Hi, it is possible - try the following or some variation to suit your use case. my example allowed a user in a suitable admin role to allocate client roles to a user, but the user was otherwise read only. 1 - Create a role to act as admin 2 - Create a policy for your role 3 - Give permission to map client roles. this is done by selecting your client then switching on permissions. then against map-roles apply your role policy. 4 - Give permission to view users. this is done by selecting the admin role, then role mappings. select client roles -> realm-management -> view users. 5 - Give permission to map roles to users. enable permissions on the users sections. then apply your admin role policy. Hope this works for you Simon. On Tue, Nov 7, 2017 at 10:10 AM, pavlos kaimakis <pkaim(a)hotmail.com&gt; wrote: