Granular account permissions?..

The way I've done it is by using Account Limitations, especially if you use AD groups or usergroups:

-Create a Group with the nodes/queries necessary

-Create/add the user or usergroups

-Use the "Account Limitations" section under the Edit Account page for the user or group

This was effective for me by saying "Hey, anything that begins with this name or has this machine type is a radio setup that the IT team doesn't need to worry about, but the (insert medical services group) folks need to see and manage this." We would also build views around those groups and change the default views of the group to help.

The problem is that this means the Nodes are not viewable to those accounts with the account restriction. I have a similar issue in my environment in that the users want to be able to view the entire environment, but I don't want to give any of them Edit Nodes rights to Nodes they don't look after. The way I got around this is that everyone has a Read-Only account by default, and we use AD Account Elevation. So there is a RW Account higher in the AD Group roles which has Account Limitations and Edit Node access. The users have an online portal where they can request access to the elevated AD Role (For a set amount of time and with an approved change request) which means the account will then change to only be able to View their devices but they will have edit access. When they are done with the change the elevated role is removed and they go back to having View access to everything.

The problem is that this means the Nodes are not viewable to those accounts with the account restriction. I have a similar issue in my environment in that the users want to be able to view the entire environment, but I don't want to give any of them Edit Nodes rights to Nodes they don't look after. The way I got around this is that everyone has a Read-Only account by default, and we use AD Account Elevation. So there is a RW Account higher in the AD Group roles which has Account Limitations and Edit Node access. The users have an online portal where they can request access to the elevated AD Role (For a set amount of time and with an approved change request) which means the account will then change to only be able to View their devices but they will have edit access. When they are done with the change the elevated role is removed and they go back to having View access to everything.

Ah that's a pretty slick solution to it, nice dgsmith80! Thanks for sharing.