Role Assignment in a Multitenant
Portal 
You use the Role Assignment tool to assign users and groups to both portal roles and UME roles.
The following rules apply to role assignment in a multitenant portal:
· Global roles, such as the Standard User Role (eu_role), can be assigned to global users only.
· Tenant roles can be assigned to users and groups from the same tenant only.
· Global user administrators can assign global and tenant-specific roles to users and groups.
· Tenant user administrators can only work with portal roles that belong to the same tenant as them and for which they have the role assigner permission.
· Tenant user administrators can only work with UME roles that belong to the same tenant as them.
Tenant user administrators are assigned to the standard Delegated User Administration role that is shipped with the portal. By default this role does not provide the authorizations to manage UME roles (UME action UME.Manage_Roles). To provide these authorizations, you need to add this action to the default delegated user administration role. Pay attention that this action allows tenant administrators to assign all roles in their tenant and also to assign himself additional authorizations.
For full details on the permissions required for role assignment, see