Step 4. Set up users and roles - Create user groups and roles, manage users in the main tenant, and authenticate users using SAML 2.0 in a multi-tenant deployment. - Administrator Guide - 8.13 - Cortex XSOAR - Cortex - Security Operations

On the main tenant, select Settings & Info → Settings → Access Management → Users → Add User.

1. In the Send Invitation section, select one of the following:

   • Manually enter users

     1. Add the email address and first and last names.

     2. Add the user.

     3. Repeat the above steps for any other users you want to add, if they have the same role, user group, or no role.

     4. (Optional) Select the Role and User Group, if relevant.

        You cannot select different roles and user groups for multiple users.

        Note

        Users created on a child tenant can’t be assigned to a user group or role that was set up in the main tenant.

     5. Invite the users.

   • Upload a file

     1. (Optional) Download the example file.

     2. Add the users' details to the file and upload it.

        Note

        • The file must be in a CSV format.

        • At least one row must exist including email address, first and last names.

        • You cannot select different roles and user groups for each user. If you want different roles and user groups for each set of users upload separate files.

     3. (Optional) Select the role and User Group.

     4. Invite the users.

     5. If you want to invite additional users, repeat these steps.

2. In the Send Invitation section, select one of the following:

   If you have set up a mail integration, users will receive a link to access Cortex XSOAR. When accessing the link, users need to complete the password and will be able to log in.

3. Unless already done so, add roles and user groups to users.

In the main tenant, select Settings & Info → Settings → Access Management → Roles → New Role.

1. Add the Role name and a meaningful Description.

2. In the Components tab, add the permissions as required. For more information, see Role-based permissions.

3. In the Advanced tab, do the following:

   • Define dashboards

   • Define preset role queries

   • Set up shift management

4. Save the role.

5. You can create user groups and add roles to them (recommended), assign roles directly to users after they have been added, or both.

Go to Settings & Info → Settings → Access Management → User Groups.

1. To create a new user group for several different system users or groups, click New Group, and add the following parameters:

   Parameter	Description
   Name	Name of the user group.
   Description	Description of the user group.
   Role	Select the group role associated with this user group. You can only have a single role designated per group.
   Users	Select the users you want to belong to this user group. Note If users have been created locally, but you want them to access the tenant through SSO only, skip this field and add only SAML group mapping after SSO is set up, otherwise, users can access the tenant through their username and password and and through SSO. If you have not yet created any users, skip this field and add them later. See Set up authentication.
   Nested Groups	Lists any nested groups associated with this user group. If you have an existing group you can add a nested group. User groups can include multiple users and nested groups, which inherit the permissions of parent user groups. The user group will have the highest level of permission. For example: Group A has Tier-1 Analyst permissions Group B has Tier-2 Analyst permissions If you add Group A as a nested group in Group B, Group A inherits Group B's permissions (Tier-1 and Tier-2 permissions). In Cortex Gateway, you can only add user groups that are created in Cortex Gateway.
   SAML Group Mapping	(Relevant when creating a user group in the Cortex XSOAR tenant only). Maps the SAML group membership to this user group. For example, you have defined a Cortex XSOAR Admins group. You need to name this group exactly how it appears in Okta. You can add multiple groups by separating them by a comma. Note When using Azure AD for SSO, the SAML group mapping needs to be provided using the group object ID (GUID) and not the group name. If you have not set up SSO in your tenant, skip this field and add it later. After you have added it, follow the procedure relevant to your IdP. For example, see Task 6. Map SAML Group Memberships to Cortex XSOAR User Groups.
   Available Tenants (Only available in Main Tenant)	Displays the list of child tenants that are paired with the main tenant. Users and roles in the child tenant are updated from the main tenant only when the user group created includes the child tenant and the role and user defined in the main tenant. Note User groups created on the Main Tenant, cannot be edited or deleted from the child tenants.

2. Create a new user group.