A FortiGate administrator configures a Virtual Domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is…

In a FortiGate VDOM configuration, a physical interface cannot be moved or reassigned to another VDOM if any configuration element (e.g., firewall policy, static route, virtual IP) in its current VDOM is referencing it. The FortiGate greys out the option to prevent breaking existing services and network connectivity.

A greyed-out option typically indicates a functional constraint rather than a permission issue; permission issues usually result in an error message upon attempt.

Non-management VDOMs are specifically designed to reference and use physical interfaces for traffic segmentation.

An interface's operational mode (PPPoE, DHCP, static) does not inherently prevent its reassignment to a different VDOM, assuming it's not currently in use by other configurations.

While the CLI can be used for interface reassignment, it is also possible via the Web Config if no other configuration references the interface, so the option would not be greyed out if this were the only reason.