Identity and access management FAQ for NetApp Console
Suggest changes
PDFs
This FAQ answers common questions about identity and access management (IAM) in the NetApp Console. It focuses on role-based access control concepts, hierarchy behavior, and member management that are useful when planning and implementing access for your organization.
Getting started
When you sign up, the Console creates an organization with one Organization admin and one default project. From there, the recommended setup steps are:
-
Edit the default project or create additional projects and folders to match your business hierarchy.
-
Add members to your organization.
-
Add or discover resources.
-
Associate resources with additional projects as needed.
Resource hierarchy: organizations, folders, and projects
Folders group related projects for organizational structure and role delegation. Projects contain resources and are where members access those resources. Resources cannot be directly associated with folders — they must be associated with projects. Assigning a role at the folder level gives that member inherited access to all child projects and folders.
No. Folders are only visible to members who have IAM permissions: Organization admin, Folder or project admin, or Super admin. Regular members access projects directly and do not see folders.
No. Resources must be associated with projects, not folders. However, an Organization admin can associate a resource with a folder so that a Folder or project admin can then link it to the appropriate projects within that folder.
You can create up to seven levels of folders and projects in your organization's resource structure.
Resources that can be associated with projects include:
-
Storage systems
-
Keystone subscriptions
-
Some Backup and Recovery workloads
-
Console agents
Roles and permissions
An Organization admin has unrestricted access to all projects and folders across the entire organization and is the only role that can create Console agents. A Folder or project admin can only manage the specific folders and projects they are assigned and cannot create Console agents.
Only users with the Organization admin role can create Console agents. Folder or project admins cannot create Console agents.
Assign the Operation support analyst role, which provides access to alerts and monitoring tools and the ability to enter and manage support cases.
No. You cannot change member access at a lower level if it was inherited from a higher level. To modify the access, you must change the member's permission at the higher hierarchy level (folder or organization) where it was originally assigned.
Managing members and access
The user must have already signed up for the NetApp Console before you can add them to your organization, folder, or project. This requirement applies even to users who are members of a federated group.
No. Even when a federated group is assigned a role, individual users must meet two requirements before they can access resources:
-
The user must have already signed up for the NetApp Console.
-
The user must be explicitly assigned a role in the Console.
NetApp recommends assigning a minimum access role such as Organization viewer to these users.
Console agents
Console agents are initially tied to the project where they are created. After creation, admins can add agents to other projects or associate them with a folder from the Agents page.