Blind user role and configuration object

Question

Hi,

Still struggling with blind user role :-) i found out that i cannot exclude configuration object from the role (this is greyed) so users cannot use "My Approval" "My requests" features

Is this normal ?

TIA

Answer 1

Here you have two options:

1. Modify the Blind User role to deny reading only AD objects of specific types.

   

2. Use a different approach to hide AD objects.

   • Delete all assignments from the Blind User role.
   • Remove all assignments from the Domain User role. By default, this role grants all users the permissions to view all objects in AD.
   • Assign users to the security roles you need. Users will be able to view only the AD objects included in the assignment scope of the roles. For example:
     • If you want to allow a user to view AD objects located in a specific OU, assign this user to the Domain User role over this OU.
     • If you want to allow a user to view AD objects located in a specific OU and perform account support tasks for these objects, assign this user to the Help Desk role over this OU.

Comments

Option 2 is definitely the best and i wonder why i did not think about it before !

I try this right now