A user in Cisco Unified Communications Manager Administration has been added to the Standard CCM Admin Users group, which includes the Standard CCMADMIN Administration role, but the user cannot add…

CUCM does not support disabling capabilities at the group level; capability controls are enforced within roles, not groups.

Standard CCM Admin Users and Standard CCMADMIN Administration are the appropriate group and role for administrative functions, so the assignment itself is correct.

Each role in Cisco Unified Communications Manager contains a set of resources with configurable access levels. Within the Standard CCMADMIN Administration role, individual capabilities such as adding users can be explicitly disabled. If the add-user capability is disabled at the role level, the user cannot add new users regardless of which group or role they belong to.

CUCM has no restriction limiting user creation to a single CCMAdmin account; any user with the correct role permissions can add users.

While LDAP synchronization imports users automatically, administrators can still create users manually in CUCM Administration when the role grants that capability.