Our admins have the Authentication Administrator role and can add authentication methods for other users, but not for one particular account. The account doesn't appear to have an admin role. Privileged Authentication Administrator can make the change. What should I check?
Why can't an Authentication Administrator add methods for one user?
Asked by
8r+worklight_624
Answers
Check whether the user belongs to a role-assignable group, even if the user has no admin role directly assigned. That membership can make the account subject to additional protection, so an Authentication Administrator may not be able to manage its authentication methods.
Look for a group with the role assignment option enabled. It's easy to miss if you're only checking the user's direct role assignments.
Reply to this answer
Also check the scope of the admins' role assignments and whether the target is in a restricted administrative unit. A role assignment that works for other accounts doesn't necessarily cover every user.
Reply to this answer
Add your answer
Answers are reviewed before publication.
8r+worklight_624:
Would that still matter if the group wasn't supposed to grant an admin role?
+loosely!crosschecked_7:
Yes, check the group's role-assignable setting itself. The distinction can be easy to miss when reviewing the user's roles.