Administrator access as a role

Question

When you edit a user in Sitecore, such as Sitecore\Admin, there's a checkbox to set the user as an Administrator. This checkbox is not available on roles. How do you set a group of users to the Administrator role? Do you have to assign the group to every possible Sitecore role?

Answer 1

Yes, "admin" is not a role and cannot be assigned to a role. You shouldn't do that either. If you need that many admin users, there might be something fishy with your security requirements.

You might want to check the overview of the Sitecore roles (https://doc.sitecore.net/sitecore_experience_platform/setting_up_and_maintaining/security_and_administration/users_roles_and_domains/the_security_roles) to see if you cannot meet the requirements by using those.

Answer 2

As @Gatogordo mentions, you likely shouldn't be using Administrator. This should be a checkbox you use on your 'emergency' account which you use to access things that nobody should access.

Inheriting default roles

It is very common to have a group of Sitecore System Administrators who need to be able to do things like set security on users, have access to all content and workflow states, and be able to make changes to templates or system settings via the user interface. There are a variety of roles that can be used for that, so it is best to define exactly the functions that the user needs and use the built-in roles to grant access. Create a custom role for your system administrators and then inherit from the roles you need.

Admin pages

In some scenarios, these system administrators also need access to things like the admin tools (like ShowConfig.aspx), which typically are only available to the 'admin' user. However, most of them also check for the 'Developer' role, so if your system administrators have the Developer role they can usually access these pages.

Custom roles

You may have requirements where there is no built-in role that supports your need. For example, you may have locked down your workflow to specific custom roles, so you'll need to grant your 'administrators' the correct roles to work on these workflow states, or grant access for your Sys Admin role to all states. Inheriting the roles can make security management easier, but if they are author roles that have explicit Deny permissions somewhere, this may not be what you want on a System Administrator. The Deny will trump any granted permissions.