What should an Administrator consider when assigning Core Administration Permissions to a role?

The "Core Administration Permissions" feature grants access to sensitive account setup pages. NetSuite classifies any role containing this permission as "highly privileged." As a mandatory security protocol to safeguard account integrity, NetSuite requires that any user assigned to a highly privileged role must use two-factor authentication (2FA) to log in. Therefore, a primary consideration for an administrator when assigning this permission is to ensure the role is configured to require 2FA, which is an enforced system behavior.

B. Editing employee records is governed by permissions on the Employee record type, not the broad Core Administration Permissions feature.
C. Assigning this powerful permission solely to edit searches violates the security principle of least privilege; specific search-related permissions should be used instead.
D. Using the standard Administrator role as a general workaround is a significant security risk and contradicts best practices, which favor creating custom roles with minimal necessary permissions.

1. NetSuite Help Center, SuiteAnswers. (2023). Two-Factor Authentication. Answer ID: 49211. This document explicitly lists "Core Administration Permissions" as a permission that makes a role highly privileged, for which 2FA is required. It states, "Users with these roles are required to set up and use 2FA to log in to NetSuite."

2. NetSuite Help Center, SuiteAnswers. (2023). Core Administration Permissions. Answer ID: 99397. This article defines the permission and notes, "Because this permission provides access to sensitive account setup information, you should assign it with caution." It reinforces the link between this permission and the 2FA mandate for highly privileged roles.

3. NetSuite Help Center, SuiteAnswers. (2023). Best Practices for Customizing or Creating Roles. Answer ID: 10092. This document advises administrators to "Follow the principle of least privilege" and to avoid using the Administrator role for daily tasks, directly contradicting the logic in options C and D.