A method for configuring a secure domain, SD, in a network functions virtualization infrastructure, NFVI, the SD being controlled by a network functions virtualization orchestrator, NFVO, and a virtualized infrastructure manager, VIM,, where the NFVO and the VIM are connected to a virtualized network function, VNF, manager, the SD comprising virtual objects handling privileged information, said method being performed by an apparatus and comprising: - obtaining (S310, 402), from the NFVO or the VNF manager, network service, NS, instance information of a virtual object, based on input from a party associated with the SD; - searching (S312, 404) in the NS instance information, for a level of confidentiality and geographic location information; - when having identified the level of confidentiality and the geographic location information, allocating (S314, 406) the virtual object to the SD according to the geographic location information, based on the level of confidentiality and a specific role of the party; - authorizing access to a set of operations on the virtual object, for the party, wherein the operations are based on the specific role of the party, in a hierarchy of party roles; - receiving, from the NFVO or the VNF manager, a selection input for a further virtual object, the selection input comprising a level of confidentiality of the further virtual object and a location attribute of the further virtual object; - when the location attribute of the further virtual object indicates a location within the geographic location information of the received NS instance information, allocating the further virtual object to the NS according to the level of confidentiality as comprised in the selection input, based on the specific role of the party; and - when the location attribute of the further virtual object does not indicate a location within the geographic location information of the received NS instance information, said method further comprises: checking whether location attributes of a second virtual object and of a second virtual link for accessing the second virtual object, allocated to an existing VNF, indicate a second location within or outside the borders of a jurisdiction indicated in the geographic location information of the received NS instance; and configuring the SD to allow lawful intercept, LI, by a privileged party in a hierarchy in the roles, when said location attributes of the second virtual object and of the second virtual link for accessing the second virtual object, indicate a second location within said borders of the jurisdiction, based on the role of the privileged party. - obtaining (S310, 402), from the NFVO or the VNF manager, network service, NS, instance information of a virtual object, based on input from a party associated with the SD; - searching (S312, 404) in the NS instance information, for a level of confidentiality and geographic location information; - when having identified the level of confidentiality and the geographic location information, allocating (S314, 406) the virtual object to the SD according to the geographic location information, based on the level of confidentiality and a specific role of the party; - authorizing access to a set of operations on the virtual object, for the party, wherein the operations are based on the specific role of the party, in a hierarchy of party roles; - receiving, from the NFVO or the VNF manager, a selection input for a further virtual object, the selection input comprising a level of confidentiality of the further virtual object and a location attribute of the further virtual object; - when the location attribute of the further virtual object indicates a location within the geographic location information of the received NS instance information, allocating the further virtual object to the NS according to the level of confidentiality as comprised in the selection input, based on the specific role of the party; and - when the location attribute of the further virtual object does not indicate a location within the geographic location information of the received NS instance information, said method further comprises: checking whether location attributes of a second virtual object and of a second virtual link for accessing the second virtual object, allocated to an existing VNF, indicate a second location within or outside the borders of a jurisdiction indicated in the geographic location information of the received NS instance; and configuring the SD to allow lawful intercept, LI, by a privileged party in a hierarchy in the roles, when said location attributes of the second virtual object and of the second virtual link for accessing the second virtual object, indicate a second location within said borders of the jurisdiction, based on the role of the privileged party.