FortiNDR v7.6.2, it introduces new features to override the admin profile with the Fortinet-Access- Profile attribute. Refer to FortiNDR v7.6.2 release notes for more information. ‘remote_wildcard’ can be used to bypass registering all user accounts individually on the system.
The RADIUS authentication is needed to use the override access profile features. Go to User & Authentication -> RADIUS Server and create a RADIUS Server with ‘Access Profile Override’ set to enable.
Create an Admin Profile at System -> Admin Profiles. In this example, the ‘Read_Profile’ is created to only give read permission.
Next, go to System -> Administrators and enable the status for ‘remote_wildcard’. Set the status to enable and assign the created RADIUS profile. Notice the default Admin Profile is set to ‘SuperAdminProfile’.
 Open the CLI console and run below command to disable the message-authenticator-attribute. Refer config profile authentication radius for more information.
config profile authentication radius edit WINServer set message-authenticator-attribute disable next end
For this example, the Windows Server is used as the RADIUS Server. Create a new Network Policy as per the example below.
In the conditions tab, the FortiNDR IP and a user group are added in the conditions to ensure only specific RADIUS authentication matches with this Network Policy.
In the Settings tab, add the Vendor Specific attributes. Set the vendor code to ‘12356’.
Select the ‘Configure Attribute’ and set the attribute as follows. Attribute value must be set with the same name as the Admin Profile configured in the FortiNDR. In this example, the ‘Read_Profile’ is used. Save all the Network Policy settings.
In FortiNDR, log in with the user who was a member of the group assigned in the Network Policy conditions previously.
Since this admin profile is overridden to use the ‘Read_Profile’, which only has read permission, when try to modify some settings in the FortiNDR, it will show an error.
 | 
