Delegated Administration
Assign routine workloads to boost management productivity and security
Role delegation boosts work efficiency, improves data security, and promotes team collaboration. With specific permissions for management tasks and NAS data, IT administrators ease their workloads, managers control their own data, and the organization gains productivity, clear responsibility, and data security.
Challenges
-
Heavy workloads
As organizations grow, the number of employees and devices will increase. If there is a limited IT staff managing the growing number of accounts and devices, this heavy workload will impact everyday tasks and may lead to inefficient workflows and frequent errors.
-
Improperly fully authorized
When employees require privileges for partial NAS functions/jobs, giving them more authority than required risks NAS security and data.
-
Poor responsiveness
When administrators are out-of-office or cannot handle tasks immediately, no other staff have proper authority to assist. This has the potential for disaster, especially for emergent cases.
Benefits of delegating roles
-
EFFCIENCY
Share administrative tasks with other staff to ease burdens and increase work efficiency.
-
SECURITY
Secure data by delegating pre-defined roles with limited authority for specific tasks only.
-
AGILITY
Ensure timely reaction for urgent conditions to maintain operational reliability.
-
8 types of delegated roles
-
System Management
Has the highest administrative capabilities under Administrator including all privileges of other delegated roles.
-
Backup Management
Manage and monitor backup jobs of the NAS.
-
Backup Operation
Execute backup jobs of specified shared folders.
-
User and Group Management
Create or delete local accounts for individual users and groups.
-
Shared Folder Management
Manage shared folders and grant access rights for users or groups.
-
Application Management
Install, update, and manage apps in the App Center.
-
Access Management
Manage overall accessibility of the NAS.
-
System Monitoring
Oversee NAS system and storage resource utilization.
A user can have multiple roles, and each role is not limited to one user. Up to 32 users and 32 groups can be assigned roles in the operation.
Practical use scenarios & examples
Role #1
- John
System Management
Scenario
Administrator Alice assigns System Management role to the senior IT officer John to act on her behalf while she is absent. Alice can determine access permissions to specific folders for the System Management role.
Permissions
-
Use the NAS Control Panel
-
Possess most administrative tasks under the administrator’s control
-
Has the privileges of all other delegated roles
Remarks
-
Has restrictions on SSH, telnet, and role delegation
-
Unable to open apps that are only accessible to administrators
Role #2
- Chris
Backup Management
Scenario
Sometimes the senior IT officer John has business trips, so he requests his fellow member Chris to take over the backup tasks during his absence. Chris is assigned the Backup Management role, so he can well maintain routine backup jobs as a non-administrator.
Permissions
-
Execute owned and the other’s backup jobs with Hyper Data Protector and Hybrid Backup Sync
-
Restore owned backup jobs
Remarks
-
Can not restore the other’s backup jobs
Role #3
- Alice
Backup Operation
Scenario
Administrator Alice manages every shared folder on the NAS, and delegates Backup Operation roles to a manager in each department: sales, marketing, HR, and R&D. Each departmental manager can easily manage backup of their own department folders and files, set backup frequency and destination based on their needs - without bothering IT staff.
Permissions
-
Create and execute backup jobs with Hyper Data Protector and Hybrid Backup Sync for the shared folders with access permissions
-
Restore data with the owned backup jobs
Remarks
-
Can only access folders with read/write permission as backup source and destination when processing backup jobs
Role #4
- Henry
User and Group Management
Scenario
The HR officer Henry is arranging new employee onboarding. Being delegated the User and Group Management role allows him to create user accounts and assign them to specific groups, effectively sharing the IT workloads and improving account management efficiency.
Permissions
-
Create, edit, and delete local users and groups
-
Edit properties of domain users and groups
-
Manage users and user groups in the Qmanager mobile app
Remarks
-
“Shared Folder Management” role is also necessary for efficiently managing user accounts and granting shared folder access permissions in a workflow
Role #5
- Emily
Shared Folder Management
Scenario
Marketing Department Manager Emily kicks off a new project, and she as a Shared Folder Management role creates a shared folder for this new project for streamlined collaboration. With the User and Group Management role, Emily can also grant or remove folder access permissions if a project member leaves or new members join.
Permissions
-
Create, edit, and delete shared folders
-
Create and edit shared folders in the Qmanager mobile app
Remarks
-
Unable to create a shared folder if the delegated user is not assigned the role "User and Group Management"
-
Unable to configure advanced permissions and folder aggregation
-
Unable to create a snapshot shared folder.
Role #6
- Zack
Application Management
Scenario
Administrator Alice assigns Application Management role to R&D department manager Zack so he can easily access the App Center and install necessary apps for development based on project needs. Zack downloads QuObjects to create object storage environment on the NAS for new app development and testing.
Permissions
-
Access the App Center on the NAS and install, update, and view apps using the Qmanager app
Remarks
-
Unable to manually install apps or configure settings in the App Center
-
Unable to open apps that are only accessible to administrators
-
Unable to access networking apps, such as Network and Virtual Switch
Role #7
- IT team members
Access Management
Scenario
To improve security control and react to security incidents more quickly, several IT team members are assigned the Access Management role. They are more aware of company IT policy to manage firewalls and security settings, and can work as a team to share workloads, especially improving troubleshooting efficiency in an emergency to prevent data breaches. They can receive security notifications in a timely manner and solve problems in the shortest time.
Permissions
-
Configure security settings in Control Panel
-
Use all features of QuFirewall
Remarks
-
Unable to access networking settings and the Network and Virtual Switch
Role #8
- third-party maintenance providers
System Monitoring
Scenario
Given the System Monitoring role, third-party maintenance providers, IT assistants or each department manager can regularly check the status of the department NAS system to ensure system performance and operation stability.
Permissions
-
View NAS system condition and information from Resource Monitor and Dashboard
-
Use the Resource Monitor in Qmanager
Remarks
-
Cannot modify any data or configuration of the NAS
Experience QTS 5.1.0
QNAP NAS supports delegated administration starting from QTS 5.1.0. Enjoy greater management efficiency that exceeds your expectations!
