SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I have a business unit "Marketing" and they would like access to Central Admin Search Area.
Please suggest.
You should never give Central Admin access to anyone that isn't a Farm Administrator and 100% responsible for all actions they take on it.
So to answer your question, no, business units should never have access to that aspect of SharePoint.
It is my opinion that if they can't sit next to you and show you what they want (they already know how to do it), then they should not be touching the most powerful aspect of your SharePoint environment.
That said, Your third suggestion is very much a possibility and depending on your resources not necessarily a bad plan. If you could create a new SharePoint server and instance of SharePoint for them to mess with and set up how they need, you could certainly replicate the steps on your live environment.
Ultimately it comes down to how much trust you are willing to place in the people you are doing this for, and how willing they are (or how willing your boss is) for them to have responsibility for any and all actions they take that affect the environment.
I would have to agree with Zork's answer that you should not give business users access to central admin. It's just too powerful and the potential risk to the site if it is (intentionally or unintentionally) abused is enormous.
Even if you try to restrict the user to just one section of CA, which I don't think would be a trivial task, I know that I would be very worried about that holding up, and I wouldn't consider it worth the risk of it not being as foolproof as I had hoped, especially because central admin is not built around giving partial access.
Having said all of that, most of the stuff that you can do in central admin you can do in any server side code or powershell scripts. You could make one or more pages in the front end of your site that perform a function that's somewhat similar to some particular page in central admin. If there is some particular search configuration that the business needs to change regularly you could determine how to make those changes via code, and if you consider the risk acceptable, expose the business to a custom page that runs the code.
Another option to expand on your #3 option, is that you could provide full access for the business to a dev site (if that's not a problem for you) and then have them write a powershell script that makes the configuration changes they need. You could then review the powershell script, ensure it's safe, and then just run the script on all applicable servers. This may or may not be applicable for business users, but I know for our company even the developers don't have central admin access, just the server admins, so when we need to make central admin changes we either need to provide steps for them to do it, or write a job/script (developed against a dev site we do have full access to) that is run in the prod environment(s).
