To add a customized role, complete the following steps:

1. On the Role Management page, click Add Customized Role in the upper-right corner. The Add Customized Role pane opens.
   
2. Under Base Role, select the system role you want to use as the starting point for your customized role. The new role inherits all permissions from the selected base role.

NOTE  The Co-Managed role cannot be customized.

3. Under Role details, type a name for the role in the Role name field, then type a brief description in the Description field (up to 200 characters).
4. Under Permissions, review the permission groups and individual toggles. Turn individual permission toggles off (or back on) to customize access for this role. Note the following:

• The new role starts with the base role's permissions, and you then restrict access by turning off permission toggles. To re-enable a permission, simply turn its toggle back on.
• At least one qualifying permission must remain enabled.

• For roles based on Admin, at least one of the following must be enabled: Security & Identity, Unified Login, User & Access Management, or Automations.
• For roles based on Billing and Purchasing, all Billing & Purchases permissions other than Compare Invoices and Tax Exemption Tool must be enabled.
• For roles based on User, at least Support Portal or Cooper Insights must be enabled.

• Some permissions under Billing & Purchases are bundled and cannot be controlled individually. These items are marked with an asterisk (*) and display an Individual control coming soon tooltip.
• Some permissions, such as Access own tickets and Create support tickets under Support Portal, are always included and cannot be disabled.
• The customized role's configuration must differ from the base role's default configuration by at least one permission change.

5. Click Add Customized Role to save the new role.

The new customized role appears in the role list on the Role Management page with Active status. You can now assign this role to users when adding or editing user accounts.

To edit a customized role, complete the following steps:

1. On the Role Management page, locate the customized role you want to edit.
2. Click the More menu (vertical ellipsis) at the end of the role's row, then click Edit. The Edit Customized Role pane opens, pre-filled with the role's current settings.
   
3. Update the Base Role, Role name, Description, or Permissions as needed. The same validation rules that apply when creating a role apply when editing. At least one qualifying permission must remain enabled, and the configuration must differ from the base role's defaults.
4. Click Save to apply your changes.

A Role updated confirmation appears at the bottom of the page, and the role list reflects your changes.

NOTE  Users already assigned to the role retain access based on the updated permissions immediately after you save.

BEFORE YOU BEGIN  Before locking a customized role, you must remove it from any IdP SSO configuration in Advanced Single Sign-On Settings.

Locking a role prevents it from being assigned to new users. Users already assigned to a locked role retain their current access until their role is changed. Locked roles cannot be selected when assigning roles to users.

To lock or unlock a customized role, complete the following steps:

1. On the Role Management page, locate the customized role you want to lock or unlock.
2. Click the More menu (vertical ellipsis) at the end of the role's row.
3. Click Lock to lock an active role, or click Unlock to reactivate a locked role.

The role's Status column updates to reflect the change.

BEFORE YOU BEGIN  Before deleting a customized role, you must reassign all users currently assigned to it, and remove it from any IdP SSO configuration.

To delete a customized role, complete the following steps:

1. On the Role Management page, locate the customized role you want to delete.
2. Click the More menu (vertical ellipsis) at the end of the role's row, then click Delete.

3. Confirm the deletion when prompted.

The customized role is permanently removed from the Role Management page and is no longer available for assignment.

No. System roles cannot be modified or deleted.

System roles (Admin, Billing and Purchasing, Co-Managed, and User) are predefined and always in Active status. If you need a variation of a system role, create a customized role using that system role as the base. Refer to Add a customized role.

NOTE  The Co-Managed role cannot be customized.

Users already assigned to the role keep their current access, but no new users can be assigned to the locked role.

A locked role cannot be selected in the role selection list when adding or editing users.

To remove a locked role from existing users, edit each user account and assign them a different role.

You can see which users are assigned by clicking the role row to open the Role Details pane. To assign a different role to a user, see Edit a user.

A customized role cannot be deleted while users are assigned to it or if it is used in IdP SSO configuration.

If the Delete option is disabled, the role cannot be deleted as it is currently used in IdP SSO configuration or assigned to users. Hover over the Delete option for details.

• If you see This Role is the default Role for Just-in-Time user creation, select a different role for automatic user creation in Advanced Single Sign-On Settings. Refer to Configure Enable Automatic User Creation for a third-party IdP SSO in KaseyaOne.

• If you see This Role is used in Mapping Rules configuration, select a different role for the rule in Advanced Single Sign-On Settings. Refer to Configure third-party IdP Groups Access Control in KaseyaOne.

• If you see This Role is assigned to users, select a different role for all users in User Management. You can see which users are assigned by clicking the role row to open the Role Details pane. To assign a different role to a user, see Edit a user.

Yes. Customized roles can be specified in a bulk user import file.

When using the CSV bulk import feature, you can enter the name of any active customized role in the role column of your import file. The role name must match an existing active role but is not case-sensitive. If the name does not match an existing active role, the record will not be processed. Refer to Import users in bulk.

The role configuration must differ from the base role and must have at least one qualifying permission enabled.

The system prevents saving a customized role in either of the following cases:

• The role's permission configuration is identical to the selected base role. You must disable at least one permission toggle before saving.
• All permissions are disabled. At least one permission must remain enabled.

For roles based on Admin, at least one of the following groups must be enabled: Security & Identity, Unified Login, User & Access Management, or Automations. For roles based on Billing and Purchasing, all Billing & Purchases permissions other than Compare Invoices and Tax Exemption Tool must be enabled. For roles based on User, at least Support Portal or Cooper Insights must be enabled.