The "admin" account and role in Splunk Cloud platform

Applicability

Description

1. sc_admin role is sufficient to administer Splunk Cloud platform

"Splunk Cloud Platform provides the sc_admin role, which has sufficient capabilities to administer Splunk Cloud Platform. It can be used  to perform self-service tasks such as installing apps, creating and managing indexes, and managing users and their passwords."

Reference:
Differences_between_Splunk_Cloud_Platform_and_Splunk_Enterprise

2. The "admin" user should not be deleted or edited

"Do not delete or edit the Splunk Cloud Platform system users: admin, app-installer, cmon_user, index-manager, internal_automation, internal_ops_admin, internal_monitoring, and internal_observability. Splunk Cloud Platform uses these system user roles to perform essential monitoring and maintenance activities."

Reference:
Delete_a_user

3. Purpose of "admin" role

"The Splunk platform uses the Admin role and system user roles to perform essential monitoring and maintenance activities. You might observe the Admin and system user roles authenticating into your Splunk Cloud Platform environment as part of the platform performing monitoring and maintenance activities. The platform performs these activities in accordance with a comprehensive security program designed to protect the confidentiality, integrity, and availability of your data.""

System_User_Roles

4. "admin" account and role are holdovers from past versions of Splunk Cloud platform 

"Splunk is in the process of retiring the use of the "admin" user and role. The "admin" account and role are holdovers from the early days of the Splunk Cloud Platform service, and as Splunk continues to evolve its capabilities in Splunk Cloud Platform, the account and role are no longer relevant."

Reference: Add,_edit and_remove_capabilities_from_roles