Admin user cannot manage a group granting admin when SIR is active - requires sn_si.admin<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue: Admin user cannot add or remove members from a group that grants the admin role - SIR is active Summary: A user with the admin role is unable to add or remove members from a group that grants the admin role. The change fails or returns a "not authorized" error, even though the user has full admin access. Symptoms Adding or removing a user from the group silently fails, orAn error appears indicating the user is not authorized to perform the actionThe behavior occurs even though the acting user holds the admin role Cause: When Security Incident Response (SIR) is active on an instance, the admin role automatically includes two Security Incident Response roles: sn_si.basic and sn_si.read. Any user with admin therefore inherits these roles as well. These two SIR roles belong to a managed application, which means the platform restricts who is allowed to assign them. They can only be granted by a user who holds the sn_si.admin role. Because adding someone to a group that grants admin also grants these SIR roles to that user, the platform requires the person making the change to hold sn_si.admin. The admin role does not include sn_si.admin. This is intentional, so that administration of Security Incident Response can be kept separate from general platform administration. As a result, an admin can end up holding the roles that trigger the restriction without holding the role that authorizes managing them — which is what blocks the group change. Resolution: Grant the sn_si.admin role to the user who needs to manage the group: Navigate to the affected user's record (User Administration > Users).In the Roles related list, add the sn_si.admin role.Save the record.Have the user retry adding or removing the group member — it should now succeed.