

  • Move computer accounts.

  • View all properties of computer accounts.

Computers - Read All Properties

Grants the following permissions:

  • List computer accounts.

  • View all properties of computer accounts.

Computer - Reset Computer Accounts

Grants the following permissions:

  • Reset computer accounts.

  • View all properties of computer accounts.

Contacts - Create Contacts

Grants the following permissions:

  • Create new contacts.

  • View all contact properties.

Contacts - Full Control

Grants full permission to:

  • Create new contacts.

  • Perform all administrative operations on existing contacts.

Contacts - Modify All Properties

Grants permission to view or modify all contact properties.

Contacts - Modify Picture

Grants the following permissions:

  • View or change the image, that is, the thumbnailPhoto attribute.

  • View all contact properties.

Contacts - Read All Properties

Grants the following permissions:

  • List contacts.

  • View all contact properties.

Domains - Read All Properties

Grants the following permissions:

  • List domain objects.

  • View all properties of domain objects.

gMSA - Full Control

Grants full permission to:

  • Create new group Managed Service Accounts (gMSAs).

  • Perform all administrative operations on existing gMSAs.

gMSA - Modify All Properties

Grants permission to view or change all gMSA properties.

gMSA - Modify Membership Policy

Grants permission to view or change the list of computers and computer groups allowed to use a specific gMSA.

gMSA - Read All Properties

Grants the following permissions:

  • List gMSAs.

  • View all gMSA properties.

Groups - Add/Remove Members

Grants permission to view or modify the members of groups.

Groups - Create Groups

Grants the following permissions:

  • Create new groups.

  • View all group properties.

Groups - Full Control

Grants full permission to:

  • Create new groups.

  • Perform all administrative operations on existing groups.

Groups - Manage Dynamic Groups

Grants the following permissions:

  • Configure rule-based membership rules for dynamic groups.

  • View all group properties.

  • List groups in AD containers.

  • List AD containers.

Groups - Modify All Properties

Grants permission to view or modify all group properties.

Groups - Modify Picture

Grants the following permissions:

  • View or change the image, that is, the thumbnailPhoto attribute.

  • View all group properties.

Groups - Perform Deprovision Tasks

Grants the following permissions:

  • Deprovision groups.

  • View all group properties.

TIP: Use this AT to delegate group deprovisioning permissions to data administrators without also delegating group create and group delete permissions.

Groups - Perform Undo Deprovision Tasks

Grants the following permissions:

  • Restore groups.

  • View all group properties.

TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on groups only.

Groups - Read all Properties

Grants the following permissions:

  • List groups.

  • View all group properties.

OUs - Create OUs

Grants the following permissions:

  • Create new Organizational Units (OUs).

  • View all OU properties.

OUs - Full Control

Grants full permission to:

  • Create new OUs.

  • Perform all administrative operations on OUs.

OUs - Modify All Properties

Grants permission to view or modify all OU properties.

OUs - Read All Properties

Grants the following permissions:

  • List OUs.

  • View all OU properties.

Printers - Full Control

Grants full permission to:

  • Create new printer queue objects.

  • Perform all administrative operations on existing printer queues.

Printers - Modify All Properties

Grants permission to view or modify all printer queue properties.

Printers - Read All Properties

Grants the following permissions:

  • List printer queue objects.

  • View all printer queue properties.

Shared Folders - Full Control

Grants full permission to:

  • Create new shared folder objects.

  • Perform all administrative operations on existing shared folders.

Shared Folders - Modify All Attributes

Grants permissions to view or modify all shared folder properties.

Shared Folders - Read All Properties

Grants the following permissions:

  • List shared folders.

  • View all shared folder properties.

Users - Create User Accounts

Grants the following permissions:

  • Create new user accounts.

  • View all user account properties.

Users - Delete User Accounts

Grants the following permissions:

  • Delete user accounts.

  • View all user account properties.

Users - Full Control

Grants full permission to:

  • Create new user accounts.

  • Perform all administrative operations on existing user accounts.

Users - Help Desk

Grants the following permissions:

  • Reset user passwords.

  • Unlock user accounts.

  • Assign or remove digital (X.509) certificates from user accounts.

  • View all user account properties.

TIP: One Identity recommends using this AT to delegate permissions required for the day-to-day operations of your helpdesk service.

Users - Modify All Properties

Grants permission to view or modify all user account properties.

Users - Modify Personal Data

Grants permission to manage the basic HR-related properties of user accounts.

Users - Modify Picture

Grants the following permissions:

  • View or change the image, that is, the thumbnailPhoto attribute.

  • View all user account properties.

Users - Move User Accounts

Grants the following permissions:

  • Move user accounts.

  • View all user account properties.

Users - Pager & Cell Phone Numbers

Grants the following permissions:

  • View and modify the mobile phone and pager number information of the user accounts.

  • View all user account properties.

Users - Perform Deprovision Tasks

Grants the following permissions:

  • Deprovision user accounts and other user-related resources.

  • View all user account properties.

TIP: Use this AT to delegate user deprovisioning permissions to data administrators without also delegating user create and user delete permissions.

Users - Perform Undo Deprovision Tasks

Grants the following permissions:

  • Restore user accounts.

  • View all user account properties.

TIP: Use this AT to delegate the permission of performing the Undo Deprovisioning command on user accounts only.

Users - Phone Number & Address

Grants the following permissions:

  • Modify the address and telephone number properties of user accounts.

  • View all user account properties.

Users - Read All Properties

Grants the following permissions:

  • List user accounts.

  • View all user account properties.

Users and Groups - Basic Management

Grants the following permissions:

  • List groups and user accounts.

  • Add or remove users and groups to or from groups.

  • Reset user passwords.

  • View or modify the login-related properties of user accounts.

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating