Prerequisites

You must have the MANAGE ANY USER system privilege, the MANAGE ROLES system privilege, and administrative rights on the role being migrated.

Context and remarks

Compatibility roles are like starter roles. You cannot modify the underlying system privileges of compatibility roles. However, you can migrate them to user-defined roles, and then modify the privileges.

The name you assign to the new role cannot begin with the prefix SYS_ and end with the suffix _ROLE. For example, SYS_MyBackup_ROLE cannot be the name of a user-defined role. The name you give the new role is permanent; you cannot alter it later.

The SYS_AUTH_SA_ROLE and SYS_AUTH_SSO_ROLE system roles cannot be migrated individually. However, when the SYS_AUTH_DBA_ROLE system role is migrated, the SYS_AUTH_SA_ROLE and SYS_AUTH_SSO_ROLE are automatically migrated to new user-defined roles as well (sa_role and sso_role, by default).

If you migrate a role for which system privilege inheritance has been disabled (for example, SYS_AUTH_VALIDATE_ROLE), the privileges of the newly created user-defined role will be granted to all grantees in the inheritance tree.