User 'XYZ' is able to impersonate some users but cannot impersonate certain specific users anymore

[rmaroti]

Hi Everyone,

In my instance user 'XYZ' is able to impersonate some users but cannot impersonate certain specific users anymore.

What will be the issue can anyone suggest ?

[Dr Atul G- LNG]

Hi @rmaroti 

A regular impersonated user cannot impersonate a user with a higher role, such as admin. This means, for example, an ITIL user cannot impersonate an admin user.

[OlaN]

Hi,

This could be security-related perhaps.

For example, you shouldn't be able to impersonate a user with specific roles unless you (as admin) also has those roles.

One example is the HR-scope. An admin who isn't HR-admin should not be able to impersonate an HR-admin persona and grant himself additional privilieges (within the HR scope).

[Ankur Bawiskar · Accepted solution]

@rmaroti 

XYZ is trying to impersonate which user? the user whom he/she is trying to impersonate has what role?

User with lower role cannot impersonate user with higher role

Points to check

1) non admins cannot impersonate admin even if they have impersonator role.

2) inactive, locked out users cannot be impersonated

3) Did somebody add some custom solution in OOTB Script Include "ImpersonateEvaluator"?

4) is that user trying to impersonate other scope role users such as HR, SecOps etc?

If my response helped please mark it correct and close the thread so that it benefits future readers.