MAS 9+: Create a Separate Permission Set for User Session Management and UI Updates in MAS SaaS

Problem Statement

In MAS 9.1, critical administrative features such as User Session Management and Updating User Interface are bundled under Suite Administration permissions, which include System Configuration. For MAS SaaS customers, IBM SRE cannot grant this access (under IDP Management access) because it exceeds the intended scope and introduces unnecessary elevated privileges. This prevents customers from using these features for operational and compliance purposes.

Proposed Solution

Create a separate permission set that includes the following:

User Session Management

• View active sessions

• Force user logouts

Updating User Interface

• Ability to update UI elements such as CSS customization

This permission set should exclude System Configuration and other unrelated administrative capabilities, allowing roles like MAXADMIN or nominated customer administrators to manage these tasks securely.

This permission set should also not impact existing other permission sets which currently allows users with sufficient permissions like MAXADMIN to manage users and view license consumption.

Business Value

• Security: Grants only necessary privileges, reducing risk of misconfiguration.

• Operational Efficiency: Enables customers to manage sessions, monitor license usage, and update UI without relying on IBM SRE.

• Compliance: Supports audit and governance by providing visibility into license consumption.

• Customer Satisfaction: Reduces friction and dependency on IBM support for routine administrative tasks.

Impact

Decoupling these permissions will:

• Improve usability for MAS SaaS customers

• Reduce support cases and escalation during critical events

• Align MAS SaaS with best practices for least-privilege access