To be able to manage roles the user should have the ‘Administrator’ role. Without this role the user won’t be able to see the roles (unless they have the permission to update user roles), update or delete roles.
Propagating roles
A role can be made available to all sub organizations. When doing this the sub organization will be able to view and can make use of this role by assigning it to their users. This can be used when multiple sub organizations need access to this same role. By doing this you’ll also keep the control over the role. When deciding if you should consider the following:
-
Is the role needed within multiple sub organizations?
-
Do you need to retain control over the role?
-
Does the role need to be at your level or could it also be made on a lower level without needing propagation?
Keep in mind that after making a role available you won’t be able to make it unavailable unless there are no users from sub organizations that have this role. In most cases you won’t need the role propagation and the role can be made in the organization that needs it.