Admin Roles restrict commit from Panorama

[MP18]

We have Panorama managing the firewalls.

certain admin role name we do not want them to do commit on the panorama and firewall.

so we want if user log into panorama and from there if he go to  firewall context or he directly log into firewall then

commit should be disabled.

I logged in to the panorma and under  panorama  admin roles i disabled the commit 

I did this by choosing the role as Panorama

For all other firewalls should i need to do same  by selecting role  device group and templates?

or also i need to do this under template for each firewall?

[gwesson · Accepted solution]

When you disabled commit for your role, did you disable commit in the Context Switch UI section?

That should be all you need to do. When they do a context switch, they're still logged into Panorama so you only need to worry about the Panorama user:

If that user has an account directly on the firewalls as well, you would need to modify their role on the firewall(s) also.

[MP18]

yes i did on Panorama and on context switch ui.

Will do on the firewalls also as they do have access to it