<profile_name>

Enter the name of the profile.

comment "<comment_str>"

Enter a description or comment.

{archive_grp | cluster_grp | content_grp | dashboard_grp | domain_grp | encryption_grp | fortiview_grp | log_grp | monitor_grp | ms365_grp | others_grp | policy_grp | profile_grp | security_grp | system_grp}

Enter the name of the functional area that you want to grant permissions for. Functional areas correspond approximately to GUI navigation menus and REST API or CLI objects.

When permission {custom | none | read | read-update | read-write} is custom for a functional area, then its associated sub-areas also will become available so that you can customize their permissions. To view all currently available functional areas, enter:

edit ?

Multiple different functional areas sometimes have settings together in one CLI or REST API object (for example, config system global). The greatest permission granted will apply to all settings in the object. If you want a more strict access control that prevents that, then configure a network interface with allowaccess {ping http https snmp ssh telnet} that only allows HTTPS (GUI), and require restricted administrators to log in using that interface only. (Do not use each administrator's access {cli gui rest} to disable CLI and REST API access; they can change their own setting if they have read-write or read-update access to the System functional area.)

permission {custom | none | read | read-update | read-write}

Select which action to grant permission for each feature in the functional area, either:

• none — No permissions except for some basic commands that are always available, such as the ability for an administrator to change their own password.

• read — View only. get and show commands require read permission, except for some basic commands that are always available, such as get system status.

• read-update — View and change existing settings. Execute actions such as generating reports.

• read-write — View and change existing settings. Execute actions such as generating reports. Delete and create new tables(policies, profiles, etc.). config commands require update or write permission.

• custom — If there are sub-areas within the functional area, select this option to make them available in the list of functional areas so that individually select their permissions. For example, if you enter:

  config system accprofile

  edit profile_A

  config menuitem

  edit policy_grp

  set permission custom

  next

  then policy sub-areas such as recipient policies become available. You can set granular permissions for them, or further customize its sub-areas:

  edit rcpt_policy

  set permission custom

  next

  edit PolicyRecipientIncoming

  set permission read-update

  Within the most granular level of sub-area, the custom option is not available.

See details about FortiMail administrator permissions.

content-detail {enable | disable}

Enable or disable administrators with read privileges or better to be able to view email contents.

This setting is used only in the archive_grp functional area.

privilege-level {high | medium | low}

Select either:

• high

• medium

• low

See details about FortiMail administrator permissions.

high is not the greatest privilege level, and its administrators cannot view, change, or delete other accounts with the super_admin_prof administrator profile, which has the maximum privilege level.

system-diagnostics {enable | disable}

Enable or disable the permission to run system diagnose commands.