"Remove MFA" not possible for delegated "admins"
Hello,
I have a few users that are allowed to do user admin tasks (create user, delete user, reset MFA). Unfortunately the last thing - reset MFA - is no longer possible. But this is important if a full admin is not available and someone needs to re-enroll MFA.
They have "System permissions, Administration, Management, Users => Custom" which was enough in the past.
Brgds Andreas
Recommended Answer
Hi Deas,
As promised, here's the update from our development team.
On SQL Server workspaces this is the intended behaviour. Removing or resetting a user's MFA is reserved for administrators, and the "Users: Custom" system permission doesn't include it. It's not something that broke in a recent version. It's how these permissions are designed for SQL workspaces.
Right now there's no way to give that right to a non-admin user on a SQL workspace. For now, a full administrator has to remove the MFA in Administration > Users.
If you'd like delegated user admins to be able to do this, it would be worth posting it in the Feature Requests section of the forum. That way the product team sees it and other users can vote for it.
Thanks again for your patience and all the details you sent.
Best regards,
Eduard Sepulveda Lopez
All Comments (12)
Hi Deas,
Thanks for the screenshot, that looks like the Users list under Administration in RDM Windows.
Could you also share which workspace this is connected to (DVLS, SQL, or Cloud), along with the current versions of RDM Windows and that workspace?
One more thing that would help: a screenshot of where "Reset MFA" normally shows up, for example when you right-click a user, comparing a full admin account (where it works) with one of the custom-permission accounts (where it's missing). That will help us pin down exactly where it's disappearing.
Thanks again for your help with this.
Eduard Sepulveda Lopez
Hello,
we use an SQL datasource.
But I have no right-click user menu where I could reset it - it is only in the menu as shown on my screenshot. For a full admin the icon is not greyed out. That´s the only difference.
Brgds Andreas
Hi Deas,
Good to know, so the icon is there but greyed out just for the custom-permission users, while full admins see it active. That narrows things down nicely.
Could you share the exact RDM Windows version and the SQL Server (or DVLS) version behind it? And when you get a chance, a quick look at exactly which boxes are checked under System permissions – Administration – Management – Users for one of those accounts would help too, just to rule out something getting unchecked along the way.
Thanks for bearing with us on this.
Best regards,
Eduard Sepulveda Lopez