Cannot remove accounts from their only roles

Symptoms

When you exclude members from a security role , this error message may appear.

The account cannot be removed as this is the only role assigned to it.

Cause

Any user must have at least one security role assigned. You cannot exclude role members who have no other roles assigned.

Resolution

Before removing a user account from its only role, assign anther security role to that account.

For example, you can assign the account the Viewer security role, which grants minimal permissions.

More information for administrators

It is useful to have at least one default security role that will be automatically assigned to all newly created user accounts. Initially, the Viewer role is the default role. You can mark another role as default, or have multiple default roles in Alloy Discovery.