Troubleshoot removed roles when upgrading from standalone Mission Control

This article is exclusively for users upgrading from the standalone Splunk Mission Control product to Splunk Enterprise Security 8.x.

Some of the roles from standalone Splunk Mission Control have been removed from Splunk Cloud Platform. However, when you upgrade from standalone Mission Control to Splunk Enterprise Security 8.x, these roles appear to be still assigned to Splunk users. You must manually unassign these roles from users.

To unassign these roles from Enterprise Security 8.x users, follow these steps:

1. In Splunk Cloud Platform, select Settings, then under Users and Authentication, select Users.
2. Use the search field at the top of the Users page to search for each of these old MC roles, one at a time.
   • role_mc_soar_asset_owner
   • role_mc_soar_automation
   • role_mc_soar_automation_engineer
   • role_mc_soar_incident_commander
   • role_mc_soar_observer
3. For each user that appears in the search, select the user name. When the editing page appears, select Save. [Do not make any edits. ]
4. When you return to the list of users, confirm that the old roles were removed from that user.
5. Repeat this process for each role listed in Step 2.

Unassign old MC roles from a user before cloning that user.