Scenarios for using the Deny permission option

You select the Deny option for these cases:

• To exclude a subset of an identity mapping that has allowed permissions.

• To exclude one special permission when you have already granted full control to an identity.

  Note: PI Module Database does not support the Deny option. If you are using both PI MDB and PI AF, avoid the Deny option to prevent synchronization problems. In addition, if a user is mapped to an identity that has the Admin permission assigned at the server level, any Deny option will be overridden.