Creating a folder

To create a folder:

1. Go to Secrets > Personal/Public Folder and select Open Tree.
2. In the Open window, select where you intend to create a folder.

   You can create a folder in an existing folder or select Folder from the Create dropdown in Root to create a root folder.

3. Click Open.
4. From the Create dropdown, select Folder.

   The New Secret Folder window opens.

   

5. Enter the following information:

   General
   Name	Name of the folder.
   Parent Folder	From the dropdown, select a parent folder or select Create to create a new parent folder. The parent folder is set in step 2. The parent folder cannot be changed for a root folder. Use the search bar to look for a folder. Use the pen icon next to the folder to edit it.
   Inherit Policy	Enable to inherit policy that applies to the parent folder. The option is enabled by default when creating a subfolder. You cannot inherit policy for a root folder.
   Secret Policy	From the dropdown, select a policy that applies to the folder or select Create to create a new policy. See Creating a policy. Use the search bar to look for a policy. Use the pen icon next to the policy to edit it. This option is only available when Inherit Policy is disabled.
   Permission Use the settings in the pane to control access to the folder.
   ZTNA
   Inherit ZTNA Control	Enable to inherit ZTNA control access permission from the parent folder. When configuring a subfolder, FortiPAM displays the ZTNA control settings from the parent folder. By default, secrets in a folder follow the ZTNA control set up in the parent folder. However, when creating or editing a secret you can customize the ZTNA control in the Secret Permission tab. See Creating a secret. The option is enabled by default when creating a subfolder. You cannot inherit ZTNA control access permission for a root folder.
   ZTNA Control	Enable to limit access by ztna-ems-tag. You can choose whether to match all the tags or only one of them. The option is only available when Inherit ZTNA Control is disabled.
   Device Tags	Select + to add ZTNA tags or groups. Use the search bar to look up a ZTNA tag or ZTNA tag group. Only permitted devices with the selected tags are allowed to launch.
   Device Match Logic	Define the match logic for the device tags: OR: Devices with any of the selected tags are allowed to launch. AND: Devices must acquire all the selected tags to launch.
   Inherit Permission	Enable to inherit permission from the parent folder. The option is enabled by default when creating a subfolder. You cannot inherit permission for a root folder. Note: The setting can only be disabled if you have the Owner permission. Also, the setting cannot be disabled for any subfolder of the personal folder, i.e., the folder generated for every user.
   Permission The level of user/user group access to the folder and secrets in the folder. See User Permission and Group Permission.

6. Click Submit.

User Permission

To create a user permission:

1. In step 4 when Creating a folder, select the user from the User/Group dropdown in the Permission pane.

   To add a new user: Select + and then select +User List. The New User List wizard opens. Follow the steps in Creating a user, starting step 2 to create a new user.

   Use the search bar to look up a user.

   Use the pen icon next to the user to edit it.

2. In the Folder Permission dropdown, select from the following:

   • View: Ability to view secrets and subfolders in the folder.

   • Add Secret: Ability to create new secrets.

   • Edit: Ability to create/edit secrets, subfolders, and the folder itself.

   • Owner: The highest possible permission level with the ability to create, edit, delete, and move secrets, subfolders, and the folder itself.

3. In the Secret Permission dropdown, select from the following:

   • View: Ability to view secret details and launch a secret.

   • Edit: Ability to create/edit secrets and launch the secrets.

   • Owner: The highest possible permission level with the ability to create, edit, delete, move, and launch secrets.

4. In Allowed Service, from the Select Entries list, select the services, click Close.

   Use the search bar to look up a service.

5. Click Submit.

From the list, click x next to a user permission entry to delete it.

Group Permission

To create group permission:

1. In step 4 when Creating a folder, select the user group from the User/Group dropdown.

   To add a new user group: Select + and then select +User Group. The Create New User Group window opens. Follow the steps in Creating user groups, starting step 3.

   Use the search bar to look up a user.

   Use the pen icon next to a user to edit it.

2. In the Folder Permission dropdown, select from the following:

   • View: Ability to view secrets and subfolders in the folder.

   • Add Secret: Ability to create new secrets.

   • Edit: Ability to create/edit secrets, subfolders, and the folder itself.

   • Owner: The highest possible permission level with the ability to create, edit, delete, and move secrets, subfolders, and the folder itself.

3. In the Secret Permission dropdown, select from the following:

   • View: Ability to view secret details and launch a secret.

   • Edit: Ability to create/edit secrets and launch the secrets.

   • Owner: The highest possible permission level with the ability to create, edit, delete, move, and launch secrets.

4. In Allowed Service, from the Select Entries list, select the services, click Close.

   Use the search bar to look up a service.

5. Click Submit.

From the list, click x next to a group permission entry to delete it.