1 Delegate computers to a security role
You delegate computers to each security role in SoftwareCentral with collection memberships. A role only sees and works on the users and devices that are members of the collections selected for it.
The settings are in the security role wizard, opened from Settings › Security Roles. See Security roles for the whole wizard.
| What you delegate | Where in the security role |
|---|---|
| Computers and users | Step SCCM security: Collections. The role can only see devices and users in the selected collections. You can also set a Maximum number of resources the role may work on in one operation. |
| Queries | Step SCCM security: the SCCM queries the role may use. |
| Operating systems | Step SCCM security: OS task sequences, used when importing and reinstalling computers. |
| Computer templates | Step SoftwareCentral Security 2: Computer templates. Must always use a template and Grant rights to all templates are extra options. |
| Software and Software Groups | Step SoftwareCentral Security 1: Package security groups. See Application Delegation. |
| Intune devices, users and groups | Step Intune Security: choose the Intune tenant and tick Grant access to tenant. The role can then manage the devices (Intune Devices), users (Intune Users) and groups (Intune Groups) that are members of the group you pick, including nested groups. Group members are cached, so it can take up to an hour before a resource you add to the group is available in SoftwareCentral. |
| What users may do | Step SoftwareCentral Security 1: Choose menu functions that will be available to this security role. This decides which interfaces and actions the role sees, for example deleting computers, the client actions and remote control. Grant rights to all submenu buttons of selected buttons gives the role every function under the buttons you selected. |
| Where computers may be placed | Step AD Security: the organisational units available to the role. Grant full access to the active directory is ticked by default; untick it to choose the OUs yourself and which objects (users, groups, computers) are allowed. Tick Locked on an OU so that a sub OU cannot be selected when a device is imported. |
| Sites | Step Role Details: the sites the role can manage, and its default site. |
2 Best practice
- Give each role only what it needs. Select the smallest set of collections, queries, operating systems, templates and menu functions that lets the role do its job.
- Delegate by collection. A role only sees the devices and users in its collections, so build the collections around who is responsible for the computers.
- Limit how much one operation can do. Set Maximum number of resources this role can work on in a single operation; 0 means no limit.
- Make roles use templates. Tick Must always use a template and assign only the templates the role needs, so computers get the values you intended.
- Be careful with the grant-all options. Grant rights to all templates, Grant rights to all OS Task Sequences and Grant full access to the active directory also cover everything you add later.
- Check the role with a test user. Sign in as a member of the role and confirm that only the intended computers, tools and OUs are visible.