Restricting log activity capabilities for tenant users

When you add the Log Activity capability to a user role, the Maintain Custom Rules and View Custom Rules permissions are automatically granted. Users who have these permissions have access to all log data for all domains. They can edit rules in all domains, even if their security profile settings have domain-level restrictions.

To prevent users from being able to access log data and modify rules in other domains or tenants, edit the user role and remove the Maintain Custom Rules and View Custom Rules permissions. Without these permissions, the tenant administrator and users cannot change rules, including those rules in their own domain.