The Application Type Administrator feature gives tenant administrators control over who can add, manage, or view applications from the application catalog. By defining permission scopes, you can restrict an administrator to a single application type instead of the entire catalog.
For example, you can create a GCP Administrators group that can add, manage, and remove GCP application instances but cannot create or modify any other application type in the catalog.
For more information about creating and managing permissions and policies, see the following:
Create the following permissions and policy configurations:
Create an identity management-related permission so that end users can see a list of users to be configured in the policy:
Consumer: Identity Management
Resources: *
Action: identity.user.list
Create a permission for application administrators:
Consumer: Applications
Resources: You can select any of the already created applications or select All so that this applies to all applications. To configure permission scopes, the resource must be selected as All.
Action: Select the following actions:
apps.app.manage
apps.app.view
apps.app.list
Permission Scopes (Optional): You can select the application types that you want to configure. If this is not configured, the application administrator is allowed to configure and manage all application types.
Create a policy for the application administrator:
Members: Select the user who is the application administrator.
Permissions: Add all permissions that were created in earlier steps.
Click Save and Enable the policy.
Log in as the application administrator user.
Click System Admin → Tenant Applications.
If the permission scope is configured for any specific application type, the user can only create applications of that type.
If permission scopes are not configured, users can add custom applications as well.