When defining permissions for domains, Apex One automatically applies the permissions for a parent domain to all the subdomains that it manages. A subdomain cannot have lesser permissions than its parent domain. For example, if the System Administrator has permission to view and configure all Security Agents that Apex One manages (the Apex One Server domain), the permissions for the subdomains must allow the System Administrator access to these configuration features. Removing a permission on a subdomain would mean that the System Administrator does not have full configuration permissions for all Security Agents.
For the following procedure, the domain tree is as follows:
user-accounts-def-pe.jpg
For example, to grant the user account Chris permissions to view and configure specific menu items for the subdomain Employees but only grant permission to view logs in the parent domain Managers, perform the following procedure.

Permissions for User Account Chris

Domain
Desired Permissions
Apex One Server
No special permissions
Managers
View Logs
Employees
View and configure Tasks
View and configure Logs
View Settings
Sales
No special permissions

Procedure

  1. Go to the User Accounts: Step 3 Define Agent Tree Menu screen.
  2. Click the Apex One Server domain.
  3. Clear all View and Configure check boxes.
    Note
    Note
    The Apex One Server domain is only configurable if you selected all of its subdomains on the User Accounts: Step 2 Agent Domain Control screen.
  4. Click the Sales domain.
  5. Clear all View and Configure check boxes.
    Note
    Note
    The Sales domain only displays if selected on the User Accounts: Step 2 Agent Domain Control screen.
  6. Click the Managers domain.
  7. Select to View Logs and clear all other View and Configure check boxes.
  8. Click the Employees domain.
  9. Select the following menu items for Chris:
    • Tasks: View and configure
    • Logs: View and configure
    • Settings: View
    Chris can now view and configure the selected menu items for the Employees domain and can only view Logs for the Managers domain.
If Chris has permission to view and configure the Managers domain, Apex One automatically grants the same permissions to the Employees subdomain as well. This occurs because the Managers domain manages all of its subdomains.