Rights can be combined or used independently of each other to create role definitions. Role definitions describe job functions that require a specific set of rights, including the specific days and times the role should be available for performing the operations allowed. If you have created desktop, application, or network access rights, you must create at least one role definition to use these rights.
To create a new role definition for a job function, you need to do the following:
- Create a new role and specify when the role is available.
- Specify how users in the role are allowed to log on.
- Add specialized Windows access rights to the role, as applicable.
- Specify whether the role requires multi-factor authentication before it can be selected.
In most cases, creating a separate role definition for each access right gives you the most granular control over what users assigned to a role can do. For example, if you create separate role definitions for desktop, application, and network access rights, you can choose which apply to specific users and groups through role assignments.