Is it possible to edit the options for available roles under "Elevate Role"?

[Anushree Sarkar]

Hi Members,

I have a requirement of providing limited "admin" role to specific users in production environment, similar to what we have for security_admin role, i.e. when a user clicks on "Elevate Role" from the profile dropdown options, a pop-up window appears which provides an option to update the checkbox to "security_admin" role. Can more roles be added to that list? For example, if a user wants to utilize the "admin" role for specific tasks, and after logging out from the session, it is removed automatically. Is it feasible to do so? Any alternate suggestions are welcome.

Thanks,

Anushree

[Mark Manders · Accepted solution]

To your question: yes, you can add more options there. You can make a certain role 'elevated' and the role will show up there.

To your use case: no. You need to have the role to be able to elevate to it. Making the admin role an elevated role would be creating huge issues for normal admins. 

If someone, for some reason needs to perform certain tasks with the admin role, you should grant them the admin role or add other roles to the functionality you want to be available. If you create a custom, elevated role for that, you could achieve your requirement, but you should really ask yourself why the hassle. If it's admin related, you only should have admins do this. And if they shouldn't always be working as admin, you should give them a second user the can log in with, that does have the admin role. 
OOB Security reports can tell you which admin logged in when.

[Anushree Sarkar]

Thank you Mark for the detailed explanation. I agree with your inputs. 

Regards,

Anushree

[Chaitanya ILCR]

Hi @Anushree Sarkar 

You make a role as elevated role 

It will appear in the options 

Removing the elevated check box on the role will remove the option

I don't recommend doing it for oob roles

Regards 

Chaitanya 

[Anushree Sarkar]

Thanks Chaitanya. Agreed. 

[Michael Laban]

Yes, roles can be added to the list.  The list is dynamically created based on the logged in user.  The first step is to create a new role and have the "Elevated privilege" checked off on the Role.  Next, assign the role to a user -- roles do not appear in the list by simply be checked as "elevated privilege".  Log out (note, you will need to log out, even if you added the role to the current user logged in).  Log in with the user that has the been assigned the elevated privelege role.  Click on the Profile button then "Elevate role" and your custom role will be in the list.