topic Re: Permission Restriction for High-Impact Settings in Open Q&A

Permission Restriction for High-Impact Settings

eric_holloway — Wed, 06 Aug 2025 17:11:06 GMT

Hello,

We are a small Dynatrace team working within a large organization, focusing on a self-serve model where "Power Users" manage application monitoring. Recently, we've encountered challenges with unintended changes affecting the organization, such as broad Maintenance Windows affecting alerting and issues with accidental OPL deletion.

We are seeking advice on what settings and applications we should restrict to admin-only access for settings we haven't thought of yet. While we have already secured the above examples and provided guidance on protocols, we would appreciate insights on additional settings or applications that should be exclusively managed by our team.

Re: Permission Restriction for High-Impact Settings

DanielS — Wed, 06 Aug 2025 15:54:44 GMT

Hello @eric_holloway what you want is perfectly doable.

The way to do it through policies. I leave you the reference to start. https://docs.dynatrace.com/docs/shortlink/iam-policystatements and an overall guide https://docs.dynatrace.com/docs/shortlink/access-platform

Please let me know if I can be of further assistance.

Re: Permission Restriction for High-Impact Settings

DanielS — Wed, 06 Aug 2025 15:57:04 GMT

I also add this blog post where you have a longer explanation, have in mind that this is the first one on a series.

Re: Permission Restriction for High-Impact Settings

eric_holloway — Wed, 06 Aug 2025 17:09:40 GMT

Yeah, we are doing it through policies. My questions is "what settings can be high impact for an org and should be locked down to admins only?"

Re: Permission Restriction for High-Impact Settings

DanielS — Wed, 06 Aug 2025 23:05:09 GMT

Well, this is a broad answer and may vary from organization to organization, but I can share my dedicated policy for power users to use in conjunction with the ALLOW environment:roles:viewer; role:

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:synthetic.browser.name", "builtin:synthetic.browser.scheduling", "builtin:synthetic.http.name", "builtin:synthetic.http.scheduling", "builtin:synthetic.browser.assigned-applications", "builtin:synthetic.http.performance-thresholds", "builtin:synthetic.browser.kpms", "builtin:synthetic.http.assigned-applications", "builtin:synthetic.http.cookies", "builtin:synthetic.browser.performance-thresholds"); ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:failure-detection.service.http-parameters", "builtin:failure-detection.service.general-parameters", "builtin:anomaly-detection.metric-events", "builtin:davis.anomaly-detectors", "builtin:metric.metadata", "builtin:settings.calculated-service-metrics", "builtin:user-action-custom-metrics" , "builtin:custom-metrics" , "builtin:tags.auto-tagging", "builtin:tags.manual-tagging", "builtin:alerting.maintenance-window", "builtin:alerting.profile", "builtin:problem.notifications", "builtin:monitoring.slo"); ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:rum.mobile.name", "builtin:rum.mobile.key-performance-metrics", "builtin:rum.mobile.request-errors", "builtin:rum.source-mappings", "builtin:rum.web.name", "builtin:rum.web.request-errors", "builtin:rum.web.custom-errors"); ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:settings.mutedrequests", "builtin:settings.subscriptions.service");

Hope it helps! At least is not a blank sheet to work on....