Disable creation of new Synthetic Monitor for specific users

[goodtimevisuals]

Our users need Full admin access, so given and now I am trying to restrict the users to create new Synthetic Monitors.

For that I created one Policy given below,
DENY settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:synthetic.browser.name","builtin:synthetic.browser.scheduling","builtin:synthetic.http.name","builtin:synthetic.synthetic-availability-settings","builtin:synthetic.synthetic-availability-settings","builtin:synthetic.browser.outage-handling","builtin:synthetic.http.scheduling","builtin:synthetic.browser.assigned-applications","builtin:synthetic.http.performance-thresholds","builtin:synthetic.browser.kpms","builtin:synthetic.http.assigned-applications","builtin:synthetic.http.outage-handling","builtin:synthetic.http.cookies","builtin:synthetic.browser.performance-thresholds");

After creation of Policy, I added the policy in new Group and added the same Group to specific users. Still they can able to create the Synthetic Monitor. Please provide the right solution.

[Peter_Youssef]

Hi @goodtimevisuals 

You have two options:

1. Through the UI, create a policy and bind this policy to a group, so you have to create the group and assign the users accordingly.
2. Through the configurations UI as well, you create create management zone permission as per the attached example and disable environment permissions.
3. Give the intended user group permission on MZ level not on Environment level.

KR,

peter.