Getting Started › Role-Based Entitlements

Role-Based Entitlements

You assign privileges to users by assigning roles. A role contains tasks that correspond to application functions in CA Identity Manager, such as the Create User task, functions in an application, such a Create Purchase Order function or account templates that give the user accounts, such as an SAP account. When users are assigned a role, they receive the corresponding privileges.

CA Identity Manager provides the following types of roles:

• User management roles, which are called admin roles.

  Admin roles can also include any task that appears in the User Console.

• Account assignment roles, which are called provisioning roles
• Application function roles, which are called access roles.

If you remove a task or account template from a role, the user can no longer perform that task, use an endpoint account, or use an application function.