WSS Admin Guide

Setting Admin Permission Levels

After adding an administrator, you can modify the permissions for policies, groups, and roles.

Note: The primary administrator for the Account has full access to all configurations. The Switch-In Admin has full access to most configurations except for logging and reporting (which you can change). Administrators cannot change their own permissions, to ensure that there is always at least one administrator with full access.

To set permissions:

• From the drop-down menu below your email address in the upper right corner of the page, select Administrators.


The Admin panel displays.


• On the Admins list, locate the administrator to configure and click the administrator's Edit link from the Actions column.


The General Information subtab displays.


• Click the Application Permissions subtab.


The Applications Permissions subtab displays.


• Assign policies for this administrator by clicking the All Policies checkbox or by selecting individual policies in the Policies box. (Shift-click or click-drag to select contiguous items; Ctrl-click to select noncontiguous items.) At least one policy is required.
  For a description of the default policies and what they block, coach, or allow, click the Policies tab and select the View link next to the policy names.
• Assign this administrator to groups by clicking the All Groups checkbox or by selecting individual groups in the Groups box. (Shift-click to select contiguous items or Ctrl-click to select noncontiguous items.) At least one group is required.
  Group administrators receive notifications if there are errors in importing users into their groups.
• Select a role in the Roles box.
  Permissions associated with the role are automatically selected.

Roles	Description
Full Access	Administrator can manage the configuration at all levels: View, Add, Edit, and Delete. Full Access also includes permissions for specific Web Security Service functions such as Authentication, LDAP Settings, and Malware Protection.
Group Admin	Administrator manages all configuration objects except Administrator, Account, and Full Audit Log.
Read Only	Administrator has View permissions only. Cannot monitor port statistics. This is the default role for administrators being added.
Site Admin	Administrator manages all configuration objects except Log management.

• You can change the permissions by selecting or deselecting the individual checkboxes for administrators, accounts, groups, and so on.