Refer to the exhibits.

From the Root FortiGate - System Administrator Configuration exhibit:

● The AdminSSO account has the super_admin_readonly role.

From the Downstream FortiGate - Security Fabric Settings exhibit:

● The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.

● SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.

When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.