Delegating user management of non-sensitive user roles.

Dragones CRM lets a high-level manager delegate the management of users to a subordinate manager, the user administrator, in a way that does not require or permit a full Administrator permission set for the user administrator or their subordinate users. The steps below are the best practice for defining sensitive user roles and building a permission set that can safely act as a user administrator.

Define the sensitive user roles.

Begin by deciding which user roles should be considered sensitive. Roles marked sensitive cannot be managed by the user administrator. The sensitive set should include every role whose permission set is larger than or equal to the user administrator’s, including the user administrator role itself. Mark roles as sensitive in Settings, User Roles by editing the individual role.

Build the user administrator’s permission set.

Make sure the user administrator’s role includes the Settings, Users permission and does not include the UserRoles, Sensitive permission. UserRoles, Sensitive should only be granted to the highest-level roles, including the administrator role.

It is critical that no role left unmarked as sensitive carries any of these permissions: Settings, Permissions, Settings, UserRoles, or UserRoles, Sensitive. If any non-sensitive role has any of them, the user administrator can modify their own permission set, or a subordinate’s, into a full administrator permission set. Permissions are defined role by role in Settings, Permissions.

What the delegate can now do.

With the roles and permissions combined as above, editing and creating subordinate users is delegated to the user administrator role you defined. The user administrator can create new users with non-sensitive roles, and edit existing users who hold them. Editing includes changing the user role, resetting the password, and retiring users with non-sensitive roles.