Administering your realm through the master realm as discussed in may not always be ideal or feasible. For example, maybe you have more than one admin application that manages various admin aspects of your organization and you want to unify all these different "admin consoles" under one realm so you can do SSO between them. Keycloak allows you to grant realm admin privleges to users within that realm. These realm admins can participate in SSO for that realm and visit a keycloak admin console instance that is dedicated solely for that realm by going to the url: /{keycloak-root}/admin/{realm}/console

Each realm has a built-in application called realm-management. This application defines roles that define permissions that can be granted to manage the realm. realm-admin - This is a composite role that grants all admin privileges for managing security for that realm. These are more fine-grain roles you can assign to the user. view-realm - View the realm configuration view-users - View users (including details for specific user) in the realm view-applications - View applications in the realm view-clients - View clients in the realm manage-realm - Modify the realm configuration (and delete the realm) manage-users - Create, modify and delete users in the realm manage-applications - Create, modify and delete applications in the realm manage-clients - Create, modify and delete clients in the realm Manage roles includes permissions to view (for example a user with manage-realm role can also view the realm configuration). To add these roles to a user select the realm you want. Then click on Users. Find the user you want to grant permissions to, open the user and click on Role Mappings. Under Application Roles select realm-management, then assign any of the above roles to the user by selecting it and clicking on the right-arrow.