Hello Cameron,
Thank you for your response. I will create a custom Admin role without the Directory > Organization > Admin permission and swap it for everyone that must not change the org settings. Together with a ABAC that prevents adding this role for everyone except selected Master Admins that should make the whole thing robust.
Thanks for the additional notes about auditing the admin privileges, too.
------------------------------
Christoph Domaschke
Produktmanager Kunden-Dialog-Center
------------------------------
Original Message:
Sent: 01-09-2026 08:32
From: Cameron Tomlin
Subject: prevent ABAC (Attribute Based Access Control) from beeing turned off
Hello Christoph,
I have a few recommendations/ideas to help protect your ABAC implementation. First you will need to strictly limit who has admin access to your org settings. Second I would recommend a regularly audit on who has admin privileges. I would recommend implementing change management process that require approval for any modifications to the Org settings.
I also want to remind you that you can use the audit logs to monitor any changes to ABAC settings.
Hope this helps!
------------------------------
Cameron
Online Community Manager/Moderator
Original Message:
Sent: 01-09-2026 08:20
From: Christoph Domaschke
Subject: prevent ABAC (Attribute Based Access Control) from beeing turned off
Hi Community,
I try to dig deeper into Attribute Based Access Control. I sucessfully created some Policies and they are working fine. But my problem is: All this new security is collapsing like a card house, if the wrong person is turning off the "Enable Attribute Based Access Control" in Organization Settings.
Is there a way to prevent that with ABAC? Or do I miss something essential?
Best regards
Christoph
#Security
------------------------------
Christoph Domaschke
Produktmanager Kunden-Dialog-Center
------------------------------