The access control entries (ACEs) specified for each customer organizational unit (OU) control the type of access to this organization that each group is granted. ACEs on all customer groups allow them to access their parent object - the reseller organization - but restrict access to the reseller organization. ACEs on the customer organization grant different permissions to different groups within the customer organization. The Remove Authenticated Users ACE is set on each customer OU to prevent all user accounts from reading the contents of the customer OU, unless they are explicitly granted this right.

The ACEs on the AllUsers@customer group grant List Object permissions for the customer OU to user objects.

The following table describes the ACE for the AllUsers@customer group that controls this group's access to the customer OU. This ACE grants all members of this group List Object permissions to the customer OU and applies only to the customer OU.

Table: List Object ACEs for the AllUsers@customer Group

The following table describes the ACEs for the AllUsers@customer group that govern permissions to the customer organization by users. These ACEs are applied to this group and any of its child objects. They grant List Object and Read permissions to all members of this group.

Table: ACEs for the AllUsers@customer Group

The following tables describe ACEs that govern access to user objects and any of their child objects by organization administrators. These ACEs specify permissions that members of the Admins@customer group have for user objects.

The following table describes the permissions that allow members of the Admins@customer group to create and delete user objects within the customer organization.

Table: User ACEs for the Admins@customer Group

The following table describes an ACE that governs access to user objects. This ACE allows organization administrators full control over user objects.

Table: All Items User ACEs for the Admins@customer Group

The following tables describe the ACEs that give members of the Admins@customer group permissions on group objects within their organization. The Admins@customer ACE allows customer organization administrators to create and delete groups within their organization.

The following table describes the group ACEs.

Table: Group ACEs for Admins@customer Group

The following table describes the All Items group ACEs.

Table: All Items Group ACEs for Admins@customer Group

The following table describes the OU ACEs.

Table: OU ACEs for the Admins@customer Group

The ACE described in the following table allows members of the Admins@customer group full control over other OUs within their customer OU.

Table: All Items OU ACEs for the Admins@customer Group

The following tables contain ACEs that govern access to user objects and any of their child objects by the organization's CSRs. These ACEs specify permissions that members of the CSRAdmins@customer group have for user objects.

The following table describes the permissions that allow organization CSRs to create and delete user objects within the customer OU.

Table: User ACEs for the CSRAdmins@customer Group

The following table describes an ACE that governs access to user objects by organization CSRs. This ACE gives members of the CSRAdmins@customer group full control over user objects.

Table: All Items User ACEs for the CSRAdmins@customer Group

The following tables describe the ACEs that give members of the CSRAdmins@customer group permissions on group objects within their OU.

The ACE in the following table enables organization CSRs to create and delete groups within their OU.

Table: Group ACEs for the CSRAdmins@customer Group

The following table describes an ACE that gives organization CSRs full control over group objects within their OUs.

Table: All Items Group ACEs for the CSRAdmins@customer Group

The following tables represent the ACEs that govern access for members of the CSRAdmins@customer group to OU objects within the customer organization.

The ACE in the following table enables organization CSRs to create and delete child OUs within their customer OU.

Table: OU ACEs for the CSRAdmins@customer Group

The following table describes an ACE that gives organization CSRs full control over OUs within their customer OU.

Table: All Items OU ACEs for the CSRAdmins@customer Group

The Remove Authenticated Users ACE is set on each child organization to prevent all users from reading the contents of the child organization, unless they are explicitly granted this right.

The _private container contains special containers and groups required to implement Delegated Administration Console functionality. It contains the Remove Authenticated Users ACE to prevent all users from accessing the _private container except those explicitly authorized to do so.