Go to Account Management > Identity & access management > Policy management.
Review the table of all existing policies that you can bind to user groups.
Name—the name of the policy
Description—a brief description of the policy
Source—global, account, or environment
Actions—view, edit, or delete that row's policy (actions available to you depend on your permission level)
Default policies
To let you use policies right away, Dynatrace IAM is shipped with built-in global policies.
On the Policies page, in the Source column, they're all set to Dynatrace
They're predefined and managed by Dynatrace
You can apply a built-in policy by assigning it to a group for the whole account or to any environment.
You can inspect them—select View policy in the Actions column—but you can't edit them
Create a policy
To create a policy
Go to Account Management > Identity & access management > Policy management.
Select Create policy.
Enter the following information.
Element
Description
Name
The name of the policy.
Description
A brief description of the policy.
Organization level
Each policy has a level that determines its scope:
global: These policies are predefined and managed by Dynatrace, and they apply to all accounts and environments. They cannot be edited.
account: These policies apply to all environments under that account (customer). Use them to set company-wide policies.
environment: These policies apply only to a single customer environment.
Organization levels are restricted in the UI to the account level (other levels are still available via API).
Restriction in UI was provided to avoid confusion between creating and binding.
Commonly creating multiple identical policies on the environment levels can be achieved in a more efficient way by defining one policy on the account level and binding it to environment levels.
Policy statement
A statement specifying exactly what this policy allows.
Example: Policy for Settings 2.0 Write
ALLOW settings:objects:read;
ALLOW settings:objects:write;
ALLOW settings:schemas:read;
You can combine multiple permissions in a single statement. Here is the same example combined into a single statement: