Hi @elsadso ,
admin_all_objects is the only capability through which you can achieve this. In splunk, setting a users' default app can be changed using user Preferences. Only admin can change any user's default app and no one else. What is the use case that any user can change other users' default app ?
https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/User-prefsconf
Default app from role is inherited because all users must have some app selected as default app. So, splunk will by default have an app inherited from their role, any user can change it from Preferences tab.
For an example, if I create a role and I want all users with xyz app to have default then, I can be control while assigning the role to any user. After that, users' preference is considered highest which will override the inherited app from the role.
Ref Doc: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/ConfigureSplunktoopeninanapp
Hope this helps 🙂
... View more