MCP Catalog admin not allowing user to edit the MCP Policy

[vicky_jaiswal]

we are using the default MCP admin Catalog Permission set with allow access to edit the MCP Policies. but it seems users are not able to edit the MCP Policy even though it is allowed for them

[cdinet]

Any non-global admin user cannot edit a policy created by someone else.  They can only duplicate it and assign their own user owned policies.  

[vicky_jaiswal]

seems i got the solution in below KB article and thanks for you reply. but we should have some option which will allow MCP Policy complete access to users base on permission set configuration.

A user is unable to edit a policy with the appropriate permission sets assigned (mcafee.com)

[cdinet]

Thanks, I forgot about that kb.  As the kb states, that is expected behavior simply because of access control not allowing non-admins to modify something belonging to an administrator.  So by making the user an administrator also of that policy, that should then give them the needed rights.  

[cdinet]

The same thing will apply to client tasks and other objects, such as queries, etc.

[vicky_jaiswal]

is there any chance to get the same permission to be configured in MCP Catalog admin permission set by default in future release of ePO/MCP versions as that will be easy to manage users/AD group putting in the permission set instead of adding each user in each MCP policies.

[cdinet]

You can certainly submit a feature modification request per KB60021.  That may have already been submitted, but more requests for it add weight to the request.

[vicky_jaiswal]

Thanks but it seems the option to change or provide Policy ownership is only available if we have MCP 4.0 beta. with lower version of MCP extension, this option is not working 

[cdinet]

That isn't necessarily true.  I am running mcp 3.2, have a test user only assigned to the mcp default permission set and was able (as an admin) add that test user as a policy owner.  You can't add or remove any global admins because they are always owners of all policies, but you can add non-global admins as long as they have proper permission set.

[vicky_jaiswal]

in Our case, we are using MCP 3.1.0 and i tried adding test user which does not have any permission to edit and modify the any policy in ePO.  after making this user MCP Policy Owner, he still not able to edit and modify MCP Policy. what else we are missing in this case due to which user even after making Policy owner not able to modify it.