Device Group and Template admins in Panorama 5.0

[torm]

After upgrading Panorama to 5.0 I can't find the option to limit access for an administrator to a specific device groups or templates in the webgui. In 4.1, it was possible to configure this under "Administrators" in the device tab. This option seems to be missing in 5.0.(see attached screen shot)

In the CLI I am able to configure it, but I can't find the options in the webgui:

admin@panorama(primary-active)# edit mgt-config users tormtest

[edit mgt-config users tormtest]

admin@panorama(primary-active)# show

tormtest {

  permissions {

    role-based {

      custom {

        device-groups [ DG1 DG2];

        templates [ Template1 Template2 ];

        profile Admin-ReadOnly;

        devices {

          002XXXXXXXX;

        }

      }

    }

  }

  phash XXXXXX;

}

[edit mgt-config users tormtest]

[scantwell · Accepted solution]

I think I saw the same issue.  I needed to create a new Admin Role first (could not use the pre-existing ones from before the upgrade)

After I created that admin role (and made sure that it was Device Group restricted, then I could create my Admin account, or point my created admin account to my newly created admin role)

[torm]

Thanks, that was it! I created a new device group admin role, and now I get the option to select device groups and templates.