--- title: Configure role lifecycle management description: Configure role LCM to delegate role management to end users with governance controls component: pingoneaic page_id: pingoneaic:identity-governance:administration/lcm-role canonical_url: https://docs.pingidentity.com/pingoneaic/identity-governance/administration/lcm-role.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: personas: Personas activate_role_lcm: Activate role LCM create_a_scope_to_define_which_roles_a_delegated_end_user_can_manage: Create a scope to define which roles a delegated end user can manage role_scope_permissions: Role scope permissions create_a_scope_for_role_lcm: Create a scope for role LCM create_an_internal_role_that_grants_the_delegated_end_user_capability: Create an internal role that grants the delegated end user capability assign_end_users_to_the_internal_role: Assign end users to the internal role test_role_lcm: Test role LCM --- # Configure role lifecycle management Role lifecycle management (role LCM) lets authorized end users create, update, delete, and view role information. It also enforces policies by requiring approval workflows before the system applies any role changes. This prevents users from granting excessive permissions without oversight and ensures access remains aligned with organizational policies. As a tenant administrator or governance administrator, you must configure and enable role lifecycle management (role LCM) before delegated end users can manage roles. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | * Role LCM doesn't support custom forms. You must use the default forms provided with the feature. * Role LCM automatically seeds request types and workflows for create role, modify role, and delete role. | ## Personas Role LCM involves the following personas: **Role LCM personas** | Persona | Description | | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Administrator | A tenant administrator or an internal administrator, such as a configured OAuth 2.0 client. | | Role owner | A user listed as the owner of a role in Advanced Identity Cloud. | | End user | An end user that's an application owner or an entitlement owner. They might also receive permissions directly from Identity Governance scopes or have no additional role-related permissions. | ## Activate role LCM Administrators must enable role LCM to activate the feature in the hosted account pages. 1. In the Advanced Identity Cloud admin console, go to Governance > Requests, and click the Settings tab. 2. In the Governance LCM section, click Ellipsis ([icon: more_horiz, set=material, size=inline]), and then click Settings. 3. In the Governance LCM modal, read the note stating that this feature adds request and approval flows for selected identity profiles and removes direct create, update, and delete capabilities, and then click Next. , and click Next. \+ image::governance-lcm-modal-about.png\[alt="Screen capture of the Governance LCM modal showing introductory information about the feature with a Next button to proceed.", role="border", width="600"] 1. In the Governance LCM modal, click Role LCM, and then click Activate. ![Screen capture of the Governance LCM modal with Role LCM option displayed and an Activate button to enable the feature.](../_images/governance-lcm-modal-roles.png) The role LCM feature is now enabled. ## Create a scope to define which roles a delegated end user can manage Create one or more scopes to define who can manage roles and what data they can access. Scopes let you control visibility and permissions for roles, role members, and assigned entitlements so you can delegate role management to the right administrators. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | | To use role LCM, a delegated end user must both match a role-management scope **and** be assigned an internal role that grants access to the Roles object. | ### Role scope permissions Scopes control what roles a user can see and manage. They define boundaries for role lifecycle operations based on role attributes, such as which applications or entitlements the role includes. When you assign a scope to a user, that scope determines whether they can view, create, modify, or delete specific roles. By default, administrators, role owners, and end users have the following scope permissions: | Action | Admin | Role owner | End user | | ----------- | ------------------------ | ------------------------ | --------- | | View role | [icon: check, set=fa]Yes | [icon: check, set=fa]Yes | If scoped | | Create role | [icon: check, set=fa]Yes | If scoped | If scoped | | Modify role | [icon: check, set=fa]Yes | If scoped | If scoped | | Delete role | [icon: check, set=fa]Yes | If scoped | If scoped | Example: Combined role owner and end user permissions Sarah owns the Marketing role. As an end user, she also has a scope that lets her manage roles that match a filter for CRM entitlements. Together, these permissions let Sarah: * View and edit the Marketing role through role ownership. * View and edit any role that matches the CRM-entitlement filter through her end-user scope. * Create roles that match the CRM-entitlement filter through her end-user scope. * Delete roles that match the CRM-entitlement filter through her end-user scope. Because Sarah is the Marketing role owner and also has a scope that applies to roles matching the CRM-entitlement filter, she can still edit the Marketing role after it includes CRM entitlements. ### Create a scope for role LCM 1. Sign on to the Advanced Identity Cloud admin console as a tenant administrator. 2. Go to Governance > Scopes, and click [icon: add, set=material, size=inline] New Scopes. 3. On the New Scope page, enter the following on the Details page: 1. Name: Enter a descriptive name for the scope. The name should be descriptive enough to easily identify the purpose of the scope. For example, enter Scope for role LCM for contractors if you want to assign an employee to manage roles for contractors. 2. Description: Enter a description for the scope. For example, enter `This internal scope allows managing roles for contractors`. 3. Click Next. ![The New Scope page showing the Details tab with Name field containing 'Role LCM scope for contractors', Description field with explanatory text, and a Next button at the bottom.](../_images/governance-role-lcm-scope-details.png) 4. On the Applies to page, define which users should be subject to this scope. 1. Select if the All or Any condition must be met. 2. Select a property for this scoping rule. For example, select description. 3. Select an operator for the scoping rule. For example, select contains. 4. Enter a condition. For example, enter Default Approvers. 5. If you want to add another rule, click [icon: add, set=material, size=inline] and repeat the steps. 6. Click Next. ![The New Scope page showing the Applies to tab with condition builder containing All/Any selector, property list set to 'description', operator list set to 'contains', and value field with 'Default Approvers', plus a Next button.](../_images/governance-role-lcm-scope-appliesto.png) 5. On the Access page, click Roles. 1. Select the All Roles or Roles matching a filter if this scope applies to all configured roles, or select Roles matching a filter to define the conditions under which this scope applies. 2. If you selected Roles matching a filter, select if All or Any conditions must be met. 1. Select a property for this scoping rule. 2. Select an operator for the scoping rule. 3. Enter a condition. 4. If you want to add another rule, click [icon: add, set=material, size=inline] and repeat the steps. 3. Select the permissions available to the scope: * Create Roles: Permission to create a new role. * Modify Role: Permission to modify a role. * Publish Roles: Permission to publish a role. * Delete Role: Permission to delete a role. 4. Click Save. ![The New Scope page showing the Access tab with Roles selected and four permission checkboxes: Create Roles, Modify Role, Publish Roles, and Delete Role, plus a Save button.](../_images/governance-role-lcm-scope-access.png) ## Create an internal role that grants the delegated end user capability Administrators must create an internal role, so that authorized end users can view the Roles object. 1. Sign on to the Advanced Identity Cloud admin console as a tenant administrator. 2. Go to Identities > Manage. 3. Click Internal Roles > [icon: add, set=material, size=inline] New Internal Role. 4. In the New Internal Role modal, enter the following and click Next. * Name: Enter a name for the internal role, such as Role LCM. * Description: Enter a description for the internal role. ![Screen capture of the New Internal Role modal with Name field containing 'Role LCM' and Description field for entering role description, and a Next button.](../_images/governance-role-lcm-internal-role-new.png) 5. In the Internal role Permissions modal, select Alpha realm - Roles, and click [icon: add, set=material, size=inline] Add. ![Screen capture of the Internal role Permissions modal showing a selectable list with 'Alpha realm - Roles' option and an Add button.](../_images/governance-role-lcm-internal-role-permissions.png) 6. Select the internal role permissions you want available with the role: * View: Allows viewing role information. * Create: Allows creating new roles. * Update: Allows updating existing roles. * Delete: Allows deleting roles. ![Screen capture of permission configuration showing four checkboxes: View for viewing role information, Create for creating new roles, Update for updating existing roles, and Delete for deleting roles.](../_images/governance-role-lcm-internal-role-permissions-add.png) 7. Click Show advanced. Click set all attributes and select Read/Write for the attribute permissions. * Name * Description * Members * assignments * applications * condition * temporalConstraints | | | | - | ---------------------------------------------------------------------------------------------------------------------------------- | | | Click Administer only a subset of Alpha realm - Roles by applying a filter to access a subset of roles based on specific criteria. | 8. Click Next. 9. In the Dynamic Internal role Assignment modal, click A conditional filter for this role if you want to set a conditional role assignment. Otherwise, click Next. ![Screen capture of the Dynamic Internal role Assignment modal with option to select 'A conditional filter for this role' and Next button to continue or skip.](../_images/governance-role-lcm-internal-role-assignment.png) 10. In the Time Constraint modal, click Set a start and end date during which this role will be active if you want to assign the role on a temporary basis. Otherwise, click Save to finish creating the internal role. ![Screen capture of the Time Constraint modal with option to 'Set a start and end date during which this role will be active', with Save button to complete or continue without time constraint.](../_images/governance-role-lcm-internal-role-time-constraint.png) ## Assign end users to the internal role Associate the scope to the assigned end users to limit their authority to the intended roles. 1. On the Role LCM page, click [icon: add, set=material, size=inline] Add Members. 2. In the Add Members modal, select the users to which the internal role applies, and then click Save. ![Screen capture of the Add Members modal showing a list of users with checkboxes for selection and a Save button to add selected users to the role.](../_images/governance-role-lcm-internal-role-add-members.png) ## Test role LCM After you enable role LCM, test the feature to ensure it's working as expected before delegating role management to end users. 1. Sign on as a test user that's a role LCM administrator. 2. Go to Administer > Roles. 3. Click [icon: add, set=material, size=inline] New Role. 4. In the New role modal, fill out the form for the new role, and then click Save. 5. Click View request to see the details of the change request you just submitted, and ensure the workflow is correct. 6. Sign on to the Advanced Identity Cloud admin console as a tenant administrator. 7. Go to Governance > Requests. 8. Click the change request you just submitted, and ensure the request details are correct. 9. Approve or reject the request, and ensure the request status updates accordingly.