first step to allow domain admins not just in the management domain