Adding roles

Before you can configure your role-based access control policies, an Account administrator must define your roles.

1. From the homepage, click Organization > Roles .
2. Click Add role.
3. In the General section, enter the following information:
   • Name
   • Description
   • Internal notes

     Special instructions visible only to the Account administrator, Role owner, and Role manager.

   • Example:

     Only permanent employees based in Montreal should be in this role. Discuss with security before adding employees to this role.
4. (Optional) In the Notifications section, select the email notifications sent to stakeholders when role membership is changed.
5. In the Advanced settings section, select the request approval workflow:

   Automatic approval

   Role membership requests are automatically approved.

   Role manager or owner

   Role membership requests need to be approved by the Role manager or Role owner.

   Identity supervisor

   Role membership requests need to be approved by the Supervisor of the identity receiving the role.

   Two-step approval: First, the identity's supervisor; then the role manager or owner

   Role membership requests need to be approved by the Supervisor of the identity receiving the role, then by the Role manager or Role owner.

6. Choose the role's visibility:

   Public

   The role is visible to everyone, and role membership requests can be created. This is the default setting.

   Private

   The role is private and should be hidden during role membership requests and role access requests.

   Because of their higher permission level, Role owners, Role managers, and Account administrators can still see private roles when making requests.

7. (Optional) In the Expiry enforcement settings set a maximum duration for role membership.
   1. Select Enforce a maximum duration for all role requests associated with an identity.
   2. Enter a maximum duration for membership to the role.
8. Click Save.