Forum Discussion

ncustis's avatar
ncustis
Icon for Neophyte rankNeophyte
11 months ago

Letting non-admin users make and manage their own dynamic groups

We’ve got an environment that is maturing into a space where our SMEs are now wanting to take some ownership of their device organization and alert tuning. Part of that has butted up against dynamic ...
Dynamic group
permissions
  • Anonymous's avatar
    Anonymous
    10 months ago

    This seems like it would be a natural evolution of LM towards using actual multi-tenancy. The FR i submitted looks like this (in case you want to copy/paste).

    Inheritance of additional appliesto clause

    I would like to specify a property on a parent group called mandatoryAppliesTo and have that appliesto "AND"ed to every appliesto of every dynamic group under the group containing the property. 
    This would simplify our current appliesto and make our standard dynamic group definitions under each customer folder identical, with the parent folder adding to each dynamic group under the customer to ensure only that customer's devices are included.
    This also gives us the ability to delegate dynamic group management under customers to non administrators while ensuring they don't accidentally cross tenant boundaries.

    More details and discussion can be found here: https://community.logicmonitor.com/product-discussions-22/letting-non-admin-users-make-and-manage-their-own-dynamic-groups-4073?postid=14899

tswisdom's avatar
tswisdom
Icon for LM Conqueror rankLM Conqueror
10 months ago

Unfortunately, this comes down to the functionality of Dynamic Groups themselves. The intention is to allow a user to control membership of a group using the Applies To language, and subsequently, grants a user the ability to include any resource within a portal.

Because this naturally allows someone with permissions to manage Dynamic groups the capacity to access all resources, in order for customers to be able to effectively control user access, dynamic grouping is restricted to users with manage permissions for all resources.

With that said, it may theoretically be possible to accommodate this with “view all” permissions as opposed to “manage all”. I’d suggest submitting feedback through your portal requesting additional access control options for dynamic groups.