Delegated Administration
A role can be given Administrative permissions over the node (or sub-nodes) for which a role exists. This delegated administration allows different roles to have different permissions inside of the Admin Console.
An example of a role that can be created would be a Delegated Admin role. In this role the administrator can set up one or more Administrative Permissions that allow that user in the role to login to the Keeper Admin Console and perform administrative functions. For example, the delegated admin can be given permission to create teams, add users, create or edit roles, run reports and perform account transfers. These permissions can be limited to a single node or they can cascade or traverse down the tree structure to all the sub-nodes. In order to have the role applied to multiple nodes, simply select the + button after Administrative Permissions (see below) and add the node the role will manage. Each node a role manages has its own set of permissions and those permissions can cascade down from that node. For example: If the role was created in the top root level node and there were three other nodes created each under the top level node. The Administrative Permission can be added as the top node, the privileges added, and cascade node permissions selected. This would then give those permissions to all 4 nodes to members of that role.
To give Administrative Permissions to a Role, select the + button on the Role screen.
Select a node. Select Save.
Select the gear next to the node you added.
When Cascade Node Permissions is selected, the permissions will be applied to all sub-nodes of the parent node. It is important to note that Administrative Permissions cannot be added to a Role if one or more of its users are still in the INVITED status.
Permission | Description |
Manage Users | The ability to add, remove, or edit users. |
Manage Nodes | The ability to add, remove, or edit nodes. |
Manage Licenses | The ability to manage and upgrade the organization's license capacity. |
Manage Roles | The ability to add, remove, or edit roles. |
Manage Teams | The ability to add, remove, or configure the Enterprise Bridge settings. |
Manage Bridge | The ability to add, remove, or configure the Enterprise Bridge settings. |
Run Reports | The ability to run and configure reports on usages within the admin console. |
View Tree | The ability to see the node structure. |
Transfer Account | The ability to transfer a user's vault. |
Note: Only administrators who are a member of this role are able to check Transfer Account. If needed, you can add yourself to the role or another administrator within the role can set this permission. Once this box is selected, only members of this role can add members to this role.
Both Administrative permissions and enforcements are configurable from within a role. Enforcements are rules or policies that apply to the end user's Vault experience and security. Administrative Permissions grant rights to perform certain actions within the admin console (also known as delegated administration).
We recommend that only specific roles are given Administrative Permission, and the permission level should be based on the least amount of privilege required by that role.
For example, the default Keeper Administrator may have created a role called Users specifically to handle the policies that are desired for all the users that have been onboarded to the Keeper platform. If one of those users are intended to be able to perform some of the administrative permissions it wouldn't make sense to configure the Users role with the additional entitlements for that one user as it would be applied to all the users and not congruent with a least privilege security model. So instead of editing the Users role to add in additional administrative permissions, it would make the most sense to create a new role called Delegated Admin, grant the administrative permissions, and make the user a member of that role.
