Okta Custom Role With Limited Permissions Can Modify Admin Email Notifications
Last Updated:
Overview
Custom administrators with limited permissions can modify most Okta administrator email notifications by design. Only Super Administrators and Organization Administrators can modify the Blind Carbon Copy (BCC) setting. Administrators observe that a custom role with limited permissions successfully modifies the administrator email notifications located in the account settings.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Custom Administrator Roles
Cause
This behavior is expected by design. The administrator email notifications available under Settings > Account are scoped to the individual administrator account and control only that account's notification preferences. Since custom administrator roles can be granted permissions to manage different resources, they are permitted to configure many of the notification options relevant to their own account.
The BCC setting is an exception because it affects organization-wide email behavior, so only Super Administrators and Organization Administrators can modify it.
Solution
Why can custom administrators modify email notifications?
Custom administrators can edit settings in the Admin email notifications section under Settings > Account by design. Okta restricts the Send all admin emails as BCC setting. Only a Super Administrator or an Organization Administrator can edit this specific setting.
