View Source

EmpowerID ships with the following default Management Roles. Click any Management Role to see a tabular description.

Users with this Management Role can perform any action in EmpowerID.

\\

The Assignment Type is Scoped at Location, and except where noted otherwise, the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Access Request	Assignment to any Access Request scoped at EmpowerID System.
Access Request	Assignment to any Access Request scoped at Anywhere.
Alert	Assignment to any Alert scoped at EmpowerID System.
Alert	Assignment to any Alert scoped at Anywhere.
Application	Assignment to any Application scoped at EmpowerID System.
Application	Assignment to any Application scoped at Anywhere.
Approval Routing Group	Assignment to any Approval Routing Group scoped at EmpowerID System.
Asset Request	Assignment to any Asset Request scoped at EmpowerID System.
Asset Request	Assignment to any Asset Request scoped at Anywhere.
Audit	Assignment to any Audit scoped at EmpowerID System.
Audit	Assignment to any Audit scoped at Anywhere.
Business Role	Assignment to any Business Role scoped at Anywhere.
Business Role	Assignment to any Business Role scoped at EmpowerID System.
Computer	Assignment to any Computer scoped at Anywhere.
Control (User Interface)	Assignment to any Control (User Interface) scoped at EmpowerID System.
Control (User Interface)	Assignment to any Control (User Interface) scoped at Anywhere.
EmpowerID System	Assignment to any EmpowerID System as Administrator scoped at EmpowerID System.
EmpowerID System	Assignment to any EmpowerID System scoped at EmpowerID System.
Exchange Contact	Assignment to any Exchange Contact scoped at Anywhere.
Exchange Mailbox	Assignment to any Exchange Mailbox scoped at Anywhere.
Exchange Public Folder	Assignment to any Exchange Public Folder scoped at Anywhere.
External Credential	Assignment to any External Credential scoped at EmpowerID System.
Folder (Shared)	Assignment to any Folder (Shared) scoped at Anywhere.
Generic Asset	Assignment to any Generic Asset scoped at Anywhere.
Generic Asset	Assignment to any Generic Asset scoped at EmpowerID System.
Generic Asset (AD Protected)	Assignment to any Generic Asset (AD Protected) scoped at Anywhere.
Group (Distribution)	Assignment to any Group (Distribution) scoped at Anywhere.
Group (Generic)	Assignment to any Group (Generic) scoped at Anywhere.
Group (Security)	Assignment to any Group (Security) scoped at Anywhere.
Location	Assignment to any Location scoped at EmpowerID System.
Location	Assignment to any Location scoped at Anywhere.
Lync User	Assignment to any Lync User scoped at Anywhere.
Management Role	Assignment to any Management Role scoped at EmpowerID System.
Management Role	Assignment to any Management Role scoped at Anywhere.
Management Role Definition	Assignment to any Management Role Definition scoped at EmpowerID System.
Management Role Definition	Assignment to any Management Role Definition scoped at Anywhere.
Organization	Assignment to any Organization scoped at Anywhere.
Organization	Assignment to any Organization scoped at EmpowerID System.
Pages and Reports	Assignment to any Pages and Reports scoped at EmpowerID System.
Person	Assignment to any Person scoped at Anywhere.
Person	Assignment to any Person scoped at EmpowerID System.
Printer (Shared)	Assignment to any Person scoped at Anywhere.
Query-Based Collection (SetGroup)	Assignment to any Query-Based Collection (SetGroup) scoped at Anywhere.
Query-Based Collection (SetGroup)	Assignment to any Query-Based Collection (SetGroup) scoped at EmpowerID System.
Separation Of Duties Policy	Assignment to any Separation Of Duties Policy scoped at EmpowerID System.
Separation Of Duties Policy	Assignment to any Separation Of Duties Policy scoped at Anywhere.
SharePoint Group	Assignment to any SharePoint Group scoped at Anywhere.
SharePoint Web Site	Assignment to any SharePoint Web Site scoped at Anywhere.
SSO Application	Assignment to any SSO Application scoped at Anywhere.
SSO Application	Assignment to any SSO Application scoped at EmpowerID System.
SSO Application Definition	Assignment to any SSO Application Definition scoped at Anywhere.
SSO Application Definition	Assignment to any SSO Application Definition scoped at EmpowerID System.
SSO OAuth Connection	Assignment to any SSO OAuth Connection scoped at EmpowerID System.
SSO OAuth Connection	Assignment to any SSO OAuth Connection scoped at Anywhere.
SSO SAML Connection	Assignment to any SSO SAML Connection scoped at Anywhere.
SSO SAML Connection	Assignment to any SSO SAML Connection scoped at EmpowerID System.
SSO WS-Federation Connection	Assignment to any SSO WS-Federation Connection scoped at EmpowerID System.
SSO WS-Federation Connection	Assignment to any SSO WS-Federation Connection scoped at Anywhere.
User Account	Assignment to any User Account scoped at Anywhere.
User Account	Assignment to any User Account scoped at EmpowerID System.
Web Service	Assignment to any Web Service scoped at Anywhere.
Web Service	Assignment to any Web Service scoped at EmpowerID System.
Workflow	Assignment to any Workflow scoped at EmpowerID System.
Workflow	Assignment to any Workflow scoped at Anywhere.

Users with this Management Role have full access to the audit workflows and user interfaces that allow users to review their audit tasks.

The Assignment Type for each resource is Direct.

\\

In this table, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Auditor Compliance Dashboard	Direct assignment to Auditor Compliance Dashboard as Viewer.
Auditor Compliance Dashboard To Do	Direct assignment to Auditor Compliance Dashboard To Do as Viewer.
Auditor Compliance Dashboard Done	Direct assignment to Auditor Compliance Dashboard Done as Viewer.
Auditor Compliance Dashboard Open Violations	Direct assignment to Auditor Compliance Dashboard Open Violations as Viewer.
Auditor Compliance Dashboard Closed Violations	Direct assignment to Auditor Compliance Dashboard Closed Violations as Viewer.
User Compliance Dashboard	Direct assignment to User Compliance Dashboard as Viewer.
User Compliance Dashboard To Do	Direct assignment to User Compliance Dashboard To Do as Viewer.
User Compliance Dashboard Done	Direct assignment to User Compliance Dashboard Done as Viewer.

\\

In this table, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
SubmitSingleAttestationResponse	Direct assignment to SubmitSingleAttestationResponse as Initiator.
SubmitSingleSodViolationResponse	Direct assignment to SubmitSingleSodViolationResponse as Initiator.
ProcessAttestationDecision	Direct assignment to ProcessAttestationDecision as Initiator.
AddResourceAttestationComment	Direct assignment to AddResourceAttestationComment as Initiator.
ClaimResourceAttestation	Direct assignment to ClaimResourceAttestation as Initiator.
RemoveResourceAttestationDelegate	Direct assignment to RemoveResourceAttestationDelegate as Initiator.
UnclaimResourceAttestation	Direct assignment to UnclaimResourceAttestation as Initiator.
SetResourceAttestationDelegate	Direct assignment to SetResourceAttestationDelegate as Initiator.
AttestationRevokeGroupMembership	Direct assignment to AttestationRevokeGroupMembership as Initiator.

Users with this Management Role have limited access to the audit workflows and user interfaces that allow users to review their audit tasks.

The Assignment Type for each resource is Direct.

\\

In this table, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
User Compliance Dashboard To Do	Direct assignment to User Compliance Dashboard To Do as Viewer.
User Compliance Dashboard Done	Direct assignment to the User Compliance Dashboard Done as Viewer.

\\

In this table, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
SubmitSingleAttestationResponse	Direct assignment to the SubmitSingleAttestationResponse workflow as Initiator.
SubmitSingleSodViolationResponse	Direct assignment to the SubmitSingleSodViolationResponse workflow as Initiator.
ProcessAttestationDecision	Direct assignment to the ProcessAttestationDecision workflow as Initiator.
AddResourceAttestationComment	Direct assignment to the AddResourceAttestationComment workflow as Initiator.
AttestationRevokeGroupMembership	Direct assignment to the AttestationRevokeGroupMembership workflow as Initiator.

Users with this Management Role can view and connect to computers, create computers, vault credentials and link to computers.

The Assignment Type for each resource is Direct.

\\

In this table, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Shared Credentials Tab	Direct Assignment to the Shared Credentials tab as Viewer.
Find Computer Page Computer Tab	Direct Assignment to the Computer tab on the Find Computer page as Viewer.
Find Computer Page Local Accounts Tab	Direct Assignment to the Local Accounts tab on the Find Computer page as Viewer.
Find Computer Page Local Groups Tab	Direct Assignment to the Local Groups tab on the Find Computer page as Viewer.
Find Computer Page Local Services Tab	Direct Assignment to the Local Services tab on the Find Computer page as Viewer.
Find Computer Page App Pools Tab	Direct Assignment to the App Pools tab on the Find Computer page as Viewer.
IT Shop My Resources My Computers Tab	Direct Assignment to the My Computers tab on the My Resources page of the IT Shop as Viewer.
My Computer Credentials Tab	Direct Assignment to the My Computer Credentials tab on the Find Computer page as Viewer.
All Computer Credentials Tab	Direct Assignment to the All Computer Credentials tab on the Find Computer page as Viewer.
Computer Credentials Check-Outs Tab	Direct Assignment to the Credential Check Outs tab on the Find Computer page as Viewer.
Shared Credential Dashboard Tab	Direct Assignment to the Shared Credential Dashboard tab on the Find Shared Credential page as Viewer.
My Shared Credentials Tab	Direct Assignment to the My Shared Credentials tab on the Find Shared Credential page as Viewer.
All Shared Credentials Tab	Direct Assignment to the All Shared Credentials tab on the Find Shared Credential page as Viewer.
Shared Credentials Check-Outs Tab	Direct Assignment to the Credential Check Outs tab on the Find Shared Credential page as Viewer.
Credentials I Manage Tab	Direct Assignment to the Credentials I Manage tab on the Find Shared Credential page as Viewer.

\\

In this table, the Resource Type is Pages and Reports, and the Access Level is Viewer.

Resource	Assignment Description
Find Computer Page	Direct Assignment to the Find Computer page as Viewer.
Saved Credentials Page	Direct Assignment to the Saved Credentials page as Viewer.
Find Shared Credentials Page	Direct Assignment to the Find Shared Credentials page as Viewer.
Schedule Account Vaulted Password Reset and Update Page	Direct Assignment to the Schedule Account Vaulted Password Reset and Update page as Viewer.
Find Shared Credential Policies Page	Direct Assignment to the Find Shared Credential Policies page as Viewer.

\\

In this table, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
Check-Out Credential	Direct Assignment to the Check-Out Credential workflow as Initiator.
Check-In Credential	Direct Assignment to the Check-In Credential workflow as Initiator.
Ping Computer	Direct Assignment to the Ping Computer workflow as Initiator.
Edit Computer Connection Attributes Bulk	Direct Assignment to the Edit Computer Connection Attributes Bulk workflow as Initiator.
Update External Credentials	Direct Assignment to the Update External Credentials workflow as Initiator.
Provision Computer	Direct Assignment to the Provision Computer workflow as Initiator.
Resource Manager Update Computer	Direct Assignment to the Resource Manager Update Computer workflow as Initiator.
Update Resource Tags	Direct Assignment to the Update Resource Tags workflow as Initiator.
Update Assignments	Direct Assignment to the Update Assignments workflow as Initiator.
Update Secret Shared People	Direct Assignment to the Update Secret Shared People workflow as Initiator.
Update External Credential Accounts	Direct Assignment to the Update External Credential Accounts workflow as Initiator.
Create Vaulted Credential	Direct Assignment to the Create Vaulted Credential workflow as Initiator.
Edit Windows Service	Direct Assignment to the Edit Windows Service workflow as Initiator.
Edit Priv Session	Direct Assignment to the Edit Priv Session workflow as Initiator.
Edit Windows Server App Pool	Direct Assignment to the Edit Windows Server App Pool workflow as Initiator.
Create Computer and Credential	Direct Assignment to the Create Computer and Credential workflow as Initiator.
Update External Credential Policies	Direct Assignment to the Update External Credential Policies workflow as Initiator.
Create External Credential Policy	Direct Assignment to the Create External Credential Policy workflow as Initiator.
Edit External Credential Policy	Direct Assignment to the Edit External Credential Policy workflow as Initiator.
Delete External Credential Policy	Direct Assignment to the Delete External Credential Policy workflow as Initiator.

Users with this Management Role have access to view and connect to computers.

The Assignment Type for each resource is Direct.

\\

In this table, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource Type	Resource	Access Level	Assignment Description
Control (User Interface)	Shared Credentials Tab	Viewer	Direct Assignment to the Shared Credentials tab on the Computer page as Viewer.
Control (User Interface)	IT Shop My Resources My Computers Tab	Viewer	Direct Assignment to the My Computers tab on the My Resources page of the IT Shop as Viewer.
Workflow	Check-Out Credential	Initiator	Direct Assignment to the Check-Out Credential workflow as Initiator.
Workflow	Check-In Credential	Initiator	Direct Assignment to the Check-In Credential workflow as Initiator.

Users with this Management Role have limited self-service access and can only view themselves.

Users with this Management Role can see and manage EmpowerID configuration screens and settings.

The Assignment Type for each resource is Scoped At Location and the Access level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Alert	Assignment to any Alert as All Access (EmpowerID Admin) scoped at EmpowerID System.
Location	Assignment to any Location as All Access (EmpowerID Admin) scoped at Anywhere.
EmpowerID System	Assignment to any EmpowerID System as All Access (EmpowerID Admin) scoped at EmpowerID System.
Organization	Assignment to any Organization as All Access (EmpowerID Admin) scoped at EmpowerID System.
Business Role	Assignment to any Business Role as All Access (EmpowerID Admin) scoped at EmpowerID System.
Location	Assignment to any Location as All Access (EmpowerID Admin) scoped at EmpowerID System.
Workflow	Assignment to any Workflow as All Access (EmpowerID Admin) scoped at EmpowerID System.
Application	Assignment to any Application as All Access (EmpowerID Admin) scoped at EmpowerID System.
Pages and Reports	Assignment to any Pages and Reports as All Access (EmpowerID Admin) scoped at EmpowerID System.
Control (User Interface)	Assignment to any Control (User Interface) as All Access (EmpowerID Admin) scoped at EmpowerID System.
Web Service	Assignment to any Web Service as All Access (EmpowerID Admin) scoped at EmpowerID System.
Asset Request	Assignment to any Asset Request as All Access (EmpowerID Admin) scoped at EmpowerID System.
Access Request	Assignment to any Access Request as All Access (EmpowerID Admin) scoped at EmpowerID System.
Management Role Definition	Assignment to any Management Role Definition as All Access (EmpowerID Admin) scoped at EmpowerID System.
Management Role	Assignment to any Management Role as All Access (EmpowerID Admin) scoped at EmpowerID System.
Query-Based Collection (SetGroup)	Assignment to any Query-Based Collection (SetGroup) as All Access (EmpowerID Admin) scoped at EmpowerID System.

Users with this Management Role can receive security-related event alerts.

Users with this Management Role can receive alerts concerning EmpowerID system events, such as failed jobs.

Users with this Management Role can create and manage audits and related policies.

\\

The Assignment Type for the resources in this table is Scoped At Location.

\\

Resource	Access Level	Assignment Description
EmpowerID System	All Access (EmpowerID Admin)	Assignment to any EmpowerID System as All Access (EmpowerID Admin) scoped at Anywhere.
Separation of Duties Policy	Reviewer	Assignment to any Separation of Duties Policy as Reviewer scoped at EmpowerID System.
Audit	Reviewer	Assignment to any Audit as Reviewer scoped at EmpowerID System.
Pages and Reports	Viewer	Assignment to any Pages and Reports as Viewer scoped at EmpowerID System.
Separation of Duties Policy	Reviewer	Assignment to any Separation of Duties Policy as Reviewer scoped at EmpowerID System.
Separation of Duties Policy	Access Manager	Assignment to any Separation of Duties Policy as Access Manager scoped at EmpowerID System.
Separation of Duties Policy	Reviewer	Assignment to any Separation of Duties Policy as Reviewer scoped at EmpowerID System.

\\

The Assignment Type for the resources in this table is Direct, the Resource Type is Control (User Interface), and the Access level is Viewer.

\\

\\

The Assignment Type for the resources in this table is Direct, the Resource Type is Pages and Reports, and the Access level is Viewer.

\\

Resource	Assignment Description
Create SoD Policy	Direct assignment to Create SoD Policy as Viewer.
Auditor Compliance Dashboard	Direct assignment to Auditor Compliance Dashboard as Viewer.
FindSeparationOfDutiesViolation Page	Direct assignment to FindSeparationOfDutiesViolation Page as Viewer.

\\

The Assignment Type for the resources in this table is Direct, the Resource Type is Workflow, and the Access level is Initiator.

\\

Resource	Assignment Description
DeleteAudit	Direct assignment to DeleteAudit as Initiator.
AttestationPolicyNew	Direct assignment to AttestationPolicyNew as Initiator.
UpdateAttestationPolicyTargets	Direct assignment to UpdateAttestationPolicyTargets as Initiator.
UpdateAuditAttestationPolicies	Direct assignment to UpdateAuditAttestationPolicies as Initiator.
AuditNew	Direct assignment to AuditNew as Initiator.
EditAttestationPolciyNoUI	Direct assignment to EditAttestationPolciyNoUI as Initiator.
DirectReportAttestationExampleAdvanced	Direct assignment to DirectReportAttestationExampleAdvanced as Initiator.
ProvisionSeparationOfDuties	Direct assignment to ProvisionSeparationOfDuties as Initiator.
EditSeparationOfDutiesPolicyNoUI	Direct assignment to EditSeparationOfDutiesPolicyNoUI as Initiator.
ProvisionAttestationPolicy	Direct assignment to ProvisionAttestationPolicy as Initiator.
EditAuditDetails	Direct assignment to EditAuditDetails as Initiator.
DeleteAttestationPolicy	Direct assignment to DeleteAttestationPolicy as Initiator.

Users with this Management Role have enterprise-wide ability to manage all Exchange mailboxes.

\\

In this table, the Assignment Type is Scoped At Location, and the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Exchange Contact	Assignment to any Exchange Contact as All Access (EmpowerID Admin) scoped at Anywhere.
Exchange Mailbox	Assignment to any Exchange Mailbox as All Access (EmpowerID Admin) scoped at Anywhere.
Exchange Public Folder	Assignment to any Exchange Public as All Access (EmpowerID Admin) scoped at Anywhere.

\\

In this table, the Assignment Type is Direct.

\\

Resource Type	Resource	Access Level	Assignment Description
Application	Configuration Manager	Administrator	Direct assignment to Configuration Manager as Administrator.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Request Center Global Stats	Direct assignment to Request Center Global Stats as Viewer.
Exchange Mailbox Resource Type dropdown item	Direct assignment to Exchange Mailbox Resource Type dropdown item as Viewer.
Exchange Public Folder Resource Type dropdown item	Direct assignment to Exchange Public Folder Resource Type dropdown item as Viewer.
Exchange Mail Contact Resource Type dropdown item	Direct assignment to Exchange Mail Contact Resource Type dropdown item as Viewer.
Deleted Exchange Mailboxes	Direct assignment to Deleted Exchange Mailboxes as Viewer.
Exchange Mailbox Stores	Direct assignment to Exchange Mailbox Stores as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AddExchangeMailboxAddress	Direct assignment to AddExchangeMailboxAddress as Initiator.
BulkMailenableGroup	Direct assignment to BulkMailenableGroup as Initiator.
CreateEquipment	Direct assignment to CreateEquipment as Initiator.
CreateExchangeMailbox	Direct assignment to CreateExchangeMailbox as Initiator.
CreateResourceMailbox	Direct assignment to CreateResourceMailbox as Initiator.
CreateUserAndMailbox	Direct assignment to CreateUserAndMailbox as Initiator.
CreateUserMailbox	Direct assignment to CreateUserMailbox as Initiator.
DeleteExchangeMailboxAddress	Direct assignment to DeleteExchangeMailboxAddress as Initiator.
DeleteMailbox	Direct assignment to DeleteMailbox as Initiator.
DisableMailbox	Direct assignment to DisableMailbox as Initiator.
DisableOWA	Direct assignment to DisableOWA as Initiator.
EditAcceptMessagesFrom	Direct assignment to EditAcceptMessagesFrom as Initiator.
EditExchangeMailboxAddress	Direct assignment to EditExchangeMailboxAddress as Initiator.
EditMailbox	Direct assignment to EditMailbox as Initiator.
EditMailForwarding	Direct assignment to EditMailForwarding as Initiator.
EditRejectMessagesFrom	Direct assignment to EditRejectMessagesFrom as Initiator.
EditSMTPAddresses	Direct assignment to EditSMTPAddresses as Initiator.
EnableAutoAccept	Direct assignment to EnableAutoAccept as Initiator.
EnableMailboxWithBasicQuota	Direct assignment to EnableMailboxWithBasicQuota as Initiator.
EnableMailboxWithCorpQuota	Direct assignment to EnableMailboxWithCorpQuota as Initiator.
EnableOWA	Direct assignment to EnableOWA as Initiator.
EnableWireless	Direct assignment to EnableWireless as Initiator.
HideDLFromGAL	Direct assignment to HideDLFromGAL as Initiator.
HideMailbox	Direct assignment to HideMailbox as Initiator.
MailboxSizeDecrease	Direct assignment to MailboxSizeDecrease as Initiator.
MailboxSizeIncrease	Direct assignment to MailboxSizeIncrease as Initiator.
MailDisableAccount	Direct assignment to MailDisableAccount as Initiator.
MailDisableGroup	Direct assignment to MailDisableGroup as Initiator.
MailEnableGroup	Direct assignment to MailEnableGroup as Initiator.
MoveMailbox	Direct assignment to MoveMailbox as Initiator.
ReinstateExchangeMailbox	Direct assignment to ReinstateExchangeMailbox as Initiator.
ResourceManagerUpdateMailbox	Direct assignment to ResourceManagerUpdateMailbox as Initiator.
SetAsPrimaryExchangeMailboxAddress	Direct assignment to SetAsPrimaryExchangeMailboxAddress as Initiator.
ShowDLInGAL	Direct assignment to ShowDLInGAL as Initiator.
ShowMailbox	Direct assignment to ShowMailbox as Initiator.

Users with this Management Role have enterprise-wide ability to manage all groups.

\\

In this table, the Assignment Type is Scoped At Location, and the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Group (Security)	Assignment to any Group (Security) as All Access (EmpowerID Admin) scoped at Anywhere
Group (Distribution)	Assignment to any Group (Distribution) as All Access (EmpowerID Admin) scoped at Anywhere
Group (Generic)	Assignment to any Group (Generic) as All Access (EmpowerID Admin) scoped at Anywhere

\\

In this table, Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
ChangeManager.aspx	Direct assignment to ChangeManager.aspx as Viewer.
Create Application Page	Direct assignment to Create Application Page as Viewer.
Create Group	Direct assignment to Create Group as Viewer.
Find ProtectedApplicationResourceApplication Page	Direct assignment to Find ProtectedApplicationResourceApplication Page as Viewer.
GroupManager.aspx	Direct assignment to GroupManager.aspx as Viewer.
GroupMembersForGroup	Direct assignment to GroupMembersForGroup as Viewer.
GroupMembershipChanges	Direct assignment to GroupMembershipChanges as Viewer.
GroupMembershipChangesHighSecurity	Direct assignment to GroupMembershipChangesHighSecurity as Viewer.
GroupMembershipForPerson	Direct assignment to GroupMembershipForPerson as Viewer.
GroupMembershipForAccount	Direct assignment to GroupMembershipForAccount as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AccountRequestwithGroup	Direct assignment to AccountRequestwithGroup as Initiator.
AddAccountsToGroup	Direct assignment to AddAccountsToGroup as Initiator.
AddGroupOrgZoneResourceTypeRole	Direct assignment to AddGroupOrgZoneResourceTypeRole as Initiator.
AddGroupResourceRole	Direct assignment to AddGroupResourceRole as Initiator.
AddGroupsToGroup	Direct assignment to AddGroupsToGroup as Initiator.
AddPeopleToGroups	Direct assignment to AddPeopleToGroups as Initiator.
AssignGroupOrgRoleOrgZone	Direct assignment to AssignGroupOrgRoleOrgZone as Initiator.
AssignGroupResourceRole	Direct assignment to AssignGroupResourceRole as Initiator.
BulkMailenableGroup	Direct assignment to BulkMailenableGroup as Initiator.
CreateADGroup	Direct assignment to CreateADGroup as Initiator.
CreateGroup	Direct assignment to CreateGroup as Initiator.
DeleteGroup	Direct assignment to DeleteGroup as Initiator.
EditGroup	Direct assignment to EditGroup as Initiator.
MailDisableGroup	Direct assignment to MailDisableGroup as Initiator.
MailEnableGroup	Direct assignment to MailEnableGroup as Initiator.
MoveGroup	Direct assignment to MoveGroup as Initiator.
RemoveAccountsFromGroups	Direct assignment to RemoveAccountsFromGroups as Initiator.
RemoveGroupAccount	Direct assignment to RemoveGroupAccount as Initiator.
RemoveGroupOrgRoleOrgZone	Direct assignment to RemoveGroupOrgRoleOrgZone as Initiator.
RemoveGroupResourceRoleNoUI	Direct assignment to RemoveGroupResourceRoleNoUI as Initiator.
RemoveGroupsFromGroup	Direct assignment to RemoveGroupsFromGroup as Initiator.
RemoveOrgRoleOrgZoneFromGroups	Direct assignment to RemoveOrgRoleOrgZoneFromGroups as Initiator.
RemoveRbacResourceRoleAssignmentAsActor	Direct assignment to RemoveRbacResourceRoleAssignmentAsActor as Initiator.
ResourceManagerEditGroup	Direct assignment to ResourceManagerEditGroup as Initiator.

Users with this Management Role have enterprise-wide ability to manage all users, groups, computers, mailboxes and other IT resources.

\\

In this table, the Assignment Type is Scoped At Location, and the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Computer	Assignment to any Computer as All Access (EmpowerID Admin) scoped at EmpowerID System.
Exchange Mailbox	Assignment to any Exchange Mailbox as All Access (EmpowerID Admin) scoped at Anywhere.
Group (Distribution)	Assignment to any Group (Distribution) as All Access (EmpowerID Admin) scoped at Anywhere.
Group (Generic)	Assignment to any Group (Generic) asAll Access (EmpowerID Admin) scoped at Anywhere.
Group (Security)	Assignment to any Group (Security) as All Access (EmpowerID Admin) scoped at Anywhere.
Location	Assignment to any Location as All Access (EmpowerID Admin) scoped at EmpowerID System.
Person	Assignment to any Person as All Access (EmpowerID Admin) scoped at Anywhere
SharePoint Group	Assignment to any SharePoint Group as All Access (EmpowerID Admin) scoped at Anywhere
SharePoint Web Site	Assignment to any SharePoint Web Site as All Access (EmpowerID Admin) scoped at Anywhere
SSO Application	Assignment to any SSO Application as All Access (EmpowerID Admin) scoped at Anywhere
SSO Application Definition	Assignment to any SSO Application Definition as All Access (EmpowerID Admin) scoped at Anywhere
User Account	Assignment to any User Account as All Access (EmpowerID Admin) scoped at Anywhere.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
AccountManager.aspx	Direct assignment to AccountManager.aspx as Viewer.
AccountsWithoutEmployeeID	Direct assignment to AccountsWithoutEmployeeID as Viewer.
AccountsWithoutManager	Direct assignment to AccountsWithoutManager as Viewer.
ActionsByPerson	Direct assignment to ActionsByPerson as Viewer.
ActionsToPerson	Direct assignment to ActionsToPerson as Viewer.
Addresses	Direct assignment to Addresses as Viewer.
AllPreferredBusinessRolesScopedByLocation	Direct assignment to AllPreferredBusinessRolesScopedByLocation as Viewer.
AllPreferredManagementRolesScopedByLocation	Direct assignment to AllPreferredManagementRolesScopedByLocation as Viewer.
AllPublicFolders	Direct assignment to AllPublicFolders as Viewer.
BusinessRoles	Direct assignment to BusinessRoles as Viewer.
ChangeManager.aspx	Direct assignment to ChangeManager.aspx as Viewer.
ComputerManager.aspx	Direct assignment to ComputerManager.aspx as Viewer.
Create Application page	Direct assignment to Create Application page as Viewer.
Create Group	Direct assignment to Create Group as Viewer.
Delegations management page	Direct assignment to Delegations management page as Viewer.
DeletedGroups	Direct assignment to DeletedGroups as Viewer.
DeletedMailboxes	Direct assignment to DeletedMailboxes as Viewer.
DeletedPeople	Direct assignment to DeletedPeople as Viewer.
DeletedUsers	Direct assignment to DeletedUsers as Viewer.
Directory Manager	Direct assignment to Directory Manageras Viewer.
DisabledUsers	Direct assignment to DisabledUsers as Viewer.
DomainControllers	Direct assignment to DomainControllers as Viewer.
Edit Person Contextual Page	Direct assignment to Edit Person Contextual Page as Viewer.
EmailAddressByMailbox	Direct assignment to EmailAddressByMailbox as Viewer.
EmpowerIDLocations	Direct assignment to EmpowerIDLocations as Viewer.
EmpowerIDServers	Direct assignment to EmpowerIDServers as Viewer.
EmptyGroups	Direct assignment to EmptyGroups as Viewer.
ExchangeMailboxesByLocation	Direct assignment to ExchangeMailboxesByLocation as Viewer.
ExchangeMailboxStores	Direct assignment to ExchangeMailboxStores as Viewer.
ExchangeResourceMailboxesByLocation	Direct assignment to ExchangeResourceMailboxesByLocation as Viewer.
ExchangeServers	Direct assignment to ExchangeServers as Viewer.
ExternalLocations	Direct assignment to ExternalLocations as Viewer.
ExternalRoles	Direct assignment to ExternalRoles as Viewer.
Find AccountInbox Page	Direct assignment to Find AccountInbox Page as Viewer.
Find Computer Page	Direct assignment to Find Computer Page as Viewer.
Find Deleted Objects	Direct assignment to Find Deleted Objects as Viewer.
Find DeletedAccount Page	Direct assignment to Find DeletedAccount Page as Viewer.
Find DeletedExchangeMailbox Page	Direct assignment to Find DeletedExchangeMailbox Page as Viewer.
Find DeletedGroups Page	Direct assignment to Find DeletedGroups Page as Viewer.
Find DeletedPeople Page	Direct assignment to Find DeletedPeople Page as Viewer.
Find Exchange Mailbox Page	Direct assignment to Find Exchange Mailbox Page as Viewer.
Find ExchangeMailContact Page	Direct assignment to Find ExchangeMailContact Page as Viewer.
Find ExchangePublicFolder Page	Direct assignment to Find ExchangePublic Page as Viewer.
Find ExecutionRuntimeJobHistory Page	Direct assignment to Find ExecutionRuntimeJobHistory Page as Viewer.
Find Group Page	Direct assignment to Find Group Page as Viewer.
Find LoginSession Page	Direct assignment to Find LoginSession Page as Viewer.
Find LyncUser Page	Direct assignment to Find LyncUser Page as Viewer.
Find OrphanedAccount Page	Direct assignment to Find OrphanedAccount Page as Viewer.
Find Person Page	Direct assignment to Find Person Page as Viewer.
Find ProtectedApplicationResourceApplication Page	Direct assignment to Find ProtectedApplicationResourceApplication Page as Viewer.
Find ResourceAttestation Page	Direct assignment to Find ResourceAttestation Page as Viewer.
Find ResourceEntitlementInbox Page	Direct assignment to Find ResourceEntitlementInbox Page as Viewer.
Find SeparationOfDutiesViolation Page	Direct assignment to Find SeparationOfDutiesViolation Page as Viewer.
Find Shared Folder Page	Direct assignment to Find Shared Folder Page as Viewer.
Find SharePointGroup Page	Direct assignment to Find SharePointGroup Page as Viewer.
Find User Account Page	Direct assignment to Find User Account Page as Viewer.
GetByLocationReport	Direct assignment to GetByLocationReport as Viewer.
GroupManager.aspx	Direct assignment to GroupManager.aspx as Viewer.
GroupMembersForGroup	Direct assignment to GroupMembersForGroup as Viewer.
GroupMembershipChanges	Direct assignment to GroupMembershipChanges as Viewer.
GroupMembershipChangesHighSecurity	Direct assignment to GroupMembershipChangesHighSecurity as Viewer.
GroupMembershipForAccount	Direct assignment to GroupMembershipForAccount as Viewer.
GroupMembershipForPerson	Direct assignment to GroupMembershipForPerson as Viewer.
IdentityManager	Direct assignment to IdentityManager as Viewer.
LockedOutUsers	Direct assignment to LockedOutUsers as Viewer.
LoginHistory	Direct assignment to LoginHistory as Viewer.
LoginsByHistory	Direct assignment to LoginsByHistory as Viewer.
MembershipChangesByAccount	Direct assignment to MembershipChangesByAccount as Viewer.
MembershipChangesByGroup	Direct assignment to MembershipChangesByGroup as Viewer.
MembershipChangesByPerson	Direct assignment to MembershipChangesByPerson as Viewer.
OrphanAccountsByLocation	Direct assignment to OrphanAccountsByLocation as Viewer.
PasswordManagementActivityByDate	Direct assignment to PasswordManagementActivityByDate as Viewer.
PasswordManagerEnrollment	Direct assignment to PasswordManagerEnrollment as Viewer.
PasswordManagerNotEnrolled	Direct assignment to PasswordManagerNotEnrolled as Viewer.
PeopleByRoleandLocation	Direct assignment to PeopleByRoleandLocation as Viewer.
PeopleByRoleReport	Direct assignment to PeopleByRoleReport as Viewer.
PeopleWithoutAccounts	Direct assignment to PeopleWithoutAccounts as Viewer.
Person Onboarding	Direct assignment to Person Onboarding as Viewer.
PersonLoginHistory	Direct assignment to PersonLoginHistory as Viewer.
PersonManager.aspx	Direct assignment to PersonManager.aspx as Viewer.
PossibleStaleComputers	Direct assignment to PossibleStaleComputers as Viewer.
ResourceRolesForPerson	Direct assignment to ResourceRolesForPerson as Viewer.
SecurityAssignmentsByAllManagementRoleReport	Direct assignment to SecurityAssignmentsByAllManagementRoleReport as Viewer.
SecurityAssignmentsBusinessRoleAsActorReport	Direct assignment to SecurityAssignmentsBusinessRoleAsActorReport as Viewer.
SecurityAssignmentsForAllResourcesReport	Direct assignment to SecurityAssignmentsForAllResourcesReport as Viewer.
SecurityAssignmentsGroupAsActorReport	Direct assignment to SecurityAssignmentsGroupAsActorReport as Viewer.
SecurityAssignmentsPersonAsActorReport	Direct assignment to SecurityAssignmentsPersonAsActorReport as Viewer.
SecurityAssignmentsScopedAtLocationReport	Direct assignment to SecurityAssignmentsScopedAtLocationReport as Viewer.
UserAttributeChanges	Direct assignment to UserAttributeChanges as Viewer.
UsersNeverLoggedIn	Direct assignment to UsersNeverLoggedIn as Viewer.
UsersPasswordNeverExpires	Direct assignment to UsersPasswordNeverExpires as Viewer.
View All Tasks	Direct assignment to View All Tasks as Viewer.
WhitePages.aspx	Direct assignment to WhitePages.aspx as Viewer.
WorkflowsByInitiator	Direct assignment to WorkflowsByInitiator as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AccountJoinToPerson	Direct assignment to AccountJoinToPerson as Initiator.
AccountRequest	Direct assignment to AccountRequest as Initiator.
AccountRequestAdvanced	Direct assignment to AccountRequestAdvanced as Initiator.
AccountRequestwithGroup	Direct assignment to AccountRequestwithGroup as Initiator.
AccountUnjoinPerson	Direct assignment to AccountUnjoinPerson as Initiator.
AddAccountsToGroups	Direct assignment to AddAccountsToGroups as Initiator.
AddExchangeMailboxAddress	Direct assignment to AddExchangeMailboxAddress as Initiator.
AddGroupResourceRole	Direct assignment to AddGroupResourceRole as Initiator.
AddGroupsToGroups	Direct assignment to AddGroupsToGroups as Initiator.
AddPeopleToGroups	Direct assignment to AddPeopleToGroups as Initiator.
AddPersonOrgZoneResourceTypeRole	Direct assignment to AddPersonOrgZoneResourceTypeRole as Initiator.
AddPersonResourceRole	Direct assignment to AddPersonResourceRole as Initiator.
AddRbacAssignmentToManagementRole	Direct assignment to AddRbacAssignmentToManagementRole as Initiator.
AddRbacResourceRoleAssignment	Direct assignment to AddRbacResourceRoleAssignment as Initiator.
AddResourceOrgZone	Direct assignment to AddResourceOrgZone as Initiator.
AssetAccessRequest	Direct assignment to AssetAccessRequest as Initiator.
AssetAccessRequestSelfService	Direct assignment to AssetAccessRequestSelfService as Initiator.
AssetProvision	Direct assignment to AssetProvision as Initiator.
AssetProvisionSelfService	Direct assignment to AssetProvisionSelfService as Initiator.
AssignAssetToPerson	Direct assignment to AssignAssetToPerson as Initiator.
AssignGroupOrgRoleOrgZone	Direct assignment to AssignGroupOrgRoleOrgZone as Initiator.
AssignGroupResourceRole	Direct assignment to AssignGroupResourceRole as Initiator.
AssignManagementRolesMultiResourcesMultiActors	Direct assignment to AssignManagementRolesMultiResourcesMultiActors as Initiator.
AssignOrgRoleOrgZone	Direct assignment to AssignOrgRoleOrgZone as Initiator.
AssignOrgRoleOrgZoneResourceRole	Direct assignment to AssignOrgRoleOrgZoneResourceRole as Initiator.
AssignPersonOrgRoleOrgZone	Direct assignment to AssignPersonOrgRoleOrgZone as Initiator.
AssignPersonResourceRole	Direct assignment to AssignPersonResourceRole as Initiator.
AssignSecondaryBusinessRoleandLocationSimpleUI	Direct assignment to AssignSecondaryBusinessRoleandLocationSimpleUI as Initiator.
AssignTokenToPerson	Direct assignment to AssignTokentoPerson as Initiator.
AuthenticationLevel2OATHLogin	Direct assignment to AuthenticationLevel2OATHLogin as Initiator.
Bulk Create People From Accounts	Direct assignment to Bulk Create People From Accounts as Initiator.
BulkAddRemoveExchangeMailboxEmailAddresses	Direct assignment to BulkAddRemoveExchangeMailboxEmailAddresses as Initiator.
BulkChangePrimaryBusinessRoleAndLocationNonUI	Direct assignment to BulkChangePrimaryBusinessRoleAndLocationNonUI as Initiator.
BulkCreatePeople	Direct assignment to BulkCreatePeople as Initiator.
BulkHideInGAL	Direct assignment to BulkHideInGAL as Initiator.
BulkMailenableGroup	Direct assignment to BulkMailenableGroup as Initiator.
ChangePassword	Direct assignment to ChangePassword as Initiator.
ChangePrimaryBusinessRoleLocationSimpleUI	Direct assignment to ChangePrimaryBusinessRoleLocationSimpleUI as Initiator.
ChangePrimaryOrgRoleOrgZone	Direct assignment to ChangePrimaryOrgRoleOrgZone as Initiator.
ClaimAccount	Direct assignment to ClaimAccount as Initiator.
ClaimPasswordVaultAccount	Direct assignment to ClaimPasswordVaultAccount as Initiator.
CopyUser	Direct assignment to CopyUser as Initiator.
CreateADGroup	Direct assignment to CreateADGroup as Initiator.
CreateBusinessRole	Direct assignment to CreateBusinessRole as Initiator.
CreateEquipment	Direct assignment to CreateEquipment as Initiator.
CreateExchangeMailbox	Direct assignment to CreateExchangeMailbox as Initiator.
CreateGroup	Direct assignment to CreateGroup as Initiator.
CreateLocation	Direct assignment to CreateLocation as Initiator.
CreateOU	Direct assignment to CreateOU as Initiator.
CreatePeopleFromFile	Direct assignment to CreatePeopleFromFile as Initiator.
CreatePersonAndAccount	Direct assignment to CreatePersonAndAccount as Initiator.
CreatePersonFromAccount	Direct assignment to CreatePersonFromAccount as Initiator.
CreatePersonSimple	Direct assignment to CreatePersonSimple as Initiator.
CreatePersonSuperSimple	Direct assignment to CreatePersonSuperSimple as Initiator.
CreateResourceMailbox	Direct assignment to CreateResourceMailbox as Initiator.
CreateTOTPToken	Direct assignment to CreateTOTPToken as Initiator.
CreateUser	Direct assignment to CreateUser as Initiator.
CreateUserAccount	Direct assignment to CreateUserAccount as Initiator.
CreateUserAndMailbox	Direct assignment to CreateUserAndMailbox as Initiator.
CreateUserHomeFolder	Direct assignment to CreateUserHomeFolder as Initiator.
CreateUserMailbox	Direct assignment to CreateUserMailbox as Initiator.
DeleteAccount	Direct assignment to DeleteAccount as Initiator.
DeleteComputer	Direct assignment to DeleteComputer as Initiator.
DeleteExchangeMailboxAddress	Direct assignment to DeleteExchangeMailboxAddress as Initiator.
DeleteGroup	Direct assignment to DeleteGroup as Initiator.
DeleteMailbox	Direct assignment to DeleteMailbox as Initiator.
DeleteOUAndItsChildObjects	Direct assignment to DeleteOUAndItsChildObjects as Initiator.
DisableAccount	Direct assignment to DisableAccount as Initiator.
DisableAutoAccept	Direct assignment to DisableAutoAccept as Initiator.
DisableComputer	Direct assignment to DisableComputer as Initiator.
DisableMailbox	Direct assignment to DisableMailbox as Initiator.
DisableOWA	Direct assignment to DisableOWA as Initiator.
DisableWireless	Direct assignment to DisableWireless as Initiator.
EditAcceptMessagesFrom	Direct assignment to EditAcceptMessagesFrom as Initiator.
EditAccount	Direct assignment to EditAccount as Initiator.
EditADUserHomeFolder	Direct assignment to EditADUserHomeFolder as Initiator.
EditAttestationPolicyNoUI	Direct assignment to EditAttestationPolicyNoUI as Initiator.
EditBulkAccount	Direct assignment to EditBulkAccount as Initiator.
EditExchangeMailboxAddress	Direct assignment to EditExchangeMailboxAddress as Initiator.
EditGroup	Direct assignment to EditGroup as Initiator.
EditMailbox	Direct assignment to EditMailbox as Initiator.
EditMailForwarding	Direct assignment to EditMailForwarding as Initiator.
EditOrgZoneResourceTypeRoleTimeConstraint	Direct assignment to EditOrgZoneResourceTypeRoleTimeConstraint as Initiator.
EditOU	Direct assignment to EditOU as Initiator.
EditPasswordVaultAccount	Direct assignment to EditPasswordVaultAccount as Initiator.
EditPerson	Direct assignment to EditPerson as Initiator.
EditPersonDemographics	Direct assignment to EditPersonDemographics as Initiator.
EditRejectMessagesFrom	Direct assignment to EditRejectMessagesFrom as Initiator.
EditSeparationOfDutiesPolicyNoUI	Direct assignment to EditSeparationOfDutiesPolicyNoUI as Initiator.
EditSharePointPersonProfile	Direct assignment to EditSharePointPersonProfile as Initiator.
EditSMTPAddresses	Direct assignment to EditSMTPAddresses as Initiator.
EditUserDemographics	Direct assignment to EditUserDemographics as Initiator.
EditVisibilityRBACObjectFilter	Direct assignment to EditVisibilityRBACObjectFilter as Initiator.
EnableAccount	Direct assignment to EnableAccount as Initiator.
EnableAutoAccept	Direct assignment to EnableAutoAccept as Initiator.
EnableComputer	Direct assignment to EnableAutoAccept as Initiator.
EnableMailboxWithBasicQuota	Direct assignment to EnableMailboxWithBasicQuota as Initiator.
EnableMailboxWithCorpQuota	Direct assignment to EnableMailboxWithCorpQuota as Initiator.
EnableOWA	Direct assignment to EnableOWA as Initiator.
EnableWireless	Direct assignment to EnableWireless as Initiator.
Enroll	Direct assignment to Enroll as Initiator.
Enrollment	Direct assignment to Enrollment as Initiator.
GetAndUpdateProfileWF	Direct assignment to GetAndUpdateProfileWF as Initiator.
HelpdeskAccountUnlock	Direct assignment to HelpdeskAccountUnlock as Initiator.
HelpdeskPasswordReset	Direct assignment to HelpdeskPasswordReset as Initiator.
HelpdeskSendOTP	Direct assignment to HelpdeskSendOTP as Initiator.
HideDLFromGAL	Direct assignment to HideDLFromGAL as Initiator.
HideMailbox	Direct assignment to HideMailbox as Initiator.
ImportOathTokens	Direct assignment to ImportOathTokens as Initiator.
JoinAccountToPerson	Direct assignment to JoinAccountToPerson as Initiator.
LaptopAssetAssignment	Direct assignment to LaptopAssetAssignment as Initiator.
LaptopAssetProvision	Direct assignment to LaptopAssetProvision as Initiator.
LaptopAssetRegistration	Direct assignment to LaptopAssetRegistration as Initiator.
LDAPCreateAccount	Direct assignment to LDAPCreateAccount as Initiator.
LDAPCreateGroup	Direct assignment to LDAPCreateAccount as Initiator.
LDAPCreateOU	Direct assignment to LDAPCreateAccount as Initiator.
Login	Direct assignment to Login as Initiator.
MailboxSizeDecrease	Direct assignment to MailboxSizeDecrease as Initiator.
MailboxSizeIncrease	Direct assignment to MailboxSizeIncrease as Initiator.
MailDisableAccount	Direct assignment to MailDisableAccount as Initiator.
MailDisableGroup	Direct assignment to MailDisableGroup as Initiator.
MailEnableAccount	Direct assignment to MailEnableAccount as Initiator.
MailEnableGroup	Direct assignment to MailEnableGroup as Initiator.
Move Computer	Direct assignment to Move Computer as Initiator.
MoveGroup	Direct assignment to MoveGroup as Initiator.
MoveMailbox	Direct assignment to MoveMailbox as Initiator.
MovePeopleFromOrgRoleOrgZoneToAnother	Direct assignment to MovePeopleFromOrgRoleOrgZoneToAnother as Initiator.
OrgRoleEdit	Direct assignment to OrgRoleEdit as Initiator.
PasswordExpirationNotification	Direct assignment to PasswordExpirationNotification as Initiator.
PasswordResetCenter	Direct assignment to PasswordResetCenter as Initiator.
PasswordCenterOTP	Direct assignment to PasswordCenterOTP as Initiator.
PersonAttributeDefaultValueEditNonResourceManager	Direct assignment to PersonAttributeDefaultValueEditNonResourceManager as Initiator.
PersonEdit	Direct assignment to PersonEdit as Initiator.
PersonEditNonResourceManager	Direct assignment to PersonEditNonResourceManager as Initiator.
PersonNew	Direct assignment to PersonNew as Initiator.
PersonPhotoApproval	Direct assignment to PersonPhotoApproval as Initiator.
ProfileManager	Direct assignment to ProfileManager as Initiator.
ProvisionAssetTypeRequest	Direct assignment to ProvisionAssetTypeRequest as Initiator.
ProvisionAttestationPolicy	Direct assignment to ProvisionAttestationPolicy as Initiator.
ProvisionCatalogRequest	Direct assignment to ProvisionCatalogRequest as Initiator.
ProvisionComputer	Direct assignment to ProvisionComputer as Initiator.
ProvisionSeparationOfDuties	Direct assignment to ProvisionSeparationOfDuties as Initiator.
ProvisionVisibilityRBACObjectFilter	Direct assignment to ProvisionVisibilityRBACObjectFilter as Initiator.
ProvisionVisibilityRBACObjectSelectColumn	Direct assignment to ProvisionVisibilityRBACObjectSelectColumn as Initiator.
ReinstateExchangeMailbox	Direct assignment to ReinstateExchangeMailbox as Initiator.
RemoveAccountsFromGroups	Direct assignment to RemoveAccountsFromGroups as Initiator.
RemoveGroupAccount	Direct assignment to RemoveGroupAccount as Initiator.
RemoveGroupOrgRoleOrgZone	Direct assignment to RemoveGroupOrgRoleOrgZone as Initiator.
RemoveGroupResourceRoleNoUI	Direct assignment to RemoveGroupResourceRoleNoUI as Initiator.
RemoveGroupsFromGroup	Direct assignment to RemoveGroupsFromGroup as Initiator.
RemoveOrgRoleOrgZoneFromGroups	Direct assignment to RemoveOrgRoleOrgZoneFromGroups as Initiator.
RemovePersonOrgRoleOrgZone	Direct assignment to RemovePersonOrgRoleOrgZone as Initiator.
RemovePersonOrgRoleOrgZoneNoUI	Direct assignment to RemovePersonOrgRoleOrgZoneNoUI as Initiator.
RemovePersonResourceRoleNoUI	Direct assignment to RemovePersonResourceRoleNoUI as Initiator.
RemoveRbacAssignmentFromManagementRole	Direct assignment to RemoveRbacAssignmentFromManagementRole as Initiator.
RemoveRbacResourceRoleAssignment	Direct assignment to RemoveRbacResourceRoleAssignment as Initiator.
RemoveRbacResourceRoleAssignmentAsActor	Direct assignment to RemoveRbacResourceRoleAssignmentAsActor as Initiator.
RemoveResourceFromOrgZone	Direct assignment to RemoveResourceFromOrgZone as Initiator.
RemoveResourceOrgZoneNoUI	Direct assignment to RemoveResourceOrgZoneNoUI as Initiator.
ResetComputer	Direct assignment to ResetComputer as Initiator.
ResetAccountPassword	Direct assignment to ResetAccountPassword as Initiator.
ResetPassword	Direct assignment to ResetPassword as Initiator.
ResetPasswordVaultAccountPassword	Direct assignment to ResetPasswordVaultAccountPassword as Initiator.
Resource Manager Delete Person	Direct assignment to Resource Manager Delete Person as Initiator.
Resource Manager Update Computer	Direct assignment to Resource Manager Update Computer as Initiator.
Resource Manager Update OrgZone	Direct assignment to Resource Manager Update OrgZone as Initiator.
Resource Manager Update Person	Direct assignment to Resource Manager Update Person as Initiator.
ResourceEntitlementEditNonResourceManager	Direct assignment to ResourceEntitlementEditNonResourceManager as Initiator.
ResourceManagerAccountDelete	Direct assignment to ResourceManagerAccountDelete as Initiator.
ResourceManagerAccountUpdate	Direct assignment to ResourceManagerAccountUpdate as Initiator.
ResourceManagerEditGroup	Direct assignment to ResourceManagerEditGroup as Initiator.
ResourceManagerUpdateMailbox	Direct assignment to ResourceManagerUpdateMailbox as Initiator.
RestoreDeletedAccount	Direct assignment to RestoreDeletedAccount as Initiator.
RevokeResourceRoleNoUI	Direct assignment to RevokeResourceRoleNoUI as Initiator.
SelfServiceAccountJoinGroup	Direct assignment to SelfServiceAccountJoinGroup as Initiator.
SelfServicePersonJoinGroup	Direct assignment to SelfServicePersonJoinGroup as Initiator.
SelfServicePersonLeaveGroup	Direct assignment to SelfServicePersonLeaveGroup as Initiator.
SetAsPrimaryExchangeMailboxAddress	Direct assignment to SetAsPrimaryExchangeMailboxAddress as Initiator.
SetUserManager	Direct assignment to SetUserManager as Initiator.
ShowDLInGAL	Direct assignment to ShowDLInGAL as Initiator.
ShowMailbox	Direct assignment to ShowMailbox as Initiator.
SubmitSingleAttestationResponse	Direct assignment to SubmitSingleAttestationResponse as Initiator.
SubmitSingleSodViolationResponse	Direct assignment to SubmitSingleSodViolationResponse as Initiator.
TerminatePerson	Direct assignment to TerminatePerson as Initiator.
UnenrollPerson	Direct assignment to UnenrollPerson as Initiator.
UnlockAccount	Direct assignment to UnlockAccount as Initiator.
UnlockFromRecoveryCenter	Direct assignment to UnlockFromRecoveryCenter as Initiator.
UnlockPersonAndAccounts	Direct assignment to UnlockPersonAndAccounts as Initiator.
UpdateDirectAssignmentTimeConstraint	Direct assignment to UpdateDirectAssignmentTimeConstraint as Initiator.
UpdateGroupAccountMembership	Direct assignment to UpdateGroupAccountMembership as Initiator.
UpdateGroupBusinessRoles	Direct assignment to UpdateGroupBusinessRoles as Initiator.
UpdateManagementRoleAssignments	Direct assignment to UpdateManagementRoleAssignments as Initiator.
UpdateOrgRoleListAsSuggestedOrgZones	Direct assignment to UpdateOrgRoleListAsSuggestedOrgZones as Initiator.
UpdateOrgRoleOrgZoneGroups	Direct assignment to UpdateOrgRoleOrgZoneGroups as Initiator.
UpdateOrgRoleOrgZonePasswordManagerPolicyID	Direct assignment to UpdateOrgRoleOrgZonePasswordManagerPolicyID as Initiator.
UpdateOrgRoleOrgZonePeople	Direct assignment to UpdateOrgRoleOrgZonePeople as Initiator.
UpdateOrgRoleOrgZoneProfileManagerPolicyID	Direct assignment to UpdateOrgRoleOrgZoneProfileManagerPolicyID as Initiator.
UpdateOrgRoleOrgZoneSetGroupID	Direct assignment to UpdateOrgRoleOrgZoneSetGroupID as Initiator.
UpdateOrgRoleOrgZoneSetGroups	Direct assignment to UpdateOrgRoleOrgZoneSetGroups as Initiator.
UpdatePasswordManagerPolicyAssignments	Direct assignment to UpdatePasswordManagerPolicyAssignments as Initiator.
UpdateProtectedApplications	Direct assignment to UpdateProtectedApplications as Initiator.
UpdateResourceAssignments	Direct assignment to UpdateResourceAssignments as Initiator.
UpdateResourceAssignmentsByResource	Direct assignment to UpdateResourceAssignmentsByResource as Initiator.
UpdateResourceTypeRoleOperations	Direct assignment to UpdateResourceTypeRoleOperations as Initiator.
UpdateResourceTypeRoleRights	Direct assignment to UpdateResourceTypeRoleRights as Initiator.
UpdateSSOApplication	Direct assignment to UpdateSSOApplication as Initiator.
UpdateSSOApplicationDefinition	Direct assignment to UpdateSSOApplicationDefinition as Initiator.
ViewPerson	Direct assignment to ViewPerson as Initiator.

Users with this Management Role have enterprise-wide ability to perform limited management of users, people and groups.

\\

In this table, the Assignment Type is Scope At Location, and the Access Level is Help Desk.

\\

Resource Type	Assignment Description
Person	Assignment to any Person as Help Desk scoped at Anywhere
User Account	Assignment to any User Account as Help Desk scoped at Anywhere.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
AccountManager.aspx	Direct assignment to AccountManager.aspx as Viewer.
AccountsWithoutManager	Direct assignment to AccountsWithoutManager as Viewer.
ActionsByPerson	Direct assignment to ActionsByPerson as Viewer.
ActionsToPerson	Direct assignment to ActionsToPerson as Viewer.
Addresses	Direct assignment to Addresses as Viewer.
ChangeManager.aspx	Direct assignment to ChangeManager.aspx as Viewer.
Delegations management page	Direct assignment to Delegations management page as Viewer.
DeletedGroups	Direct assignment to DeletedGroups as Viewer.
DeletedPeople	Direct assignment to DeletedPeople as Viewer.
DeletedUsers	Direct assignment to DeletedUsers as Viewer.
Directory Manager	Direct assignment to Directory Manager as Viewer.
DisabledUsers	Direct assignment to DisabledUsers as Viewer.
DomainControllers	Direct assignment to DomainControllers as Viewer.
EmptyGroups	Direct assignment to EmptyGroups as Viewer.
Find Computer Page	Direct assignment to Find Computer Page as Viewer.
Find Group Page	Direct assignment to Find Group Page as Viewer.
Find OrgRolOrgZone Page	Direct assignment to Find OrgRoleOrgZone Page as Viewer.
Find ProtectedApplicationResourceApplication Page	Direct assignment to Find ProtectedApplicationResourceApplication Page as Viewer.
Find User Account Page	Direct assignment to Find User Account Page as Viewer.
GroupMembersForGroup	Direct assignment to GroupMembersForGroup as Viewer.
GroupMembershipChanges	Direct assignment to GroupMembershipChanges as Viewer.
GroupMembershipChangesHighSecurity	Direct assignment to GroupMembershipChangesHighSecurity as Viewer.
GroupMembershipForAccount	Direct assignment to GroupMembershipForAccount as Viewer.
GroupMembershipForPerson	Direct assignment to GroupMembershipForPerson as Viewer.
Identity Manager	Direct assignment to Identity Manager as Viewer.
LockedOutUsers	Direct assignment to LockedOutUsers as Viewer.
LoginHistory	Direct assignment to LoginHistory as Viewer.
LoginsByLocation	Direct assignment to LoginsByLocation as Viewer.
MembershipChangesByAccount	Direct assignment to MembershipChangesByAccount as Viewer.
MembershipChangesByGroup	Direct assignment to MembershipChangesByGroup as Viewer.
MembershipChangesByPerson	Direct assignment to MembershipChangesByPerson as Viewer.
OrphanAccountsByLocation	Direct assignment to OrphanAccountsByLocation as Viewer.
PasswordManagementActivityByDate	Direct assignment to PasswordManagementActivityByDate as Viewer.
PasswordManagerEnrollment	Direct assignment to PasswordManagerEnrollment as Viewer.
PasswordManagerNotEnrolled	Direct assignment to PasswordManagerNotEnrolled as Viewer.
PeopleByRoleandLocation	Direct assignment to PeopleByRoleandLocationas Viewer.
PeopleByRoleReport	Direct assignment to PeopleByRoleReport as Viewer.
PeopleWithoutAccounts	Direct assignment to PeopleWithoutAccounts as Viewer.
PersonLoginHistory	Direct assignment to PersonLoginHistory as Viewer.
PersonManager.aspx	Direct assignment to PersonManager.aspx as Viewer.
PossibleStaleComputers	Direct assignment to PossibleStaleComputers as Viewer.
ResourceRolesForPerson	Direct assignment to ResourceRolesForPerson as Viewer.
UserAttributeChanges	Direct assignment to UserAttributeChanges as Viewer.
UsersNeverLoggedIn	Direct assignment to UsersNeverLoggedIn as Viewer.
UsersPasswordNeverExpires	Direct assignment to UsersPasswordNeverExpires as Viewer.
WorkflowsByInitiator	Direct assignment to WorkflowsByInitiator as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AccountRequest	Direct assignment to AccountRequest as Initiator.
AccountRequestAdvanced	Direct assignment to AccountRequestAdvanced as Initiator.
AccountRequestwithGroup	Direct assignment to AccountRequestwithGroup as Initiator.
AddAcountsToGroups	Direct assignment to AddAccountsToGroups as Initiator.
AddPeopleToGroups	Direct assignment to AddPeopleToGroups as Initiator.
Bulk Create People From Accounts	Direct assignment to Bulk Create People From Accounts as Initiator.
BulkCreatePeople	Direct assignment to BulkCreatePeople as Initiator.
ChangePassword	Direct assignment to ChangePassword as Initiator.
CopyUser	Direct assignment to CopyUser as Initiator.
CreatePersonAndAccount	Direct assignment to CreatePersonAndAccount as Initiator.
CreatePersonSimple	Direct assignment to CreatePersonSimple as Initiator.
CreateUser	Direct assignment to CreateUser as Initiator.
CreateUserHomeFolder	Direct assignment to CreateUserHomeFolder as Initiator.
DeleteComputer	Direct assignment to DeleteComputer as Initiator.
DeleteOUAndItsChildObjects	Direct assignment to DeleteOUAndItsChildObjects as Initiator.
DisableAccount	Direct assignment to DisableAccount as Initiator.
DisableComputer	Direct assignment to DisableComputer as Initiator.
EditAccount	Direct assignment to EditAccount as Initiator.
EditADUserHomeFolder	Direct assignment to EditADUserHomeFolder as Initiator.
EditBulkAccount	Direct assignment to EditBulkAccount as Initiator.
EditGroup	Direct assignment to EditGroup as Initiator.
EditOU	Direct assignment to EditOU as Initiator.
EditPersonDemographics	Direct assignment to EditPersonDemographics as Initiator.
EditUserDemographics	Direct assignment to EditUserDemographics as Initiator.
EnableAccount	Direct assignment to EnableAccount as Initiator.
EnableComputer	Direct assignment to EnableComputer as Initiator.
Enroll	Direct assignment to Enroll as Initiator.
Enrollment	Direct assignment to Enrollment as Initiator.
GetAndUpdateProfileWF	Direct assignment to GetAndUpdateProfileWF as Initiator.
HelpdeskAccountUnlock	Direct assignment to HelpdeskAccountUnlock as Initiator.
HelpdeskPasswordReset	Direct assignment to HelpdeskPasswordReset as Initiator.
HelpdeskSendOTP	Direct assignment to HelpdeskSendOTP as Initiator.
LaptopAssetAssignment	Direct assignment to LaptopAssetAssignment as Initiator.
LaptopAssetProvision	Direct assignment to LaptopAssetProvision as Initiator.
LaptopAssetRegistration	Direct assignment to LaptopAssetRegistration as Initiator.
Login	Direct assignment to Login as Initiator.
Move computer	Direct assignment to Move Computer as Initiator.
MoveGroup	Direct assignment to MoveGroup as Initiator.
PasswordExpirationNotification	Direct assignment to PasswordExpirationNotification as Initiator.
PasswordResetCenter	Direct assignment to PasswordResetCenter as Initiator.
PasswordResetCenterOTP	Direct assignment to PasswordResetCenterOTP as Initiator.
PersonEdit	Direct assignment to PersonEdit as Initiator.
PersonNew	Direct assignment to PersonNew as Initiator.
ProfileManager	Direct assignment to ProfileManager as Initiator.
ProvisionComputer	Direct assignment to ProvisionComputer as Initiator.
RemoveAccountsFromGroups	Direct assignment to RemoveAccountsFromGroups as Initiator.
RemoveGroupAccount	Direct assignment to RemoveGroupAccount as Initiator.
Reset Computer	Direct assignment to Reset Computer as Initiator.
ResetAccountPassword	Direct assignment to ResetAccountPassword as Initiator.
ResetPassword	Direct assignment to ResetPassword as Initiator.
ResourceManagerAccountDelete	Direct assignment to ResourceManagerAccountDelete as Initiator.
ResourceManagerAccountUpdate	Direct assignment to ResourceManagerAccountUpdate as Initiator.
ResourceManagerEditGroup	Direct assignment to ResourceManagerEditGroup as Initiator.
RestoreDeletedAccount	Direct assignment to RestoreDeletedAccount as Initiator.
SelfServiceAccountJoinGroup	Direct assignment to SelfServiceAccountJoinGroup as Initiator.
SelfServicePersonJoinGroup	Direct assignment to SelfServicePersonJoinGroup as Initiator.
SelfServicePersonLeaveGroup	Direct assignment to SelfServicePersonLeaveGroup as Initiator.
TestDatasource	Direct assignment to TestDatasource as Initiator.
UnlockAccount	Direct assignment to UnlockAccount as Initiator.
UnlockFromRecoveryCenter	Direct assignment to UnlockFromRecoveryCenter as Initiator.
UnlockPersonAndAccounts	Direct assignment to UnlockPersonAndAccounts as Initiator.
ViewPerson	Direct assignment to ViewPerson as Initiator.

Users with this Management Role have enterprise-wide ability to manage all user and person passwords.

\\

Assignment Type	Resource Type	Resource	Access Level	Assignment Description
Scoped At Location	Person	N/A	Password Reset and Unlock	Assignment to any Person as Password Reset and Unlock scoped at Anywhere
Direct	Control (User Interface)	Request Center Global Stats	Viewer	Direct assignment to Request Center Global Stats as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Directory Manager	Direct assignment to Directory Manager as Viewer.
DisabledUsers	Direct assignment to DisabledUsers as Viewer.
HelpdeskView.aspx	Direct assignment to HelpdeskView.aspx as Viewer.
Identity Manager	Direct assignment to Identity Manager as Viewer.
LockedOutUsers	Direct assignment to LockedOutUsers as Viewer.
PasswordManagementActivityByDate	Direct assignment to PasswordManagementActivityByDate as Viewer.
PasswordManagerEnrollment	Direct assignment to PasswordManagerEnrollment as Viewer.
PasswordManagerNotEnrolled	Direct assignment to PasswordManagerNotEnrolled as Viewer.
UsersPasswordNeverExpires	Direct assignment to UsersPasswordNeverExpires as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ChangePassword	Direct assignment to ChangePassword as Initiator.
CreateTOTPToken	Direct assignment to CreateTOTPToken as Initiator.
Enroll	Direct assignment to Enroll as Initiator.
Enrollment	Direct assignment to Enrollment as Initiator.
HelpdeskAccountUnlock	Direct assignment to HelpdeskAccountUnlock as Initiator.
HelpdeskPasswordReset	Direct assignment to HelpdeskPasswordReset as Initiator.
HelpdeskSendOTP	Direct assignment to HelpdeskSendOTP as Initiator.
PasswordExpirationNotification	Direct assignment to PasswordExpirationNotification as Initiator.
PasswordResetCenter	Direct assignment to PasswordResetCenter as Initiator.
PasswordResetCenterOTP	Direct assignment to PasswordResetCenterOTP as Initiator.
ResetAccountPassword	Direct assignment to ResetAccountPassword as Initiator.
ResetPassword	Direct assignment to ResetPassword as Initiator.
UnenrollPerson	Direct assignment to UnenrollPerson as Initiator.
UnlockFromRecoveryCenter	Direct assignment to UnlockFromRecoveryCenter as Initiator.

Users with this Management Role have the ability to author RBAC policies and delegations.

This Management Role allows assignees to create, edit, and delete Management Roles and define the Resources Roles they grant. It is not intended for use in assigning people to Management Roles.

\\

In this table, the Assignment Type is Scoped At Location.

\\

Resource Type	Access Level	Assignment Description
Access Request	Access Manager	Assignment to any Access Request as Access Manager scoped at Anywhere.
Alert	Access Manager	Assignment to any Alert as Access Manager scoped at EmpowerID System.
Application	Access Manager	Assignment to any Application as Access Manager scoped at EmpoewrID system.
Approval Routing Group	Access Manager	Assignment to any Approval Routing Group as Access Manager scoped at EmpowerID System.
Asset Request	Access Manager	Assignment to any Asset Request as Access Manager scoped at Anywhere.
Audit	Access Manager	Assignment to any Audit as Access Manager scoped at EmpowerID System.
Business Role	Access Manager	Assignment to any Business Role as Access Manager scoped at EmpowerID System.
Computer	Access Manager	Assignment to any Computer as Access Manager scoped at Anywhere.
Control (User Interface)	Access Manager	Assignment to any Control (User Interface) as Access Manager scoped at EmpowerID System.
EmpowerID System	Access Manager	Assignment to any EmpowerID System as Access Manager scoped at EmpowerID System.
EmpowerID System	Access Manager	Assignment to any EmpowerID System as Access Manager scoped at Anywhere.
Exchange Contact	Access Manager	Assignment to any Exchange Contact as Access Manager scoped at Anywhere.
Exchange Mailbox	Access Manager	Assignment to any Exchange Mailbox as Access Manager scoped at Anywhere.
Exchange Public Folder	Access Manager	Assignment to any Exchange Public Folder as Access Manager scoped at Anywhere.
External Credential	Access Manager	Assignment to any External Credential as Access Manager scoped at Anywhere.
Folder (Shared)	Access Manager	Assignment to any Folder (Shared) as Access Manager scoped at Anywhere.
Generic Asset	Access Manager	Assignment to any Generic Asset as Access Manager scoped at Anywhere.
Generic Asset (AD Protected)	Access Manager	Assignment to any Generic Asset (AD Protected) as Access Manager scoped at Anywhere.
Group (Generic)	Access Manager	Assignment to any Group (Generic) as Access Manager scoped at Anywhere.
Group (Security)	Access Manager	Assignment to any Group (Security) as Access Manager scoped at Anywhere.
Location	Access Manager	Assignment to any Location as Access Manager scoped at EmpowerID System.
Lync User	Access Manager	Assignment to any Lync User as Access Manager scoped at Anywhere.
Management Role	Access Manager	Assignment to any Management Role as Access Manager scoped at EmpowerID System.
Management Role	Administrator	Assignment to any Management Role as Administrator scoped at Anywhere.
Management Role Definition	Access Manager	Assignment to any Management Role Definition as Access Manager scoped at EmpowerID System.
Organization	Access Manager	Assignment to any Person as Access Manager scoped at EmpowerID System.
Pages and Reports	Access Manager	Assignment to Pages and Reports as Access Manager scoped at EmpowerID System.
Person	Resource Role Assignee	Assignment to any Person as Access Manager scoped at EmpowerID System.
Printer (Shared)	Access Manager	Assignment to any Printer (Shared) as Access Manager scoped at Anywhere.
Query-Based Collection (SetGroup)	Access Manager	Assignment to any Query-Based Collection (SetGroup) as Access Manager scoped at EmpowerID System.
Separation of Duties Policy	Access Manager	Assignment to any Separation of Duties Policy as Access Manager scoped at Anywhere.
SSO Application	Access Manager	Assignment to any SSO Application as Access Manager scoped at EmpowerID System.
SSO Application Definition	Access Manager	Assignment to any SSO Application Definition as Access Manager scoped at EmpowerID System.
SSO SAML Connection	Access Manager	Assignment to any SSO SAML Connection as Access Manager scoped at EmpowerID System.
SSO WS-Federation Connection	Access Manager	Assignment to any SSO WS-Federation Connection as Access Manager scoped at EmpowerID System.
User Account	Access Manager	Assignment to any User Account as Access Manager scoped at EmpowerID System.
Web Service	Access Manager	Assignment to any Web Service as Access Manager scoped at EmpowerID System.
Workflow	Access Manager	Assignment to any Workflow as Access Manager scoped at EmpowerID System.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Resource Manager: Management Role Assignees	Direct assignment to Resource Manager: Management Role Assignees as Viewer.
Resource Manager: Directly Assigned Locations	Direct assignment to Resource Manager: Directly Assigned Locations as Viewer
Management Role Resource Type dropdown item	Direct assignment to Management Role Resource Type dropdown as Viewer
Resource Manager: Management Role Resource Role Assignments	Direct assignment to Resource Manager: Management Role Resource Role Assignments as Viewer
Resource Manager: Management Role Resultant Set of Resource Roles	Direct assignment to Resource Manager: Management Role Resultant Set of Resource Roles as Viewer

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Access Level	Assignment Description
AddRbacAssignmentToManagementRole	Viewer	Direct assignment to AddRbacAssignmentToManagementRole as Initiator
AddResourceOrgZone	Initiator	Direct assignment to AddResourceOrgZone as Initiator
DeleteManagementRole	Viewer	Direct assignment to DeleteManagementRole as Initiator
EditManagementRoleNoUI	Initiator	Direct assignment to EditManagementRoleNoUI as Initiator
ProvisionManagementRole	Initiator	Direct assignment to ProvisionManagementRole as Initiator.
RemoveRbacAssignmentFromManagementRole	Initiator	Direct assignment to RemoveRbacAssignmentFromManagementRole as Initiator.
RemoveResourceFromOrgZone	Initiator	Direct assignment to RemoveResourceFromOrgZone as Initiator
RemoveResourceOrgZoneNoUI	Initiator	Direct assignment to RemoveResourceOrgZoneNoUI as Initiator
UpdateResourceAssignments	Initiator	Direct assignment to UpdateResourceAssignments as Initiator
UpdateResourceAssignmentsByResource	Initiator	Direct assignment to UpdateResourceAssignmentsByResource as Initiator

Users with this Management Role have enterprise-wide ability to manage all SharePoint webs and groups.

\\

In this table, the Assignment Type is Scoped At Location and the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
SharePoint Group	Assignment to any SharePoint Group as All Access (EmpowerID Admin) scoped at All IT Systems.
SharePoint Web Site	Assignment to any SharePoint Web Site as All Access (EmpowerID Admin) scoped at All IT Systems.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Find SharePointGroup Page	Direct assignment to Find SharePointGroup Page as Viewer.
Find SharePointWeb Page	Direct assignment to Find SharePointWeb Page as Viewer.
GroupManager.aspx	Direct assignment to GroupManager.aspx as Viewer.
PersonManger.aspx	Direct assignment to PersonManager.aspx as Viewer.
SimpleWhitePages.aspx	Direct assignment to SimpleWhitePages.aspx as Viewer.
WhitePages.aspx	Direct assignment to WhitePages.aspx as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AddGroupResourceRole	Direct assignment to AddGroupResourceRole as Initiator.
AddGroupsToGroup	Direct assignment to AddGroupsToGroup as Initiator.
AddPeopleToGroups	Direct assignment to AddPeopleToGroups as Initiator.
EditSharePointPersonProfile	Direct assignment to EditSharePointPersonProfile as Initiator.

Users with this Management Role have enterprise-wide ability to manage all users.

\\

In this table, the Assignment Type is Scoped At Location and the Access Level is Viewer.

\\

Resource Type	Assignment Description
Person	Assignment to any Person as All Access (EmpowerID Admin) scoped at Anywhere.
User Account	Assignment to any User Account as EmpowerID Administrator scoped at Anywhere.
Exchange Account	Assignment to any Exchange Contact as EmpowerID Administrator scoped at Anywhere.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Account Resource Type dropdown item	Direct assignment to Account Resource Type dropdown item as Viewer.
DeletedAccounts	Direct assignment to DeletedAccounts as Viewer.
Deleted Exchange Mailboxes	Direct assignment to Deleted Exchange Mailboxes as Viewer.
Deleted Groups	Direct assignment to Deleted Groups as Viewer.
Deleted Person Objects	Direct assignment to Deleted Person Objects as Viewer.
Exchange Mail Contact Resource Type dropdown item	Direct assignment to Exchange Mail Contact Resource Type dropdown item as Viewer.
Group Membership Change Log	Direct assignment to Group Membership Change Log as Viewer.
Inbound Attribute Changes	Direct assignment to Inbound Attribute Changes as Viewer.
New Account Inbox	Direct assignment to New Account Inbox as Viewer.
Operation Audit Log	Direct assignment to Operation Audit Log as Viewer.
Orphan Accounts	Direct assignment to Orphan Accounts as Viewer.
Outbound Attribute Changes	Direct assignment to Outbound Attribute Changes as Viewer.
Person Manager Enrollment	Direct assignment to Password Manager Enrollment as Viewer.
Person Login History	Direct assignment to Person Login History as Viewer.
Person Resource Type dropdown item	Direct assignment to Person Resource Type dropdown item as Viewer.
Recently Created Objects	Direct assignment to Recently Created Objects as Viewer.
Request Center Global Stats	Direct assignment to Request Center Global Stats as Viewer.
Resource Manager: Access Granted To Account	Direct Assignment to Resource Manager: Access Granted To Account.
Resource Manager: Access Granted To Group	Assignment to Resource Manager: Access Granted To Group as Viewer.
Resource Manager: Access Granted To Person	Direct assignment to Resource Manager: Access Granted To Person as Viewer.
Resource Manager: Account Resultant Set Of Resource Roles	Direct assignment to Resource Manager: Account Resultant Set of Resource Roles as Viewer.
Resource Manager: Audit History By Person	Direct assignment to Resource Manager: Audit History By Person as Viewer.
Resource Manager: Group Account	Direct assignment to Resource Manager: Group Account as Viewer.
Resource Manager: Group Account History By Account	Assignment to Resource Manager: Group Account History By Account as Viewer.
Resource Manager: Group Account History By Group	Assignment to Resource Manager: Group Account History By Group as Viewer.
Resource Manager: Group Account History By Person	Direct assignment to Resource Manager: Group Account History By Person as Viewer.
Resource Manager: Person Account	Direct assignment to Resource Manager: Person Account as Viewer.
Resource Manager: Person Business Roles	Direct assignment to Resource Manager: Person Business Roles as Viewer.
Resource Manager: Person Group Membership	Direct assignment to Resource Manager: Person Group Membership as Viewer.
Resource Manager: Person Resultant Set Of Resource Roles	Direct assignment to Resource Manager: Person Resultant Set of Resource Roles as Viewer.
Resource Manager: Resultant Resource Locations	Direct assignment to Resource Manager: Resultant Resource Locations as Viewer.
Resource Manager: Resultant Set of Security	Direct assignment to Resource Manager: Resultant Set of Security as Viewer.
Resource Manager: Security	Direct assignment to Resource Manager: security as Viewer.
Resources Pending RBAC Processing	Direct assignment to Resources Pending RBAC Processing as Viewer.
Workflow Error Log	Direct assignment to Workflow Error Log as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
AccountManager.aspx	Direct assignment to AccountManager.aspx as Viewer.
ChangeManager.aspx	Direct assignment to ChangeManager.aspx as Viewer.
Create Application page	Direct assignment to Create Application page as Viewer.
Find ProtectedApplicationResourceApplication page	Direct assignment to Find ProtectedApplicationResourceApplication page as Viewer.
HelpdeskView.aspx	Direct assignment to HelpdeskView.aspx as Viewer.
PersonManger.aspx	Direct assignment to PersonManager.aspx as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AccountRequest	Direct assignment to AccountRequest as Initiator.
AccountRequestAdvanced	Direct assignment to AccountRequestAdvanced as Initiator.
AccountRequestwithGroup	Direct assignment to AccountRequestwithGroup as Initiator.
AddAccountsToGroups	Direct assignment to AddAccountsToGroups as Initiator.
AddPeopleToGroups	Direct assignment to AddPeopleToGroups as Initiator.
Bulk Create People From Accounts	Direct assignment to Bulk Create People From Accounts as Initiator.
BulkCreatePeople	Direct assignment to BulkCreatePeople as Initiator.
BulkMailenableGroup	Direct assignment to BulkMailenableGroup as Initiator.
ChangePassword	Direct assignment to ChangePassword as Initiator.
ChangePrimaryBusinessRoleLocationSimpleUI	Direct assignment to ChangePrimaryBusinessRoleLocationSimpleUI as Initiator.
ChangePrimaryOrgRoleOrgZone	Direct assignment to ChangePrimaryOrgRoleOrgZone as Initiator.
ClaimAccount	Direct assignment to ClaimAccount as Initiator.
CopyUser	Direct assignment to CopyUser as Initiator.
CreatePersonAndAccount	Direct assignment to CreatePersonAndAccount as Initiator.
CreatePersonFromAccount	Direct assignment to CreatePersonFromAccount as Initiator.
CreateUser	Direct assignment to CreateUser as Initiator.
CreateUserAccount	Direct assignment to CreateUserAccount as Initiator.
CreateUserAndMailbox	Direct assignment to CreateUserAndMailbox as Initiator.
CreateUserHomeFolder	Direct assignment to CreateUserHomeFolder as Initiator.
DeleteAccount	Direct assignment to DeleteAccount as Initiator.
DisableAccount	Direct assignment to DisableAccount as Initiator.
EditAccount	Direct assignment to EditAccount as Initiator.
EditADUserHomeFolder	Direct assignment to EditADUserHomeFolder as Initiator.
EditBulkAccount	Direct assignment to EditBulkAccount as Initiator.
EditPersonDemographics	Direct assignment to EditPersonDemographics as Initiator.
EditUserDemographics	Direct assignment to EditUserDemographics as Initiator.
EnableAccount	Direct assignment to EnableAccount as Initiator.
Enroll	Direct assignment to Enroll as Initiator.
Enrollment	Direct assignment to Enrollment as Initiator.
GetAndUpdateProfileWF	Direct assignment to Request Workflow:GetAndUpdateProfileWF as Initiator.
HelpdeskAccountUnlock	Direct assignment to HelpdeskAccountUnlock as Initiator.
HelpdeskPasswordReset	Direct assignment to HelpdeskPasswordReset as Initiator.
HelpdeskSendOTP	Direct assignment to HelpdeskSendOTP as Initiator.
JoinAccountToPerson	Direct assignment to JoinAccountToPerson as Initiator.
MailEnableAccount	Direct assignment to MailEnableAccount as Initiator.
PasswordExpirationNotification	Direct assignment to PasswordExpirationNotification as Initiator.
PasswordResetCenter	Direct assignment to PasswordResetCenter as Initiator.
PasswordResetCenterOTP	Direct assignment to PasswordResetCenterOTP as Initiator.
PersonEdit	Direct assignment to PersonEdit as Initiator.
PersonEditNonResourceManager	Direct assignment to PersonEditNonResourceManager as Initiator.
PersonNew	Direct assignment to PersonNew as Initiator.
ProfileManager	Direct assignment to ProfileManager as Initiator.
RemoveAccountFromGroups	Direct assignment to RemoveAccountFromGroups as Initiator.
RemoveGroupAccount	Direct assignment to RemoveGroupAccount as Initiator.
RemoveRbacResourceRoleAssignment	Direct assignment to RemoveRbacResourceRoleAssignment as Initiator.
ResetAccountPassword	Direct assignment to ResetAccountPassword as Initiator.
ResetPassword	Direct assignment to ResetPassword as Initiator.
ResourceManagerDeletePerson	Direct assignment to ResourceManagerDeletePerson as Initiator.
ResourceManagerUpdatePerson	Direct assignment to ResourceManagerUpdatePerson as Initiator.
ResourceManagerAccountDelete	Direct assignment to ResourceManagerAccountDelete as Initiator.
ResourceManagerAccountUpdate	Direct assignment to ResourceManagerAccountUpdate as Initiator.
RestoreDeletedAccount	Direct assignment to RestoreDeletedAccount as Initiator.
RETDeprovisionADAccount	Direct assignment to RETDeprovisionADAccount as Initiator.
SelfServiceAccountJoinGroup	Direct assignment to SelfServiceAccountJoinGroup as Initiator.
SelfServicePersonJoinGroup	Direct assignment to SelfServicePersonJoinGroup as Initiator.
SelfServicePersonLeaveGroup	Direct assignment to SelfServicePersonLeaveGroup as Initiator.
TerminatePerson	Direct assignment to TerminatePerson as Initiator.
TestDatasource	Direct assignment to TestDatasource as Initiator.
UnenrollPerson	Direct assignment to UnenrollPerson as Initiator.
Update Person	Direct assignment to Update Person as Initiator.
UnjoinAccountFromPerson	Direct assignment to UnjoinAccountFromPerson as Initiator.
UnlockAccount	Direct assignment to UnlockAccount as Initiator.
UnlockPersonAndAccounts	Direct assignment to UnlockPersonAndAccounts as Initiator.
UnlockFromRecoveryCenter	Direct assignment to EnableAccount as Initiator.
ViewPerson	Direct assignment to ViewPerson as Initiator.

Users with this Management Role receive notifications of group membership changes.

Users with this Management Role have full access to the IT Shop workflows and user interfaces to allow access requests and resource management.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
IT Shop Workflows	Direct Assignment to IT Shop Workflows as Viewer.
Shopping Cart	Direct Assignment to Shopping Cart as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
IT Shop I Manage	Direct Assignment to IT Shop I Manage as Viewer.
IT Shop My Access	Direct Assignment to IT Shop My Access as Viewer.
IT Shop Request Access	Direct Assignment to IT Shop Request Access as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AddBusinessProcessTaskComment	Direct Assignment to AddBusinessProcessTaskComment as Initiator.
AddCommentToTask	Direct Assignment to AddCommentToTask as Initiator.
ClaimBusinessProcessTask	Direct Assignment to ClaimBusinessProcessTask as Initiator.
ClaimSSOAccount	Direct Assignment to ClaimSSOAccount as Initiator.
CreateApplicationUser	Direct Assignment to CreateApplicationUser as Initiator.
CreateAsset	Direct Assignment to CreateAsset as Initiator.
CreateAssetMailbox	Direct Assignment to CreateAssetMailbox as Initiator.
CreateGenericAsset	Direct Assignment to CreateGenericAsset as Initiator.
ProvisionAssetForPerson	Direct Assignment to ProvisionAssetForPerson as Initiator.
RemoveBusinessProcessTaskDelegate	Direct Assignment to RemoveBusinessProcessTaskDelegate as Initiator.
SetBusinessProcessTaskDelegate	Direct Assignment to SetBusinessProcessTaskDelegate as Initiator.
TerminateWorkflow	Direct Assignment to TerminateWorkflow as Initiator.
UnclaimBusinessProcessTask	Direct Assignment to UnclaimBusinessProcessTask as Initiator.
UpdateAccountGroupMembership	Direct Assignment to UpdateAccountGroupMembership as Initiator.
UpdateDirectAssignmentTimeConstraint	Direct Assignment to UpdateDirectAssignmentTimeConstraint as Initiator.
UpdateManagementRoleAssignments	Direct Assignment to UpdateManagementRoleAssignments as Initiator.
UpdatePersonApplicationGroupMembership	Direct Assignment to UpdatePersonApplicationGroupMembership as Initiator.
UpdatePersonDirectAssignment	Direct Assignment to UpdatePersonDirectAssignment as Initiator.
UpdatePersonGroupMembership	Direct Assignment to UpdatePersonGroupMembership as Initiator.
UpdatePersonManagementRoleAssignments	Direct Assignment to UpdatePersonManagementRoleAssignments as Initiator.
UpdatePersonManagementRoles	Direct Assignment to UpdatePersonManagementRoles as Initiator.

Users with this Management Role have limited access to the IT Shop workflows and user interfaces to allow access requests and resource management.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
IT Shop Workflows	Direct Assignment to IT Shop Workflows as Viewer.
Shopping Cart	Direct Assignment to Shopping Cart as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
IT Shop Request Access	Direct Assignment to IT Shop Request Access as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ClaimSSOAccount	Direct Assignment to ClaimSSOAccount as Initiator.
CreateApplicationUser	Direct Assignment to CreateApplicationUser as Initiator.
CreateAsset	Direct Assignment to CreateAsset as Initiator.
CreateAssetMailbox	Direct Assignment to CreateAssetMailbox as Initiator.
CreateGenericAsset	Direct Assignment to CreateGenericAsset as Initiator.
ProvisionAssetForPerson	Direct Assignment to ProvisionAssetForPerson as Initiator.
UpdateAccountGroupMembership	Direct Assignment to UpdateAccountGroupMembership as Initiator.
UpdateDirectAssignmentTimeConstraint	Direct Assignment to UpdateDirectAssignmentTimeConstraint as Initiator.
UpdatePersonApplicationGroupMembership	Direct Assignment to UpdatePersonApplicationGroupMembership as Initiator.
UpdatePersonDirectAssignment	Direct Assignment to UpdatePersonDirectAssignment as Initiator.
UpdatePersonGroupMembership	Direct Assignment to UpdatePersonGroupMembership as Initiator.
UpdatePersonManagementRoleAssignments	Direct Assignment to UpdatePersonManagementRoleAssignments as Initiator.
UpdatePersonManagementRoles	Direct Assignment to UpdatePersonManagementRoles as Initiator.

Users with this Management Role have the ability to perform delegated administration of people, users and groups within partner organizations. They can only see object in the partner organization.

\\

In this table, the Assignment Type is Person Relative Resource and the Access Level is All Access (EmpowerID Admin).

\\

Resource Type	Assignment Description
Person	Assignment to any person as All Access (EmpowerID Admin) that matches this criteria: People in organizations to which I belong.
User Account	Assignment to any user account as All Access (EmpowerID Admin) that matches this criteria: User accounts in organizations to which I belong.
Group (Security)	Assignment to any group (security) as All Access (EmpowerID Admin) that matches this criteria: Security groups in organizations to which I belong.
Group (Distribution)	Assignment to any group (distribution) as All Access (EmpowerID Admin) that matches this criteria: Distribution groups in organizations to which I belong.
Group (Generic)	Assignment to any group (generic) as All Access (EmpowerID Admin) that matches this criteria: Generic groups in organizations to which I belong.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Account Resource Type Drop-down Item	Direct Assignment to Account Resource Type Drop-down Item as Viewer.
Group Resource Type Drop-down Item	Direct Assignment to Group Resource Type Drop-down Item as Viewer.
Person Resource Type Drop-down Item	Direct Assignment to Person Resource Type Drop-down Item as Viewer.
Global Person Search Box	Direct Assignment to Global Person Search Box as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Find Group Page	Direct Assignment to Find Group Page as Viewer.
Find Person Page	Direct Assignment to Find Person Page as Viewer.
Find User Account Page	Direct Assignment to Find User Account Page as Viewer.
Person Onboarding	Direct Assignment to Person Onboarding as Viewer.
View Account Page	Direct Assignment to View Account Page as Viewer.
Create Person Simple	Direct Assignment to Create Person Simple as Viewer.
Edit Group Page	Direct Assignment to Edit Group Page as Viewer.
Reset Password Page	Direct Assignment to Reset Password Page as Viewer.
Edit Person Page	Direct Assignment to Edit Person Page as Viewer.
Edit Account Page	Direct Assignment to Edit Account Page as Viewer.
View Group Page	Direct Assignment to View Group Page as Viewer.
View Person Page	Direct Assignment to View Prson Page as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ChangePrimaryOrgRoleOrgZone	Direct Assignment to ChangePrimaryOrgRoleOrgZone as Initiator.
HelpdeskPasswordReset	Direct Assignment to HelpdeskPasswordReset as Initiator.
HelpdeskAccountUnlock	Direct Assignment to HelpdeskAccountUnlock as Initiator.
UpdateAssignments	Direct Assignment to UpdateAssignments as Initiator.
UpdatePersonAssignments	Direct Assignment to UpdatePersonAssignments as Initiator.
ResourceManagerEditGroup	Direct Assignment to ResourceManagerEditGroup as Initiator.
TemporaryGroupMembership	Direct Assignment to TemporaryGroupMembership as Initiator.
PersonEditNonResourceManager	Direct Assignment to PersonEditNonResourceManager as Initiator.
CreatePeopleFromFile	Direct Assignment to CreatePeopleFromFile as Initiator.
CreatePerson	Direct Assignment to CreatePerson as Initiator.
UpdateResourceTags	Direct Assignment to UpdateResourceTags as Initiator.
PersonPhotoApproval	Direct Assignment to PersonPhotoApproval as Initiator.
UpdateGroupAccountMembership	Direct Assignment to UpdateGroupAccountMembership as Initiator.
UpdatePersonRelationships	Direct Assignment to UpdatePersonRelationships as Initiator.
UpdatePersonBusinessRoles	Direct Assignment to UpdatePersonBusinessRoles as Initiator.
UpdateResourceLocations	Direct Assignment to UpdateResourceLocations as Initiator.
DisableMultiplePeopleWF	Direct Assignment to DisableMultiplePeopleWF as Initiator.
EditPersonPhotoApproval	Direct Assignment to EditPersonPhotoApproval as Initiator.
DeleteMultiplePeopleWF	Direct Assignment to DeleteMultiplePeopleWF as Initiator.
UpdatePersonGroupMembership	Direct Assignment to UpdatePersonGroupMembership as Initiator.

Provides limited access for partner users, typically password self-service and access to SSO applications. Can only see object in the partner organization.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Person Resource Type Drop-down Item	Direct Assignment to Person Resource Type Drop-down Item as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
View Self Page	Direct Assignment to View Self Page as Viewer.
Edit Self Page	Direct Assignment to Edit Self Page as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Assignment Type	Resource Type	Resource	Access Level	Assignment Description
Direct	Workflow	PersonPhotoApproval	Initiator	Direct Assignment to PersonPhotoApproval as Initiator.
Direct	Workflow	RequestDecisions	Initiator	Direct Assignment to RequestDecisions as Initiator.
Direct	Workflow	PersonEditNonResourceManager	Initiator	Direct Assignment to PersonEditNonResourceManager as Initiator.

Grants access to the provisioning/joiner, mover, and deprovisioning/leaver request workflows. This role is often assigned to HR personnel.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Create Person Simple	Direct Assignment to Create Person Simple as Viewer.
Person Onboarding	Direct Assignment to Person Onboarding as Viewer.
Person Terminations	Direct Assignment to Person Terminations as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ChangePrimaryOrgRoleOrgZone	Direct Assignment to ChangePrimaryOrgRoleOrgZone as Initiator.
ChangePrimaryBusinessRoleLocationSimpleUI	Direct Assignment to ChangePrimaryBusinessRoleLocationSimpleUI as Initiator.
DeleteMultiplePeopleWf	Direct Assignment to DeleteMultiplePeopleWf as Initiator.
DisableMultiplePeopleWf	Direct Assignment to DisableMultiplePeopleWf as Initiator.
RehireCheckWorkflow	Direct Assignment to RehireCheckWorkflow as Initiator.

User with this Management Role can perform self-service tasks related to their passwords and profiles.

\\

In this table, the Assignment Type is Scoped At Location and the Access Level is Requestor.

\\

Resource Type	Assignment Description
Asset Request	Assignment to any Asset Request as Requestor scoped at Anywhere.
Access Request	Assignment to any Access Request as Requestor scoped at Anywhere.
Audit	Assignment to Reviewer scoped at EmpowerID System.

\\

In this table, the Assignment Type is Scoped At Location and the Access Level is Can Use In Access Assignment.

\\

Resource Type	Assignment Description
Person	Assignment to any Person as Can Use In Access Assignment scoped at EmpowerID System.
Person	Assignment to any Person as Can Use In Access Assignment scoped at Anywhere.
User Account	Assignment to any User Account as Can Use In Access Assignment scoped at Anywhere.
Group (Generic)	Assignment to any Group (Generic) as Can Use In Access Assignment scoped at Anywhere.
Group (Security)	Assignment to any Group (Security) as Can Use In Access Assignment scoped at Anywhere.
Group (Distribution)	Assignment to any Group (Distribution) as Can Use In Access Assignment scoped at Anywhere.
Query-Based Collection (SetGroup)	Assignment to any Query-Based Collection (SetGroup) as Can Use In Access Assignment scoped at Anywhere.
Query-Based Collection (SetGroup)	Assignment to any Query-Based Collection (SetGroup) as Can Use In Access Assignment scoped at EmpowerID System.
Business Role	Assignment to any Business Role as Can Use In Access Assignment scoped at EmpowerID System.
Business Role	Assignment to any Business Role as Can Use In Access Assignment scoped at Anywhere.
Location	Assignment to any Location as Can Use In Access Assignment scoped at EmpowerID System.
Location	Assignment to any Location as Can Use In Access Assignment scoped at Anywhere.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
My Workspace: Home	Direct assignment to My Workspace: Home as Viewer.
My Workspace: SSO Applications	Direct Assignment to My Workspace: SSO Applications To Account.
My Workspace: My Resource Operation Decisions	Direct Assignment to My Workspace: MY Resource Operation Decisions To Account.
My Workspace: Protected SSO Applications	Direct Assignment to My Workspace: Protected SSO Applications To Account.
My Workspace: My Security Assignments	Direct Assignment to My Workspace: My Security Assignments To Account.
My Workspace: My Workflow Decisions	Direct Assignment to My Workspace: My Workflow Decisions To Account.
My Workspace: Task List	Direct Assignment to My Workspace: Task List To Account.
My Workspace: My Resultant Access	Direct Assignment to My Workspace: My Resultant Access To Account.
My Workspace: My Security Assignments	Direct Assignment to My Workspace: My Security Assignments To Account.

\\

In this table, the Assignment Type is Direct, the Resource is Default Organization, and the Access Level is Viewer.

\\

Resource Type	Assignment Description
Location	Direct assignment to Default Organization as Viewer.
Organization	Direct assignment to Default Organization as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Change Password Standalone Workflow	Direct assignment to Change Password Standalone Workflow as Viewer.
IT Shop	Direct assignment to IT Shop as Viewer.
User Compliance Dashboard	Direct assignment to User Compliance Dashboard as Viewer.
White Pages	Direct assignment to White Pages as Viewer.
Edit Self Page	Direct assignment to Edit Self Page as Viewer.
Enrollment Standalone Workflow	Direct assignment to Enrollment Standalone Workflow as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Web Service, and the Access Level is Executor.

\\

Resource	Assignment Description
LoginService	Direct assignment to LoginService as Executor.
LoginService.HasRightsToCall	Direct assignment to LoginService.HasRightsToCall as Executor.
LoginService.RunLoginWorkflow	Direct assignment to LoginService.RunLoginWorkflow asExecutor.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
RequestOathToken	Direct assignment to Request Workflow: RequestOathToken as Initiator.
UpdateDirectAssignmentTimeConstraint	Direct assignment to Request Workflow: UpdateDirectAssignmentTimeConstraint as Initiator.
PersonPhotoApproval	Direct assignment to Request Workflow: PersonPhotoApproval as Initiator.
SubmitSingleSodViolationResponse	Direct assignment to Request Workflow: SubmitSingleSodViolationResponse as Initiator.
BulkAddRemoveExchangeMailboxEmailAddresses	Direct assignment to Request Workflow: BulkAddRemoveExchangeMailboxEmailAddresses as Initiator.
SubmitSingleAttestationResponse	Direct assignment to Request Workflow: SubmitSingleAttestationResponse as Initiator.
UpdateManagementRoleAssignments	Direct assignment to Request Workflow: UpdateManagementRoleAssignments as Initiator.
ClaimBusinessProcessTask	Direct assignment to Request Workflow: ClaimBusinessProcessTask as Initiator.
ChangePersonBusinessRoleAndLocation	Direct assignment to Request Workflow: ChangePersonBusinessRoleAndLocation as Initiator.
ProcessAttestationDecision	Direct assignment to Request Workflow: ProcessAttestationDecision as Initiator.
UpdatePersonManagementRoles	Direct assignment to Request Workflow: UpdatePersonManagementRoles as Initiator.
AuthenticationLevel2OATHLogin	Direct assignment to Request Workflow: AuthenticationLevel2OATHLogin as Initiator.
UpdateResourceAssignmentsByResource	Direct assignment to Request Workflow: UpdateResourceAssignmentsByResource as Initiator.
UpdateGroupAccountMembership	Direct assignment to Request Workflow: UpdateGroupAccountMembership as Initiator.
SendPersonOneTimePassword	Direct assignment to Request Workflow: SendPersonOneTimePassword as Initiator.
EditPasswordVaultAccount	Direct assignment to Request Workflow: EditPasswordVaultAccount as Initiator.
ResetPasswordValutAccountPassword	Direct assignment to Request Workflow: ResetPasswordValutAccountPassword as Initiator.
ClaimPasswordVaultAccount	Direct assignment to Request Workflow: ClaimPasswordVaultAccount as Initiator.
UpdatePersonRelationships	Direct assignment to Request Workflow: UpdatePersonRelationships as Initiator.
UpdatePersonAccounts	Direct assignment to Request Workflow: UpdatePersonAccounts as Initiator.
UpdateGroupMemberGroups	Direct assignment to Request Workflow: UpdateGroupMemberGroups as Initiator.
UpdatePersonBusinessRoles	Direct assignment to Request Workflow: UpdatePersonBusinessRoles as Initiator.
UpdateResourceLocations	Direct assignment to Request Workflow: UpdateResourceLocations as Initiator.
UpdateResourceAssignments	Direct assignment to Request Workflow: UpdateResourceAssignments as Initiator.
UpdateResourceTags	Direct assignment to Request Workflow: UpdateResourceTags as Initiator.
UpdatePersonAssets	Direct assignment to Request Workflow: UpdatePersonAssets as Initiator.
UpdateAccountGroupMembership	Direct assignment to Request Workflow: UpdateAccountGroupMembership as Initiator.
UpdatePersonManagementRoleAssignments	Direct assignment to Request Workflow: UpdatePersonManagementRoleAssignments as Initiator.
UnclaimResourceAttestation	Direct assignment to Request Workflow: UnclaimResourceAttestation as Initiator.
ClaimResourceAttestation	Direct assignment to Request Workflow: ClaimResourceAttestation as Initiator.
CreateGenericAsset	Direct assignment to Request Workflow: CreateGenericAsset as Initiator.
AddResourceAttestationComment	Direct assignment to Request Workflow: AddResourceAttestationComment as Initiator.
AddBusinessProcessTaskComment	Direct assignment to Request Workflow: AddBusinessProcessTaskComment as Initiator.
UnclaimBusinessProcessTaskComment	Direct assignment to Request Workflow: UnclaimBusinessProcessTaskComment as Initiator.
ClaimBusinessProcessTaskComment	Direct assignment to Request Workflow: ClaimBusinessProcessTaskComment as Initiator.
RemoveBusinessProcessTaskDelegate	Direct assignment to Request Workflow: RemoveBusinessProcessTaskDelegate as Initiator.
SetBusinessProcessTaskDelegate	Direct assignment to Request Workflow: SetBusinessProcessTaskDelegate as Initiator.
RequestManagementRole	Direct assignment to Request Workflow: RequestManagementRole as Initiator.
SelfServiceRequestManagementRole	Direct assignment to Request Workflow: SelfServiceRequestManagementRole as Initiator.
ProvisionAssetForPerson	Direct assignment to Request Workflow: ProvisionAssetForPerson as Initiator.
DeleteOwnSSOAccount	Direct assignment to Request Workflow: DeleteOwnSSOAccount as Initiator.
SelfServiceRequestApplicationRole	Direct assignment to Request Workflow: SelfServiceRequestApplicationRole as Initiator.
UpdatePersonManagementRoles	Direct assignment to Request Workflow: UpdatePersonManagementRoles as Initiator.
UpdatePersonDirectAssignment	Direct assignment to Request Workflow: UpdatePersonDirectAssignment as Initiator.
UpdateAssignments	Direct assignment to Request Workflow: UpdateAssignments as Initiator.
CreateAsset	Direct assignment to Request Workflow: CreateAsset as Initiator.
CreateLaptopAsset	Direct assignment to Request Workflow: CreateLaptopAsset as Initiator.
CreateAssetMailbox	Direct assignment to Request Workflow: CreateAssetMailbox as Initiator.
CreatePerson	Direct assignment to Request Workflow: CreatePerson as Initiator.
AddCommentToTask	Direct assignment to Request Workflow: AddCommentToTask as Initiator.
CreateApplicationUser	Direct assignment to Request Workflow: CreateApplicationUser as Initiator.
ResumeWorkflows	Direct assignment to Request Workflow: ResumeWorkflows as Initiator.
Enrollment	Direct assignment to Request Workflow: Enrollment as Initiator.
ProfileManager	Direct assignment to Request Workflow: ProfileManager as Initiator.
PasswordResetCenter	Direct assignment to Request Workflow: PasswordResetCenter as Initiator.
ChangePassword	Direct assignment to Request Workflow: ChangePassword as Initiator.
RegisterAccount	Direct assignment to Request Workflow: RegisterAccount as Initiator.
ClaimSSOAccount	Direct assignment to Request Workflow: ClaimSSOAccount as Initiator.
EditPersonPhotoApproval	Direct assignment to Request Workflow: EditPersonPhotoApproval as Initiator.
AuthenticationLevel2Login	Direct assignment to Request Workflow: AuthenticationLevel2Login as Initiator.
AuthenticationLevel3Login	Direct assignment to Request Workflow: AuthenticationLevel3Login as Initiator.
AuthenticationLevel4Login	Direct assignment to Request Workflow: AuthenticationLevel4Login as Initiator.
Login	Direct assignment to Request Workflow: Login as Initiator.
AssignAssetToPerson	Direct assignment to Request Workflow: AssignAssetToPerson as Initiator.
RequestDecisions	Direct assignment to Request Workflow: RequestDecisions as Initiator.
ProcessAttestationDecision	Direct assignment to Request Workflow: ProcessAttestationDecision as Initiator.
UpdatePersonManagementRoles	Direct assignment to Request Workflow: UpdatePersonManagementRoles as Initiator.
CheckOutAccountVaultedPassword	Direct assignment to Request Workflow: CheckOutAccountVaultedPassword as Initiator.
ChangePersonBusinessRoleAndLocation	Direct assignment to Request Workflow: ChangePersonBusinessRoleAndLocation as Initiator.
ClaimBusinessProcessTask	Direct assignment to Request Workflow: ClaimBusinessProcessTask as Initiator.
RemoveBusinessProcessTaskDelegate	Direct assignment to Request Workflow: RemoveBusinessProcessTaskDelegate as Initiator.
SetBusinessProcessTaskDelegate	Direct assignment to Request Workflow: SetBusinessProcessTaskDelegate as Initiator.
ClaimPasswordVaultAccount	Direct assignment to Request Workflow: ClaimPasswordVaultAccount as Initiator.
ClaimAccount	Direct assignment to Request Workflow: ClaimAccount as Initiator.
ViewPerson	Direct assignment to Request Workflow: ViewPerson as Initiator.
UnenrollPerson	Direct assignment to Request Workflow: UnenrollPerson as Initiator.
UpdatePersonApplicationGroupMembership	Direct assignment to Request Workflow: UpdatePersonApplicationGroupMembership as Initiator.
TerminateWorkflow	Direct assignment to Request Workflow: TerminateWorkflow as Initiator.
UnclaimSSOAccount	Direct assignment to Request Workflow: UnclaimSSOAccount as Initiator.
ClaimSSOAccount	Direct assignment to Request Workflow: ClaimSSOAccount as Initiator.
UpdatePersonManagementRoleAssignments	Direct assignment to Request Workflow: UpdatePersonManagementRoleAssignments as Initiator.
SelfServicePersonLeaveGroup	Direct assignment to Request Workflow: SelfServicePersonLeaveGroup as Initiator.
SelfServicePersonJoinGroup	Direct assignment to Request Workflow: SelfServicePersonJoinGroup as Initiator.
SelfServiceAccountJoinGroup	Direct assignment to Request Workflow: SelfServiceAccountJoinGroup as Initiator.
EditManagementRoleNoUI	Direct assignment to Request Workflow: EditManagementRoleNoUI as Initiator.
PersonEditNonResourceManager	Direct assignment to Request Workflow: PersonEditNonResourceManager as Initiator.
PasswordResetCenterOTP	Direct assignment to Request Workflow: PasswordResetCenterOTP as Initiator.
AddRbacResourceRoleAssignment	Direct assignment to Request Workflow: AddRbacResourceRoleAssignment as Initiator.
ResourceManagerUpdateProtectedApplicationResource	Direct assignment to Request Workflow: ResourceManagerUpdateProtectedApplicationResource as Initiator.
EmailLostUsername	Direct assignment to Request Workflow: EmailLostUsername as Initiator.
AssetAccessRequest	Direct assignment to Request Workflow: AssetAccessRequest as Initiator.
AssetAccessRequestSelfService	Direct assignment to Request Workflow: AssetAccessRequestSelfService as Initiator.
ResourceManagerAccountUpdate	Direct assignment to Request Workflow: ResourceManagerAccountUpdate as Initiator.
ResourceManagerUpdateMailbox	Direct assignment to Request Workflow: ResourceManagerUpdateMailbox as Initiator.
ResourceManagerEditGroup	Direct assignment to Request Workflow: ResourceManagerEditGroup as Initiator.
AddResourceRole	Direct assignment to Request Workflow: AddResourceRole as Initiator.
Enroll	Direct assignment to Request Workflow: Enroll as Initiator.
UpdatePersonGroupMembership	Direct assignment to Request Workflow: UpdatePersonGroupMembership as Initiator.
AssetProvisionSelfService	Direct assignment to Request Workflow: AssetProvisionSelfService as Initiator.

Grants limited access. Typically includes password self-service.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Global Flyout menu	Direct Assignment to Global Flyout Menu as Viewer.
IT Shop Workflows	Direct Assignment to IT Shop Workflows as Viewer.
SharePoint Claims Picker	Direct Assignment to SharePoint Claims Picker as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Enrollment Standalone Workflow Page	Direct Assignment to Enrollment Standalone Workflow Page as Viewer.
Change Password Standalone Workflow Page	Direct Assignment to Change Password Workflow Page as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
Login	Direct Assignment to Login as Initiator.
ResumeWorkflows	Direct Assignment to ResumeWorkflows as Initiator.
AuthenticationLevel2OATHLogin	Direct Assignment to AuthenticationLevel2OATHLogin as Initiator.
RequestOathToken	Direct Assignment to RequestOathToken as Initiator.

Users with this Management Role can create and manage apps and SSO connections.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Shopping Cart	Direct Assignment to Shopping Cart as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
FindProtectedApplicationResourceApplication Page	Direct Assignment to FindProtectedApplicationResourceApplication Page as Viewer.
Create Application Page	Direct Assignment to Create Application Page as Viewer.
View Group Page	Direct Assignment to View Group Page as Viewer.
Create SAML AuthN Request	Direct Assignment to Create SAML AuthN Request as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
CreateApplication	Direct Assignment to CreateApplication as Initiator.
EditSAMLSingleSignOn	Direct Assignment to EditSAMLSingleSignOn as Initiator.
UpdateApplication	Direct Assignment to UpdateApplication as Initiator.
UpdateAssignments	Direct Assignment to UpdateAssignments as Initiator.

Grants full access to the SSO and vaulted credential workflows and user interfaces to allow a user to sign in to SSO applications.

\\

In this table, the Assignment Type is Direct, the Resource Type is Control (User Interface), and the Access Level is Viewer.

\\

Resource	Assignment Description
Shared Credentials Tab	Direct Assignment to Shared Credentials Tab as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
SSO Applications Page	Direct Assignment to SSO Applications Page as Viewer.
Saved Credentials Page	Direct Assignment to Saved Credentials Page as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ClaimSSOAccount	Direct Assignment to ClaimSSOAccount as Initiator.
DeleteOwnSSOAccount	Direct Assignment to DeleteOwnSSOAccount as Initiator.
UpdatePersonSecrets	Direct Assignment to UpdatePersonSecrets as Initiator.
EditFormsSSOCredentials	Direct Assignment to EditFormsSSOCredentials as Initiator.
UpdateFormsSSOCredentialSharedPeople	Direct Assignment to UpdateFormsSSOCredentialSharedPeople as Initiator.
UpdateExternalCredentials	Direct Assignment to UpdateExternalCredentials as Initiator.
UpdateExternalCredentialSharedPeople	Direct Assignment to UpdateExternalCredentialSharedPeople as Initiator.
ResetMasterPassword	Direct Assignment to ResetMasterPassword as Initiator.

Grants limited access to the SSO and vaulted credential workflows and user interfaces to allow a user to sign in to SSO applications.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
SSO Applications Page	Direct Assignment to SSO Applications Page as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
ClaimSSOAccount	Direct Assignment to ClaimSSOAccount as Initiator.
DeleteOwnSSOAccount	Direct Assignment to DeleteOwnSSOAccount as Initiator.
UpdatePersonSecrets	Direct Assignment to UpdatePersonSecrets as Initiator.
EditFormsSSOCredentials	Direct Assignment to EditFormsSSOCredentials as Initiator.
UpdateFormsSSOCredentialSharedPeople	Direct Assignment to UpdateFormsSSOCredentialSharedPeople as Initiator.
ResetMasterPassword	Direct Assignment to ResetMasterPassword as Initiator.

Users with this Management Role have access to Microsoft SQL Server Reporting Services Administrator.

Users with this Management Role have access to Microsoft SQL Server Reporting Services Developer.

Users with this Management Role have access to Microsoft SQL Server Reporting Services Administrator.

Users with this Management Role have access to view Microsoft SQL Server Reporting Services.

This Management Role grants users the ability to see all EmpowerID user interfaces as well as the ability to initiate any workflow.

\\

In this table, the Assignment Type is Scoped At Location and the Access Level is Requester.

\\

Resource Type	Assignment Description
Access Request	Assignment to any Access Request as Requestor scoped at EmpowerID System.
Asset Request	Assignment to any Asset Request as Requestor scoped at EmpowerID System.

\\

In this table, the Assignment Type is Scoped At Location.

\\

Resource Type	Access Level	Assignment Description
Control (User Interface)	Viewer	Assignment to any Control (User Interface) as Viewer scoped at EmpowerID System.
Pages and Reports	Viewer	Assignment to any Pages and Reports as Viewer scoped at EmpowerID System.
Workflow	Initiator	Assignment to any Workflow as Initiator scoped at EmpowerID System.

\\

In this table, the Assignment Type is Direct and the Access Level is Viewer.

\\

Resource Type	Resource	Assignment Description
Control (User Interface)	Global Person Search Box	Direct assignment to Global Person Search Box as Viewer.
Pages and Reports	User Compliance Dashboard	Direct assignment to User Compliance Dashboard as Initiator.
Pages and Reports	Change Password Standalone Workflow	Direct assignment to Change Password Standalone Workflow as Initiator.
Pages and Reports	Enrollment Standalone Workflow	Direct assignment to Enrollment Standalone Workflow as Initiator.
Pages and Reports	IT Shop	Direct assignment to IT Shop as Initiator.

\\

In this table, the Assignment Type is Direct, the Resource Type is Web Service, and the Access Level is Executor.

\\

Resource	Assignment Description
LoginService	Direct assignment to LoginService as Executor.
LoginService.HasRightsToCall	Direct assignment to LoginService.HasRightsToCall as Executor.
LoginService.RunLoginWorkflow	Direct assignment to LoginService.RunLoginWorkflow as Executor.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
AddRbacResourceRoleAssignment	Direct assignment to AddRbacResourceRoleAssignment as Initiator.
AddResourceAttestationComment	Direct assignment to AddResourceAttestationComment as Initiator.
AddResourceRole	Direct assignment to AddResourceRole as Initiator.
AssetAccessRequest	Direct assignment to AssetAccessRequest as Initiator.
AssetAccessRequestSelfService	Direct assignment to AssetAccessRequestSelfService as Initiator.
AssetProvisionSelfService	Direct assignment to AssetProvisionSelfService as Initiator.
AuthenticationLevel2OATHLogin	Direct assignment to AuthenticationLevel2OATHLogin as Initiator.
BulkAddRemoveExchangeMailboxEmailAddresses	Direct assignment to BulkAddRemoveExchangeMailboxEmailAddresses as Initiator.
ChangePassword	Direct assignment to ChangePassword as Initiator.
ClaimAccount	Direct assignment to ClaimAccount as Initiator.
ClaimBusinessProcessTask	Direct assignment to ClaimBusinessProcessTask as Initiator.
ClaimPasswordVaultAccount	Direct assignment to ClaimPasswordVaultAccount as Initiator.
ClaimResourceAttestation	Direct assignment to ClaimResourceAttestation as Initiator.
ClaimSSOAccount	Direct assignment to ClaimSSOAccount as Initiator.
CreateAsset	Direct assignment to CreateAsset as Initiator.
CreateAssetMailbox	Direct assignment to CreateAssetMailbox as Initiator.
CreateGenericAsset	Direct assignment to CreateGenericAsset as Initiator.
CreateLaptopAsset	Direct assignment to CreateLaptopAsset as Initiator.
CreatePerson	Direct assignment to CreatePerson as Initiator.
DeleteOwnSSOAccount	Direct assignment to DeleteOwnSSOAccount as Initiator.
EditManagementRoleNoUI	Direct assignment to EditManagementRoleNoUI as Initiator.
EditPasswordVaultAccount	Direct assignment to EditPasswordVaultAccount as Initiator.
Enroll	Direct assignment to Enroll as Initiator.
Enrollment	Direct assignment to Enrollment as Initiator.
Login	Direct assignment to Login as Initiator.
PasswordResetCenter	Direct assignment to PasswordResetCenter as Initiator.
PasswordResetCenterOTP	Direct assignment to PasswordResetCenterOTP as Initiator.
PersonEditNonResourceManager	Direct assignment to PersonEditNonResourceManager as Initiator.
PersonPhotoApproval	Direct assignment to PersonPhotoApproval as Initiator.
ProfileManager	Direct assignment to ProfileManager as Initiator.
ProvisionAssetForPerson	Direct assignment to ProvisionAssetForPerson as Initiator.
RemoveBusinessProcessTaskDelegate	Direct assignment to RemoveBusinessProcessTaskDelegate as Initiator.
RequestOathToken	Direct assignment to RequestOathToken as Initiator.
ResetPasswordVaultAccountPassword	Direct assignment to ResetPasswordVaultAccountPassword as Initiator.
ResourceManagerAccountUpdate	Direct assignment to ResourceManagerAccountUpdate as Initiator.
ResourceManagerEditGroup	Direct assignment to ResourceManagerEditGroup as Initiator.
ResourceManagerUpdateMailbox	Direct assignment to ResourceManagerUpdateMailbox as Initiator.
ResourceManagerUpdateProtectedApplicationResource	Direct assignment to ResourceManagerUpdateProtectedApplicationResource as Initiator.
ResumeWorkflows	Direct assignment to ResumeWorkflows as Initiator.
SelfServiceAccountJoinGroup	Direct assignment to SelfServiceAccountJoinGroup as Initiator.
SelfServicePersonJoinGroup	Direct assignment to SelfServicePersonJoinGroup as Initiator.
SelfServicePersonLeaveGroup	Direct assignment to SelfServicePersonLeaveGroup as Initiator.
SendPersonOneTimePassword	Direct assignment to SendPersonOneTimePassword as Initiator.
SetBusinessProcessTaskDelegate	Direct assignment to SetBusinessProcessTaskDelegate as Initiator.
SubmitSingleAttestationResponse	Direct assignment to SubmitSingleAttestationResponse as Initiator.
SubmitSingleSodViolationResponse	Direct assignment to SubmitSingleSodViolationResponse as Initiator.
TerminateWorkflow	Direct assignment to TerminateWorkflow as Initiator.
UnclaimBusinessProcessTask	Direct assignment to UnclaimBusinessProcessTask as Initiator.
UnclaimResourceAttestation	Direct assignment to UnclaimResourceAttestation as Initiator.
UnclaimSSOAccount	Direct assignment to UnclaimSSOAccount as Initiator.
UnenrollPerson	Direct assignment to UnenrollPerson as Initiator.
UpdateAccountGroupMembership	Direct assignment to UpdateAccountGroupMembership as Initiator.
UpdateAssignments	Direct assignment to UpdateAssignments as Initiator.
UpdateDirectAssignmentTimeConstraint	Direct assignment to UpdateDirectAssignmentTimeConstraint as Initiator.
UpdateGroupAccountAssignment	Direct assignment to UpdateGroupAccountAssignment as Initiator.
UpdateGroupMemberGroups	Direct assignment to UpdateGroupMemberGroups as Initiator.
UpdateManagementRoleAssignments	Direct assignment to UpdateManagementRoleAssignments as Initiator.
UpdatePersonAccounts	Direct assignment to UpdatePersonAccounts as Initiator.
UpdatePersonAssets	Direct assignment to UpdatePersonAssets as Initiator.
UpdatePersonBusinessRoles	Direct assignment to UpdatePersonBusinessRoles as Initiator.
UpdatePersonDirectAssignment	Direct assignment to UpdatePersonDirectAssignment as Initiator.
UpdatePersonGroupMembership	Direct assignment to UpdatePersonGroupMembership as Initiator.
UpdatePersonManagementRoleAssignments	Direct assignment to UpdatePersonManagementRoleAssignments as Initiator.
UpdatePersonManagementRoles	Direct assignment to UpdatePersonManagementRoles as Initiator.
UpdatePersonRelationships	Direct assignment to UpdatePersonRelationships as Initiator.
UpdateResourceAssignments	Direct assignment to UpdateResourceAssignments as Initiator.
UpdateResourceAssignmentsByResource	Direct assignment to UpdateResourceAssignmentsByResource as Initiator.
UpdateResourceLocations	Direct assignment to UpdateResourceLocations as Initiator.
UpdateResourceTags	Direct assignment to UpdateResourceTags as Initiator.
ViewPerson	Direct assignment to ViewPerson as Initiator.

Grants full access to the business process task workflows and user interfaces.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Request Center Tasks To Do	Direct Assignment to Request Center Tasks To Do as Viewer.
Request Center Tasks Done	Direct Assignment to Request Center Tasks Done as Viewer.
Request Center Requests My Open	Direct Assignment to Request Center Requests My Open as Viewer.
Request Center Requests My Complete	Direct Assignment to Request Center Requests My Complete as Viewer.
Request Center Tasks My Reports	Direct Assignment to Request Center Tasks My Reports as Viewer.
Request Center Tasks All	Direct Assignment to Request Center Tasks All as Viewer.
Activity Stream	Direct Assignment to Activity Stream as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
TerminateWorkflow	Direct Assignment to TerminateWorkflow as Initiator.
ResumeWorkflows	Direct Assignment to ResurmeWorkflows as Initiator.
AddCommentToTask	Direct Assignment to AddCommentToTask as Initiator.
SetBusinessProcessTaskDelegate	Direct Assignment to SetBusinessProcessTaskDelegate as Initiator.
RemoveBusinessProcessTaskDelegate	Direct Assignment to RemoveBusinessProcessTaskDelegate as Initiator.
ClaimBusinessProcessTask	Direct Assignment to ClaimBusinessProcessTask as Initiator.
UnClaimBusinessProcessTask	Direct Assignment to UnClaimBusinessProcessTask as Initiator.
AddBusinessProcessTaskComment	Direct Assignment to AddBusinessProcessTaskComment as Initiator.

Grants limited access to the business process task workflows and user interfaces.

\\

In this table, the Assignment Type is Direct, the Resource Type is Pages and Reports, and the Access Level is Viewer.

\\

Resource	Assignment Description
Request Center Tasks To Do	Direct Assignment to Request Center Tasks To Do as Viewer.
Request Center Tasks Done	Direct Assignment to Request Center Tasks Done as Viewer.
Request Center Requests My Open	Direct Assignment to Request Center Requests My Open as Viewer.
Request Center Requests My Complete	Direct Assignment to Request Center Requests My Complete as Viewer.
Activity Stream	Direct Assignment to Activity Stream as Viewer.

\\

In this table, the Assignment Type is Direct, the Resource Type is Workflow, and the Access Level is Initiator.

\\

Resource	Assignment Description
TerminateWorkflow	Direct Assignment to TerminateWorkflow as Initiator.
ResumeWorkflows	Direct Assignment to ResurmeWorkflows as Initiator.
AddCommentToTask	Direct Assignment to AddCommentToTask as Initiator.
RemoveBusinessProcessTaskDelegate	Direct Assignment to RemoveBusinessProcessTaskDelegate as Initiator.
AddBusinessProcessTaskComment	Direct Assignment to AddBusinessProcessTaskComment as Initiator.

concepts:

EmpowerID RBAC Overview

administrative procedures:

Creating Management Role Definitions

Assigning Access Levels to Management Role Definitions

Cloning Management Role Definitions

Creating Management Roles

Assigning Access Levels to Management Roles

Assigning Management Roles

Publishing Resources to the IT Shop

Cloning Management Roles