Assign user roles and groups - Learn how to assign users to roles and user groups. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Role-based access control (RBAC) enables you to use predefined Palo Alto Networks roles to assign access rights to Cortex XDR users. You can manage roles for all Cortex XDR tenants and services in the Gateway or in the Cortex XDR tenant. By assigning roles, you enforce the separation of access among functional or regional areas of your organization.

Each role extends specific privileges to users. The way you configure administrative access depends on the security requirements of your organization. Use roles to assign specific access privileges to administrative user accounts.

You can manage role permissions in Cortex XDR , which are listed by the various components according to the sidebar navigation in Cortex XDR. Some components include additional action permissions, such as pivot (right-click) options, to which you can also assign access, but only when you’ve given the user View/Edit permissions to the applicable component.

The default Palo Alto Networks roles provide a specific set of access rights to each role. You cannot edit the default roles directly, but you can save them as new roles and edit the permissions of the new roles. To view the predefined permissions for each default role, go to Settings → Configurations → Access Management → Roles.

Cortex XDR provides predefined built-in user roles that provide specific access rights that cannot be modified. You can also create custom, editable user roles. If a user does not have any Cortex XDR access permissions that are assigned specifically to them, the field displays No-Role.

Users are assigned roles and permissions either by being assigned a role directly or by being assigned membership in one or more user groups.  A user group can only be assigned to a single role, but users can be added to multiple groups if they require multiple roles. You can also nest groups to achieve the same effect.  Users who have multiple roles through either method will receive the highest level of access based on the combination of their roles.

On the User Groups page, you can create a new user group for several different system users or groups. You can see the details of all user groups, the roles, nested groups, IdP groups (SAML) when the group was created/updated, etc.

You can also right-click in the table to perform actions such as edit, save as a new group, remove (delete) a group, and copy text to the clipboard.