Admin User Permissions Not Inclusive of All Permissions

[mmevanson]

Hello Community,
Can anyone explain to me why the Admin User Permission isn't inclusive of every single permission needed to run the platform?  The frustrating one is that you can't even create storage buckets with the Admin User Permissions.  

The request is that we would have one all permissive policy that is updated *automatically* according to whatever changes or expands in the platform.  

Thanks,
Matt

[MaximilianoML]

Hello @mmevanson!

I believe the reason is that Admin User is not intended to be a true “god mode” permission set. It gives very broad administrative access, but Dynatrace still keeps some high-impact capabilities separate, especially when they can affect data storage, retention, or governance.

Bucket creation is a good example of that. Managing Grail buckets is more than just another admin action in the UI. It influences where data is stored and how it is retained, so Dynatrace treats it as a separate area that must be granted intentionally, instead of being included automatically in the Admin User policy.

From that perspective, the current model seems to be built around avoiding accidental over-permissioning. Someone may need to administer users, settings, or parts of the platform without necessarily being allowed to manage storage-level resources.

That said, I completely understand the frustration. The name “Admin User” naturally gives the impression that it should cover everything, so finding out that it does not include something as fundamental as creating a bucket feels unexpected.

I also think your request is reasonable. It would be helpful to have a separate, clearly named full-access administrator policy that Dynatrace maintains automatically as new permissions are introduced. To keep it safe, assigning that kind of “god mode” role could require an extra confirmation step, for example:

“This grants unrestricted access across the platform. Are you sure you want to assign it?”

That would keep the current safer Admin User model, while still giving customers a clear and deliberate way to grant truly complete administrative access when needed. I haven’t checked the Product Ideas section to see whether something similar has already been submitted, but it would definitely be worth taking a look there and adding your support if one already exists.

I hope it helps you 😄

[mmevanson]

Thanks for the explanation Max.  Yeah - I guess I am old school and think there should be a "god" credential offered.  There aren't too many products I've used over the past 30 years that require an admin user to add permissions.   Giving permissions at the data layer is great... for customers that need it.  But if you are a platform owner/admin, you will be providing those permissions and using it in your IAM policies.  But Admin out of the box should not. 

[MaximilianoML]

That’s funny because your 30 years of experience are more than I have of life, I’m 22. But I agree with your point: sometimes the “old school” way simply works better. There is always room for improvement, and sometimes that also means revisiting or even stepping back from certain decisions. Would you agree?

[mmevanson]

I agree with challenging the norm.  But a software vendor should not be limiting the admin role permissions just because they can or they think they should.   That is the customer's decision.