PIM Manager settings

Requires a second administrator to approve any Review & Save commit or row deletion that touches privileged access before PIM Manager writes it. The check runs in PIM Manager at the moment you commit; it applies from...

Lets the engine look for resources it does not manage yet. At the end of each engine run it lists your Azure subscriptions and management groups (and Power BI workspaces when that integration is on), and the daily dis...

The master switch for every mail PIM Manager and the engine send. It covers alerts, digests, reminders, escalations, the tier report, access-request and review mails, and the mail that delivers a new admin's first sig...

The switch for posting alerts to a Microsoft Teams or generic webhook. PIM Manager posts an alert to the webhook only when this switch is on AND a valid HTTPS webhook URL is saved in the alerting settings. It is on by...

Lets the engine apply your workload role delegation. This covers Intune and Defender XDR role assignments, including Defender custom roles built from a role specification, and the generic workload-connector rows (wher...

The switch for the enterprise-app app-role connector. The engine applies app-role assignments from your app-role definitions only when it is on. Azure DevOps, Dataverse, Business Central and Power Platform rows actual...

Controls only whether the engine's end-of-run discovery sweep lists your Power BI workspaces. Power BI workspace role rows are applied by the workload connectors (they need this entry's Pro licence, not this switch),...

Turns on the access-request job that runs every minute. It publishes who may request access to the public request portal, takes in submitted requests, decides them (auto-approved or by the department owner, per depart...

Accepts access requests that other systems (for example ServiceNow) send to the REST API on the public broker. A caller can ask for an admin account to be enabled, or a group membership, for a set time, and read or ca...

Opens the Model Context Protocol endpoint on PIM Manager, so an AI assistant or agent signed in with an Entra account can read who has what, pending changes, jobs and problems. It can also stage and commit changes thr...

Lets PIM Manager work with your on-premises Active Directory through the hybrid worker, a small service you install on a domain-joined server. It creates admin accounts in AD, mirrors the PIM groups you mark for AD to...

The switch for replication between a managing tenant and its managed tenants. On a managing tenant it gates the publish job (the signed baseline managed tenants read); on a managed tenant it gates the pull job (readin...

Runs the licence-request job every 30 minutes. When no valid Pro licence for this tenant is installed, or the installed one ends within 30 days, PIM Manager asks Invardia for its licence. When one is delivered, it che...

Runs the install-key job every 6 hours. When this install has a Pro licence for this tenant and no Invardia install key yet, it claims one by sending Invardia the licence file and this tenant's id. The key lets the ni...

Runs the uplink job every hour. It reports to Invardia which jobs ran and whether they succeeded (one report per job, never one per run), and every hour a heartbeat with version, edition and licence state. Without an...

Adds a setup report to the hourly uplink run: once a day and whenever something changes, the state of the critical settings (updater deployed and scheduled, update ring, install key, licence, mail sender, alert recipi...

Adds the cause of every problem to the hourly job reports: a stable error code (for example pim-entra-0104), the kind of cause, who acts and one short technical line, and adds the Microsoft services the tenant is lice...

The master switch for the scheduler. Every scheduled job checks it before it runs: engine reconcile runs, the change queue, discovery, digests and reminders, access-request handling, licence checks and requests, telem...

Turns on the action paths of the Approvals page: raising an approval request, deciding it, and running an approved offboarding. When off, the page can be viewed, but PIM Manager refuses those actions. PIM Manager read...

Turns on the action paths of the Template Rollout page: adding and revoking exemptions, approving a template version, and deploying a template's rows. When off, the page and its conformance view can be read, but PIM M...

Records the commercial edition of this tenant (Core, Pro, or Pro (Design Partner)), with a grant basis (paid or design partner) and a note. The value is stored, shown and audited. Which Pro features actually work is d...

Says which deployment shape this install runs as: a single tenant, a managing tenant, or a managed tenant (hosted centrally or locally). The mode badge at the top, the managing-tenant pages, the managed-tenant pull an...

The signed licence document from Invardia. It is the one thing that decides which Pro features this environment may use, and whether it may run as a managing or managed tenant. You register it by picking or pasting th...

The Home page -- the landing page of PIM Manager with per-tier counts, gaps, orphans, engine and job status and the "what needs my attention" call-out.

Shows or hides the Access map page (Access > Access map): the live graph of who can reach what -- admins, groups, nested groups and targets -- where you can also link people into groups and groups into permissions (st...

Shows or hides the bulk change page (Access > Create & change access (bulk)): duplicate a group or delegation to many targets, bulk-attach, move an admin between groups, each with a preview before it is staged.

Shows or hides the Pending changes page (Pending changes > Review & commit queue) -- the one queue where every staged change (configuration edits, revokes, TAP re-issues, session revokes) is reviewed with a diff and c...

Shows or hides the Check for problems page (Pending changes > Check for problems): it checks your configuration for orphans, naming errors, missing owners and stale roles before you commit, each with a suggested fix.

Shows or hides the Delegation overview (All privileged permissions) page (Reviews & controls > Delegation overview (All privileged permissions)): who holds an active assignment right now, with revoke of what is not ne...

Shows or hides the Approvals page (Reviews & controls > Approvals): the second-person queue where an offboarding, revoke or sensitive change is raised, approved or denied by a different admin, and executed.

Shows or hides the Jobs & status page (Jobs > Jobs & status): each scheduled job's cadence, last result, next run and failures, with Run now and the run history.

Shows or hides the Drift page (Reviews & controls > Drift: live vs desired), which compares your tenant with what PIM says it should be, per area. The old Governance page it is named after no longer exists, so today t...

Shows or hides the Look up a role page (Access > Look up a role): what a role can do, which roles grant an action (least privilege first), who can activate a role, and a side-by-side compare of two roles.

The Audit trail page (Operations > Audit trail): every change, who made it and when, with before and after, filter, search and export.

Shows or hides the Support page (Operations > Support): a one-click connectivity and permission self-check (SQL, Graph, Azure) and a sanitized diagnostics bundle to hand over when you need help.

The Settings page itself -- where this Features card lives.

Shows or hides the guided wizards (Access > Create access): create an administrator (with a future creation date and TAP start), build a direct group, or delegate a permission -- names, level, tier and plane are deriv...

Shows or hides the Invite a guest or consultant page (Admin accounts > Invite a guest or consultant): B2B guest invitation into the delegation model, and enable or disable a managed consultant account.

Shows or hides the editable tables: Access > Delegations -- all rows (change an eligibility from 90 to 365 days, Active or Eligible, or the policy of an existing delegation) and Access > All records (the raw records b...

Shows or hides the Reports page (Reviews & controls > Reports): "who can do what" and the reverse -- pick a person to see everything they can reach, or a role to see who can activate it; printable and exportable evide...

Shows or hides the Access reviews page (Reviews & controls > Access reviews): recertification campaigns end to end -- attest (approve, deny, recertify) with a justification, assign reviewers, send reminders and export...

Shows or hides the Tenant Baseline page (Templates > Tenant Baseline): how this tenant, and every tenant you manage, compares with the approved templates, and rolling a template version out by ring.

Shows or hides the Managed tenants page (Reviews & controls > Managed tenants): which of your central admins and roles reach each managed tenant, what was held back and why, and the per-relationship projection policy....

For a live demo environment. While on, every signed-in member of the demo guest group becomes a demo viewer: they can open every page and stage changes in their own browser, but the server refuses every commit, approv...

The Entra ID group, by display name or object id, whose members become demo viewers while Demo mode is on. Nested members count. Guests are matched by their home address as well as their guest UPN.

A short name for this PIM environment, at most 40 characters -- for example Test (EU) or Production -- so several open PIM Managers, and their mails, can be told apart.

The domain after the @ in every admin account PIM creates in this tenant, picked from the tenant's verified domains. On a managed tenant it is also the domain the admins replicated from the managing tenant are created...

One prefix per admin type (internal admin, external admin / consultant, guest). The prefix fills the {AdminTypePrefix} token in the admin account patterns, so an external admin can be named x-admin-abc-id while an int...

One suffix per environment: Entra ID (cloud) and on-premises Active Directory. It fills the {Platform} / {EnvironmentSuffix} token in admin and group names, e.g. admin-abc-id for the cloud account and admin-abc-ad for...

The start of the tag of each direct-group type (role, organisation, department, project, cross-org). It fills {GroupTypePrefix}; the rest of the tag is {ShortName}, e.g. ROLE-HelpDesk. The tag is then placed in the PI...

The administrative unit (by its tag) that a new group of each direct-group type is placed in.

The administrative unit a permission group (an Entra role, Azure role or workload role group) is placed in, by its privilege level L0, L1 or L2.

The first part of a permission-group tag ({Service}), per service, e.g. Entra-ID-UserAdministrator-L1-T0-CP-ID.

The word your admin accounts use, e.g. Admin or adm. It fills {AdminWord} in the admin account patterns (and any other pattern that uses it), so one naming template serves every tenant.

An optional short name for this tenant, e.g. TST or EU. It fills {TenantCommonName} wherever you use it in a pattern, a prefix or a suffix, so the same naming template works in every tenant.

The user name of a normal (day-to-day) admin account. Names are rendered in lower case, and a domain is added from the admin account domain setting.

The user name of a high-privilege (L0 / Tier 0) admin account, used when an admin row has Purpose = HighPriv. Note: the shipped pattern has no {AdminTypePrefix}, so external high-privilege admins get no x- unless you...

Text added after the person's name in a new admin account's display name. Tokens such as {Initial} or {Platform} may be used.

The name starts that identify an admin account. The engine reads admin accounts from your tenant only where the user name starts with one of these, so ordinary users are never in scope. Tokens are allowed; only the pa...

The admin type used when an admin row does not name one. It picks the prefix from the Prefix by admin type table. The list offers only the types that table defines.

The environment used when a row does not name one. It picks the suffix from the Suffix by environment table, for admin names and for the {Platform} token in group names.

The name of a PIM group, built around its tag ({Role}). It is also how PIM Manager and the engine recognise your groups: the literal text before the first token (PIM- by default) is the prefix used to find managed gro...

The name of a permission group that grants an Entra role inside one administrative unit. {Role} is the tag without its AU part, {AdminUnit} the administrative unit.

Optional, advanced: a regular expression every group tag must match. It only drives the naming check before commit; it does not change any name and the engine does not use it to act.

Despite the key name, this is the name of a PERMISSION group (Entra role, Azure role, workload role) -- not an Azure resource group. Tokens: {Workload} / {Service}, {Scope}, {Permission}, {Level}, {Tier}, {Plane}, {Do...

The display name of an administrative unit that the Create access wizard adds for a new group type. {AdminUnit} is the administrative unit tag without its PIM- prefix (e.g. PIM-PROJECTS becomes PIM-Groups-PROJECTS).

The on-premises Active Directory OU (distinguished name, e.g. OU=Admins,DC=example,DC=com) where new day-to-day admin accounts are created. Only for tenants with on-premises AD.

The on-premises AD OU where new high-privilege (L0 / Tier 0) admin accounts are created -- rows with Purpose = HighPriv, or with no Purpose and a user name that matches the high-privilege admin pattern.

Name-marker filters, each with a key, a label, any-of patterns (with *) and markers every match must also contain. They are kept for compatibility with the earlier engine generation.

The text at the end of a PIM group name that marks the group as also existing in your on-premises Active Directory. The hybrid worker mirrors every defined PIM group named <your group prefix>*<marker> to an AD securit...

A full wildcard that replaces the derived pattern for which PIM groups are mirrored to AD. Only groups defined in PIM Manager are ever considered -- the pattern never reaches AD groups PIM Manager does not define. The...

The end of a cloud admin account name (its mail nickname) that the hybrid worker swaps for the AD admin suffix to find the matching on-premises account. Example: Admin-JDOE-ID in Entra ID becomes Admin-JDOE-AD in AD....

The end of the AD admin account a cloud admin maps to, and the safety marker for removals: the sync only ever removes a USER from a mirrored AD group when its account name ends in this suffix. Service accounts, nested...

The distinguished name of the organizational unit (OU=...,DC=...) where the hybrid worker creates AD groups for mirrored PIM groups that do not exist in AD yet. Groups are created as global security groups with the PI...

The name of the per-server permission group that becomes local administrator on one server. Tokens: {prefix} (your group prefix), {server} (required), {cloud} (the cloud admin suffix) and {marker} (the AD group marker...

One AD group (name, or DOMAIN\name) that server onboarding also adds to the local Administrators group of every onboarded server -- next to that server's own per-server group. It replaces the shared all-servers group...

Account names (comma or semicolon separated, no wildcards) that the just-in-time sync never removes from a mirrored AD group, even when they carry the AD admin suffix and have no active PIM activation. They are report...

How many mirrored groups one parallel batch reads from Microsoft Graph per sync pass when the worker looks up who has each group activated. Allowed 1-1000. It is a speed setting only -- it does not change who is added...

How many group batches the hybrid worker reads from Microsoft Graph at the same time during a sync pass. Allowed 1-64. Higher is faster until Graph starts throttling. It does not change who is added or removed.

How the hybrid worker reads the time at which an activation ends. Type on or off. On: the end time is always read as UTC, which is what Microsoft Entra sends. Off: it is read as before, which is only exact when the cl...

The organizational units the hybrid worker looks in when it lists Windows servers. Enter distinguished names, one per line or separated by a semicolon; several OUs are allowed and sub-OUs are included. A server is alw...

Organizational units whose servers the hybrid worker never lists. Enter distinguished names, one per line or separated by a semicolon; sub-OUs are included. It works with the whole domain and with the list of OUs to l...

A server is listed only when its computer object in Active Directory last changed within this many days. This is the date the object changed in the directory (a domain-joined computer renews its password about every 3...

Wildcards for the server names to list, separated by a comma, a semicolon or a new line (for example SRV-*, FS??). Letters, digits, - and _ with the wildcards * and ?.

Wildcards for server names that are never listed, separated by a comma, a semicolon or a new line (for example TEST-*). A wildcard that would match every server is refused.

The organizational units whose newly found Windows servers are collected into one list for a SuperAdmin. Enter distinguished names, one per line or separated by a semicolon; sub-OUs are included. Each OU must lie insi...

How many server groups of an approved list the hybrid worker creates in one run. Allowed 1-1000. The worker runs about once an hour and goes on, run after run, until the approved list is done. It does not decide wheth...

Extra organizational units where the hybrid worker looks for old PIM groups: Active Directory groups that carry the PIM naming but have no definition in PIM Manager any more. The OU for new AD groups is always include...

A list of workload role bindings (for example a Defender XDR or Intune role for a group) that you deliberately do not want created. Each entry names a workload and/or a role, optionally a group tag and a scope, a reas...

The company name shown on the public access request portal, so people can see where they are signing in. It appears in the page header and the browser tab title. Plain text, at most 40 characters.

One e-mail address shown on the public access request portal as a 'Need help? Contact ...' line with a mail link. A value that is not an e-mail address is refused at save and never published.

The Azure storage account shared by the public request portal and the engine. The portal writes requests there; the engine pulls them every minute with its managed identity, re-decides each one, and writes back status...

The https address of the public request portal. PIM Manager uses it as the link in mails to people who request access (enabled, ending, ended, denied), in the consultant company review mails, as the portal link on the...

The Entra application (client) ids allowed to call the access request REST API, typically your ticketing system. The engine publishes the list to the portal for a fast answer and re-checks every API request itself.

The permission groups that people using the request portal (typically consultants) may ask to join for a short time, in addition to the access they already have. Only defined groups are offered, and a group the accoun...

The length offered on the portal for an ad-hoc group membership, from 1 to 744 hours (31 days). The portal offers this value together with the request durations set on the person's department. When the time is up the...

Keys for systems that cannot use an Entra application token to call the access request API. Each key has a name, scopes (requests.write to submit, requests.read to read status) and a lifetime of 1-3650 days. The key i...

Separation of duties for approval requests (offboard, revoke and similar): by default the administrator who raises a request may not approve it -- a different administrator must. This switch lifts that rule for tenant...

Decides whether the engine deletes, in Microsoft Entra ID, the groups whose definition is marked Retire -- the mark that the bin on a group row and 'Remove all delegations, delete the group(s)' stage. The engine reads...

The longest activation PIM Manager lets any policy template recommend, picked from 1 hour to 3 days. It caps the PIM Manager recommendation for the groups and roles PIM Manager manages: a template whose 'An activation...

The longest eligible assignment PIM Manager lets a policy template allow (30, 90, 180 or 365 days). The engine applies it to the policies it writes for the groups and roles PIM Manager manages, where the template requ...

A floor on every activation policy the engine writes for the groups and roles PIM Manager manages. When it is on, the engine adds MFA to the 'To activate, require' checks of any policy template that sets those checks...

Decides whether the engine acts by itself on an admin account that is due for offboarding: its offboard date has passed, it is marked Retire, or its status is Revoked. The offboarding job (admin-offboarding) reads the...

Decides what the daily full run (the job full-reconcile) does with a leftover: a live assignment or membership that PIM Manager put in your tenant, whose definition was later removed by a PIM Manager commit, and for w...

How long an approval request (offboard, revoke and similar) may wait for a decision. A request that nobody decided in this time is closed as expired and can no longer be approved; the change must be requested again.

A change to the list of emergency access (break-glass) accounts is requested by one SuperAdmin and approved by another. This is how long such a request may wait. After that it expires and can never be approved; it mus...

A department owner can move the end date of one of their people further into the future on the My people page. This is the furthest they may move it, counted in days from today. An earlier date is not an extension and...

When the engine creates a group in Microsoft Entra ID it looks for an owner: the owners or sponsor on the group's definition, or the contact of its department. This switch decides what happens when none of them resolv...

The validation reports a permission or role group that nobody has activated for a long time, or ever, so you can decide whether the access is still needed. This is the number of days without an activation after which...

Department owners approve access requests and receive the mail about their department, and the links in that mail open PIM Manager. This sets whether the tick 'Give PIM Manager Reader access (their normal account)' is...

The rings that stage what a managing tenant replicates (central admins, delegations and other ring-tagged rows). A row on ring N reaches the managed tenants whose own ring is N or lower, so ring 0 gets new rows first...

Picks the one transport every PIM Manager mail uses -- TAP codes, approval and review mails, alerts, the daily digest and the tier report. Shared mailbox sends through Microsoft Graph as the environment's own identity...

The Exchange Online shared mailbox PIM Manager sends as when the mail mode is Shared mailbox -- named by your organisation: the mailbox name, one of the tenant's verified domains and the display name (step 1 of Get St...

The host name and port of the SMTP relay PIM Manager hands its mail to when the mail mode is SMTP relay, for example smtp.example.com on port 587.

Whether the connection to the SMTP relay is encrypted with STARTTLS or sent in clear text (None). Only STARTTLS on a plain port is supported; implicit TLS on port 465 is not.

The sender address on every mail PIM Manager sends through the SMTP relay, for example pim@example.com. Recipients see it as the sender; your relay may require that it is an address it is allowed to send for.

The sign-in PIM Manager uses on the SMTP relay. The user name, Key Vault name and secret name are stored with the settings; the password itself is written only to your environment's Key Vault and is never stored in th...

An emergency stop for every email PIM Manager sends: alerts, the daily digest, the tier report, TAP codes, approval, review and reminder mails, and test mails. It is checked at the single point every mail passes through.

A test and lab control: every PIM Manager email is sent to this one address instead of its real recipient. The original recipient is kept in the mail so you can see who it was meant for.

Limits PIM Manager email to the listed addresses. Any recipient not on the list is dropped; a mail with several recipients keeps only the listed ones. Matching is on the full address, not case-sensitive, and wildcards...

Who is mailed when PIM Manager raises an alert: job and engine failures, drift, expiring access, break-glass use, coverage gaps, missing targets and uncommitted changes. The same list receives the safety-breaker mails...

Who receives the daily summary mail sent by the scheduled daily-summary job (once every 24 hours by default; the cadence is on the Jobs page).

Who receives the tier-impact report mail sent by the scheduled tier-report job (once every 24 hours by default) -- which admins hold which tier 0/1 access.

Which situations send an alert. Run failure: a scheduled run failed or a safety breaker held it (re-mailed at most daily). Drift: the tenant differs from the desired state (default every two weeks). Expiring access: a...

An HTTPS address -- a Microsoft Teams incoming webhook or any endpoint that accepts JSON -- that receives each alert in addition to email. It works even when no mail sending is set up and is not affected by the email...

The shape of what is posted to the outbound webhook. Microsoft Teams posts a message card with a colour by severity, the alert facts and an Open PIM Manager button. Generic JSON posts a flat object with event, title,...

Whether PIM Manager mails your SuperAdmins when something waits on them: open required Get Started steps, policy change sets held by the circuit breaker, approval and access requests, guard holds and releases, a break...

Builds the full management report (key figures and trends, risk and exceptions, changes and audit, compliance evidence) for the last full month, once a month, keeps it for download under Reports > Management report an...

The mail addresses that receive the monthly management report as an attachment. One address per line; each must be a valid mail address and duplicates are dropped.

How many days PIM Manager keeps its daily configuration backups (departments, external companies, admins, group definitions, delegations, workload bindings and settings -- never secrets). Any whole number from 1 to 3650.

How long the audit trail keeps its rows. 0 keeps every row forever. Any other value must be 13 to 1200 months. Audit rows can never be edited, and the database itself refuses any delete that does not come from the ret...

How many days before a time-bound assignment ends the engine renews it (1 to 90). It applies to every expiring delegation PIM manages: group memberships of admins, nested groups, Entra role, administrative-unit and Az...

What a blank AutoExtend cell on a delegation row means. Who decides an extension, first match wins: an access review outcome (Keep extends, Remove does not), then an owner's Deny of that exact end date, then the row's...

The validation checks the sign-in methods registered on each admin account. An admin with none of the methods in this list is reported, and so is an admin who has only weak methods (text message, voice call, e-mail)....

For an admin account that asks for a Temporary Access Pass with a start time in the future, the engine waits until the start time is near before it issues and mails the pass. This is how many hours before the start ti...

Decides whether the engine issues a Temporary Access Pass once per admin account, or keeps issuing a new one whenever the previous pass has run out and the admin has still not completed their first sign-in.

An admin row can ask for the mail sent to the admin account to be forwarded to the person's normal mailbox. This switch decides whether the engine sets that forwarding in Exchange Online when it creates or updates an...

When the discovery sweep finds resources it has not seen before -- a new subscription, management group, resource group, workspace or role -- it records each in the audit trail. With an address here it also sends one...

Switches the ServiceNow intake on: the scheduled intake job reads the requests your ServiceNow integration has dropped for PIM Manager and turns each into a proposal.

Per type of resource the discovery sweep can find -- an Azure subscription, a management group, a resource group, a Power BI workspace -- you choose what PIM Manager does with a new one: report it only, stage a group...

Whether a change must be committed by a different administrator than the one who staged it. Off: anyone may commit what they staged. Sensitive: changes classed as sensitive (a privileged role or scope added to a group...

Whether releasing a safety guard needs a second SuperAdmin. A release lets one held engine plan through for one run or until a time (at most 24 hours) -- for example more removals than the per-run removal budget, or m...

How many rows of one list a single commit may take out before a SuperAdmin has to approve it. It is a count: there is no share of the list in the rule, so taking 2 rows out of a list of 3 does not ask, and taking 26 r...

How many removals one engine run may apply in one scope without an approval. When a run would remove more, it removes none of them in that scope and holds the list. This ONE number bounds seven things: removals a row...

How many admin accounts one engine run may disable. It is a count of accounts: the share of the scanned accounts plays no part. When a run would disable more, it disables none of them and holds the list. The number bo...

How many assignments one bulk revoke may take away before it needs more than a click. A batch larger than this must be confirmed by typing its exact count, and it needs an approved request on the Approvals page. Both...

How many admin accounts one engine run may delete. An account is deleted only when its row says Deleted, which was approved before it was stored. When more accounts are waiting, the rest are deleted by the next run.

The emergency accounts PIM must never lock out, by sign-in name (UPN) or object id. Both PIM Manager and the engine read this one list. A change is not applied directly: it becomes a request that a different SuperAdmi...

The scripts and services that may use the PIM Manager API with their own application identity, each with the role it gets: Reader or Admin. Part of PIM Manager Pro. A change is not applied directly: it becomes a reque...

The group that gets the PIM Activator browser extension deployed, one for PROD and one for TEST, picked from your directory, plus an optional list of extra tenants for the extension's catalog. It is about deployment o...

The policy template that gives the PIM Manager recommendation for the PIM for Groups policy of every group PIM Manager manages whose definition leaves the policy template blank. A template recommends how long an activ...

The policy template that gives the PIM Manager recommendation for the Entra ID role policy of every role your delegations assign (to groups, in administrative units, or directly) when the row leaves the policy templat...

The policy template that gives the PIM Manager recommendation for the PIM policy of each Azure role and scope pair your Azure delegations assign when the row leaves the policy template blank. If two rows name the same...

Who may do what in PIM Manager: each sign-in name is mapped to Reader (view only), Delegated (view only, limited to the groups they own), Admin (stage, commit and revoke) or SuperAdmin (everything, including settings,...