I can't revoke someone's permission here
The person carries a key in this tenant, but you can't revoke it on the Roles screen. The permission comes from a role given in a higher scope; that is where it is revoked.
What happened
On the tenant's Access screen you saw that a person carries a key. You can't find that assignment on the Roles screen, or when you try to revoke it, it says “This assignment is not in this tenant's own scope; it cannot be revoked here.”
Why it happens
A role given in the account or on the platform also works in the tenants below it. Such a permission was not given in this tenant; it only flows down here. Revoking it from the tenant would mean overturning a higher scope's decision from below.
What inlorus does
- On the tenant's Roles screen it shows and manages only the assignments given in this tenant's own scope.
- On the Access screen it marks a key that comes from above as “Inherited” and states which scope it comes from.
- It refuses to revoke another scope's assignment from here.
What you do
- On the tenant's Access screen, open the person and check which role and which scope the key comes from.
- If the permission comes from the account, ask the account admin to revoke the assignment; if it comes from the platform, ask the platform admin.
- The account admin revokes the assignment from the account's Roles screen.
How to keep it from happening again
- When giving a role at account level, keep in mind that the role will work in all of the account's tenants.