I am running ePO 4. I have 10 OUs under My Organization and have created 10 separate On Access Default Policies and assigned one to each OU, each has different exclusions. I then created 10 Permission Sets, one for each OU and created all required users and assigned them the needed Permission Sets to be admins for their OUs. When the users log in, they can view everything I allowed in each Permission Set but not modify anything. Under Virus Scan 8.5 I have "View and change settings" allowed but none of the users can make any changes to the group's On access Default Processes Policies. They can view what is set, but not Add, Edit, Clear etc.
When I created the Permission Sets, I duplicated the Group Admin set and then modified it to allow access to only 1 OU. What am I missing?