New playbook roles

The introduction of new Playbook roles allows Tenant Admins to delegate responsibilities more precisely among their operators. There are now three roles to view and manage playbooks:

• Playbook Manager
• Playbook Admin
• Playbook Global Viewer

With the release of the new roles, any operator who previously had been given access to manage a Playbook will be assigned the “Playbook Manager” role. Tenant Admins can then enhance their capabilities by assigning them either the “Playbook Admin” or “Playbook Global Viewer” role.

How to assign the new Playbook roles

Tenant Admins can assign these roles easily. They simply need to select the desired role in the operator's “Personal info” tab under “Settings”. 

What can each Playbook role do?

Let's have a look at the differences between the new Playbook roles:

*This refers to the ability to select which policies to display in the widget, the order in which they appear, and how to represent the matched items - either as a numeric value or a percentage.

How permissions affect Playbook roles

Permissions significantly influence the capabilities of each operator within the app. Each new playbook role is subject to permissions, which can only be granted or revoked by a Tenant Admin. Let's examine the differences:

Tenant Admin

Playbook Admin

Playbook Manager and Playbook Global Viewer

Operators assigned the “Playbook Manager” or “Playbook Global Viewer” role will not be able to see any playbook under the “Playbook” section in the menu until a Tenant Admin grants them specific Playbook permissions. Moreover, they won't have access to the Playbook Policy Library under “Settings > Playbooks”.

For more information on delegation, please visit the “Delegate playbooks and policies” article.

Custom policy ownership restrictions

As mentioned above, both Tenant Admins and Playbook Admins can create custom policies. When a custom policy is created, the creator of the policy becomes the owner. Let's examine in more detail what this ownership entails:

1. Tenant Admin creates a custom policy

A Tenant Admin who creates a custom policy can:

•  Make it visible to all Playbook operators with the corresponding Playbook permissions within their own V-Tenant. To share the policy with operators, the “Set to public” toggle must also be enabled.
•  Allow Playbook Admins and Playbook Managers to execute this policy remediation against matched items in their own V-Tenant.
• Enable other Tenant Admins to edit the policy.

However, the following ownership restrictions will apply:

• Neither Playbook Admins nor Playbook Managers will have the ability to modify this policy.

2. Playbook Admin creates a custom policy

If a Playbook Admin creates a custom policy, they can:

• Make it accessible to all Playbook operators with the corresponding permissions within their own V-Tenant, if applied.
• Permit Playbook Admins, and Playbook Managers to execute this policy remediation against matched items in their own V-Tenant.

Tenant Admins will also be able to:

• View the policy 
• Execute the policy remediation
• Disable the custom policy
• Delete custom policy

However, the following ownership restrictions will apply:

• No Tenant Admin will be able to modify this custom policy.

Policy Box

The restrictions mentioned in this section will be reflected within the Policy Box: depending on the user's role and permissions, some actions will appear greyed out. 

In the example below, a Playbook Admin looking at a custom policy created by another admin is not able to edit or delete the policy. However, the “Run remediation” button is enabled. 

Created by

Within each Policy Box, the “Created by” section is visible to all operators who have permission to view the policy. Its purpose is to provide clear visibility regarding the policy's creator and help operators understand the associated permissions based on their roles.

When it comes to custom policies, the UserPrincipalName (UPN) of the policy creator will be displayed in this section. Out-of-the-Box policies are shown as created by CoreView. For custom policies created by CoreView partners, the text “MSP” will be displayed instead of the UPN of the creator.