Who assigns roles, group memberships and/or other attributes to a user?

• A. User
• B. Access Administrator
• C. Identity Types
• D. Service Provider (SP)

Answer: (B)

Assigning roles, group memberships, and other attributes to a user is done by the access administrator who provisions identities and entitlements. This role has the authority to grant and adjust permissions, place a user into the appropriate groups, and attach attributes like department or job title. The user themselves are the subject of the access, not the one who assigns it. Identity types describe the kinds of identities that can exist and don’t handle provisioning, while a service provider is the external system that hosts resources and enforces access but doesn’t determine internal user entitlements. So, the person responsible for these assignments is the access administrator.