roll based access control

[darnorri]

got this question from a customer

Is there a way to restrict an ISE Admin to maintaining policy for certain Identity Groups?

Any help would be greatly appreciated.

[Mike.Cifelli · Accepted solution]

As far as I know you cannot accomplish that scenario. As far as Authorization permissions for RBACL it is broken down by Menu and Data access. In the Menu access you can either Show or Hide all policy sets. However, you can grant RBACL for the admins to only manage their specific identity groups via specific configuration under Data access. That would be similar to modifying the Policy Admin Data Access role. HTH!