# Policy to only allow user to configure service settings

**URL:** <https://community.dynatrace.com/t/policy-to-only-allow-user-to-configure-service-settings/49178>\
**Category:** Open Q&A\
**Tags:** user-management, services, settings\
**Created:** [December 3, 2024, 4:45pm UTC](https://community.dynatrace.com/t/policy-to-only-allow-user-to-configure-service-settings/49178 "2024-12-03T16:45:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chen](https://avatars.discourse-cdn.com/v4/letter/c/3d9bf3/32.png) [@Chen](https://community.dynatrace.com/u/Chen)\
**Post date:** [December 3, 2024, 4:45pm UTC](https://community.dynatrace.com/t/policy-to-only-allow-user-to-configure-service-settings/49178/1 "2024-12-03T16:45:44Z")

</div>

I want to allow the users to modify settings (such as anomaly configuration) on a single service/entity level, without granting them the global settings on environment or cluster level for all services as global configuration.

I first tried the following:

```markup
ALLOW settings:objects:read, settings:objects:write
WHERE settings:scope startsWith 'SERVICE-';

```

The above policy statement does not seem to work as they do not see the setting option on the service/entity.

Then I tried the following:

```markup
ALLOW settings:objects:read, settings:objects:write
WHERE settings:schemaId = "builtin:anomaly-detection.services”;

```

The above policy statement does work on the service/entity level, but at the same time they also see the global environment settings option which I do not want.

How can I have a policy statement that allow the user to only modify the settings on service and entity level, but not globally? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![RohitBisht](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/rohitbisht/32/38577_2.png) [@RohitBisht](https://community.dynatrace.com/u/RohitBisht)\
**Post date:** [December 5, 2024, 1:21am UTC](https://community.dynatrace.com/t/policy-to-only-allow-user-to-configure-service-settings/49178/2 "2024-12-05T01:21:55Z")

</div>

Hi, for this you may have to append management zone with this. Please try

> **[IAM policy reference](https://docs.dynatrace.com/docs/manage/identity-access-management/permission-management/manage-user-permissions-policies/advanced/iam-policystatements)**
>
> Complete reference of IAM policies and corresponding conditions across all Dynatrace services.

> **[Policy boundaries](https://docs.dynatrace.com/docs/manage/identity-access-management/permission-management/manage-user-permissions-policies/iam-policy-boundaries)**
>
> Restrict security policies with policy boundaries to provide tailored access to your users.

- environment:management-zone&nbsp;-&nbsp;The name of a management zone. This condition is applicable to either: any settings object that is allowed on the scope of an entity that can be matched into a management zone or settings objects of the schemas builtin:alerting.maintenance-window, builtin:alerting.profile, builtin:anomaly-detection.metric-events, builtin:monitoring.slo and builtin:problem.notifications.  
operators:&nbsp;IN&nbsp;,=&nbsp;,startsWith

---

<div class="post-metadata">

**Author:** ![Chen](https://avatars.discourse-cdn.com/v4/letter/c/3d9bf3/32.png) [@Chen](https://community.dynatrace.com/u/Chen)\
**Post date:** [December 9, 2024, 4:29pm UTC](https://community.dynatrace.com/t/policy-to-only-allow-user-to-configure-service-settings/49178/3 "2024-12-09T16:29:52Z")

</div>

Lovely, it worked perfectly after implementing the management-zone. Thanks a lot!