Who can assign the SystemAdmin role
This article explains who is allowed to grant or revoke the SystemAdmin role in MobilityManager, and why the platform enforces this rule so strictly. Understanding it prevents both accidental lockouts and unintended privilege escalation.
The rule in one sentence
Only an existing SystemAdmin can assign the SystemAdmin role to someone else, and only a SystemAdmin can remove it. No other permission grants this ability.
Note: Holdingusers:manageorroles:assignis enough to hand out ordinary roles such as FleetManager or Driver, but it is not enough to hand out SystemAdmin. That last step is gated on already being a SystemAdmin.
Why the restriction exists
Custom roles apply across the whole platform, and SystemAdmin holds every permission in every tenant. Without this guard, a tenant administrator who merely holds users:manage for their own tenant could promote themselves or a colleague to SystemAdmin and gain control of every other tenant. The platform therefore treats SystemAdmin as a special case that only the existing SystemAdmin circle can extend.
Where the rule is enforced
The check is applied on every path that could grant SystemAdmin, so there is no back door:
- When creating a user with a role attached — a non-SystemAdmin cannot attach the SystemAdmin role during account creation.
- When assigning a role to an existing user through user administration.
- When assigning a role through the roles area.
- When removing the SystemAdmin role — only a SystemAdmin can revoke it.
If a non-SystemAdmin attempts any of these, the request is refused with an access-denied response.
Related protections
Two further rules reinforce this boundary:
| Protection | Effect |
|---|---|
| Non-SystemAdmins cannot act on a SystemAdmin account | They cannot edit, deactivate, or reset the password of a SystemAdmin. |
| Cross-tenant reach is SystemAdmin-only | A tenant administrator manages only their own tenants, never all of them. |
Practical guidance
- Keep at least two SystemAdmin accounts so the loss of one does not leave you unable to grant the role again.
- Grant SystemAdmin only to trusted platform operators; use a custom role for narrower administrators.
- If you need a new SystemAdmin and have none available, you will need an existing SystemAdmin (or your platform provider) to make the assignment.
Warning: If every SystemAdmin account is lost or deactivated, no remaining user can recreate one through the normal interface. Protect these accounts accordingly.
Related
- The SystemAdmin role and what it can do
- Assign and remove user roles
- Create a custom role
- Troubleshooting "Access Denied" errors
