--- title: "Configure admin roles" slug: "configure-admin-roles-v6-5" description: "Set up Admin Roles with tailored privileges in Appgate SDP to enhance system security and control access to resources effectively." updated: 2025-10-31T18:28:03Z published: 2025-10-31T18:28:03Z canonical: "support.appgate.com/configure-admin-roles-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure admin roles Check [Before you start](/v1/docs/admin-roles) which includes links to system security best practices. When you're ready use <+Add> to set up a new Admin Role. You can use on of the presets or create your own role by choosing Empty. ![Menu displaying various templates for creating admin roles.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/config_admin_roles.png?sv=2026-02-06&spr=https&st=2026-10-29T06%3A29%3A12Z&se=2026-10-29T07%3A29%3A12Z&sr=c&sp=r&sig=Nxc6b7FqqBO1lnWlmr54t1dbOo5wV%2BUWe17ZUR3hwNQ%3D) Presets provide an easy way to access to pages such as the Dashboard, which work slightly differently from other single function pages as they can contain a number of **Target Items**. Unless the right privileges are configured, the admin will have only partial access to the information. In the case of the Dashboard the preset provides the following privileges: - privileges on - privileges on - privileges on - privileges on (for user-sign-ins) - privileges on - privileges on ## Add Admin Role ***Name*** May only be alphanumeric with space, underscore and dash. ### Settings ***Privileges*** Privileges allow specific rights to be assigned to an Admin Role. Multiple Privileges may be added to one Role. i.e. view/edit/delete Policies tagged with CustomerA. Note that Admin Roles default to Privilege Types on Target Items ie. the role will permit full system admin privileges to all entities on the system. Change these settings when delegating administration to control permitted access and actions with the same level of granularity that is applied to control user access to network resources. Privileges can be configured to enable or a particular Privilege Type to be applied to a type of Target (such as Appliances or ) or to a specific Target (such as a named Appliance or Entitlements tagged with ). To add a new Privilege to an Admin Role, select <+Add> to open the Privileges form: ![Settings for editing privileges for admin roles.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag42-privilege2.png?sv=2026-02-06&spr=https&st=2026-10-29T06%3A29%3A12Z&se=2026-10-29T07%3A29%3A12Z&sr=c&sp=r&sig=Nxc6b7FqqBO1lnWlmr54t1dbOo5wV%2BUWe17ZUR3hwNQ%3D) *Privilege Type* Select the Type of action the administrator can perform. i.e. Delete or Export. The default Privilege is ie. all possible actions, which can be applied to (all) Target Items. *Target Item* Select the feature on which the action can be applied. i.e. Condition or License. Not all Privileges are relevant to all Target Items. The list of Target Items in the drop down list will depend on which Privilege type has been selected. See the Privilege-Target Combination section below. Target Items can be further restricted by adding optional Scope of Privilege to the Role. *Limit Scope of Privilege by Name* Restrict the Target further to features with these specific name(s). *Limit Scope of Privilege by Tag* Restrict the Target further to features with these specific tag(s). In the example above, an Admin Role is being created to allow an Administrator to Edit the Local database. In the example below, the Privilege will be restricted to Policies tagged 'Administrators'. ![Example of privileges for an admin role that is restricted to policies with the Administrators tag.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/ag42-privilege1.png?sv=2026-02-06&spr=https&st=2026-10-29T06%3A29%3A12Z&se=2026-10-29T07%3A29%3A12Z&sr=c&sp=r&sig=Nxc6b7FqqBO1lnWlmr54t1dbOo5wV%2BUWe17ZUR3hwNQ%3D) *Default Tags* These tags will be added by default when creating a new instance of the specified target. To change these requires Edit rights on the Target. ***Privilege-Target Combinations*** | | Privilege Type | | --- | --- | | Target Item | All | Assign Function | Backup | Check Status | Create | Delete | Download Logs | Edit | Export | Get User Attributes | Reboot | Renew Certificate | Reevaluate | Revoke | Tag | Test | Upgrade | View | | Admin Role | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Admin Message | yes | | | | | yes | | | | | | | | | | | | yes | | Allocated IP | yes | | | | | | | | | | | | | | | | | yes | | Appliance | yes | yes | yes | yes | yes | yes | yes | yes (excludes assign function) | yes | | yes | yes | | | yes | yes (for appliance commands) | yes | yes | | Appliance Customization | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Audit Log | yes | | | | | | | | | | | | | | | | | yes | | Auto Update | yes | | | | | | | yes | | | | | | | | | | yes | | Blacklist | yes | | | | yes | yes | | | | | | | | | | | | yes | | CA Certificate | yes | | | | yes | yes | | yes | | | | | | | | | | yes | | Client Profile | yes | | | | yes | yes | | yes | yes | | | | | | yes | | | yes | | Condition | yes | | | | yes | yes | | yes | | | | | | | yes | yes | | yes | | Criteria Script | yes | | | | yes | yes | | yes | | | | | | | yes | yes | | yes | | Device Claims Script | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Entitlement | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Entitlement Script | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | FIDO2 Device | yes | | | | | yes | | | | | | | | | | | | yes | | File | yes | | | | yes | yes | | yes | | | | | | | | | | yes | | Global Setting | yes | | | | | yes | | yes | | | | | | | | | | yes | | Identity Provider | yes | | | | yes | yes | | yes | | yes | | | | | yes | yes | | yes | | IP Pool | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | License | yes | | | | | yes | | yes | | | | | | | | | | yes | | Local User | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | MFA Provider | yes | | | | yes | yes | | yes | | | | | | | yes | yes | | yes | | OTP Seed | yes | | | | | yes | | | | | | | | | | | | yes | | Policy | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Registered Device | yes | | | | | yes | | | | | | | yes | yes | | | | yes | | Ringfence Rule | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Secret | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Service User | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Session Info | yes | | | | | | | | | | | | | | | | | yes | | Site | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | Token Record (Deprecated) | yes | | | | | | | | | | | | yes | yes | | | | yes | | Trusted Certificate | yes | | | | yes | yes | | yes | | | | | | | | | | yes | | User Claim Script | yes | | | | yes | yes | | yes | | | | | | | yes | | | yes | | User License | yes | | | | | yes | | | | | | | | | | | | yes | | ZTP | yes | | | | yes | yes | | yes | | | | | | | | | | yes | The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions. Labels assigned to entitlements or resources that help categorize and manage them within the Appgate ZTNA system. Key-value pairs related to the identity and content of the user or device and are specific to each session. A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system. A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements. A digital key used to authenticate and authorize users or devices, enabling secure access to resources.