ColeF.69651 (Customer) asked a question.
My question: Do Example 1 and Example 2 (seen below) grant the exact same permissions?
Specifically, does being added to groups “SuperDesk Group Admin via Admin Role” and “SuperDesk Group Membership Admin via Group” grant the same permissions?
Based on my testing, the answer is yes, but would appreciate being proven right (or wrong)!
Example 1: Custom Administrator Role with Resource Set, applied to Group with Resource Set
- Role name: SuperDesk Group Admin Role
- Permissions granted to Role: A) User > Edit user's group membership B) Group > Manage group membership
- Resource set: SuperDesk Resource Set Test (Resource set contains the following groups: SuperDesk Developer, SuperDesk User, SuperDesk View Only)
- Group the admin role is assigned to: SuperDesk Group Admin via Admin Role
- Resource set: SuperDesk Resource Set Test (same resource set as above: resource set contains the following groups: SuperDesk Developer, SuperDesk User, SuperDesk View Only)
Example 2: Standard Role Group Membership Administrator, applied to Group, with resources added
- Standard role used: Group Membership Administrator
- Group the admin role is assigned to: SuperDesk Group Membership Admin via Group
- Resources added to the standard role: Same groups as the resource set used in Example 1: SuperDesk Developer, SuperDesk User, SuperDesk View Only
-----------------
Purpose of this question / test: Example 2 is the method I’ve used for "Group Owner" settings. Using the GUI for this has worked well, for smaller numbers of groups in the resource set. For larger lists of groups, it becomes very difficult or impossible to manage. And as far as I can tell, it is not possible to configure or adjust Example 2 via API.
However, using the API to configure Example 1 is very straightforward. It is not a solution I would want to use often; setting up a new Admin role just for each "Group Owner" would be bad practice. But using it occasionally, when the resource set is larger than 30+ groups, I think it is a feasible solution.

Hello @ColeF.69651 (Customer) Thank you for reacting out to our Community!
Both examples seem to have the same same level of Admin role. You can also review the standard roles permissions here :
https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm#Group
As for the API assignment of Custom roles can be done, please see our API doc below:
https://developer.okta.com/docs/reference/api/roles/
Community members help others by clicking Like or Select as Best on responses. Try it today.
Ask Away: OIG Product Experts Answer Your Questions Thru Thur., Dec 14
Earn Today: New Okta Community Badges Have Arrived
Thanks for the information, Paul!