> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md).

# Scope user access to applications (Application SBAC)

Scope user access to applications to ensure users only have permission, visibility, and actions within the applications explicitly assigned to them. This enforces clear security boundaries and provides consistent, application-level control across all application-related assets and issues, minimizing a user’s broad or unnecessary access by enforcing per-user application-level control and ensuring users can only access what’s relevant to them.

Application SBAC defines security boundaries and policies around the application entity itself. It provides granular, application-aware control, transitioning from infrastructure-wide permissions to application-specific enforcement.

## Key features

* **Granular access control** (Implicit Deny Model): Enforces explicit user access to specific applications and their associated assets—such as repositories, packages, and vulnerabilities. Access to any application or asset not explicitly listed is automatically denied
* **Contextual data filtering**: Use the **Business Application Names** as a universal filter to scope data views (such as dashboards) to a selected application

## Application-based scope across the platform

* **ASPM Command Center**: Limits the interactive security workflow graph in the **ASPM Command Center** to only the applications the user is authorized for
* **Dashboards**: Application scope automatically narrows platform-wide data into application-specific insights
* **Coverage**: Evaluate the security maturity of your application by identifying connected data sources and their coverage status of the application's assets, assessing the scanner coverage status of onboarded assets, and understanding which scanners (such as SCA, Secrets, IaC) that are actively analyzing the application's codebase and build

## Application SBAC setup and workflow

1. Platform enablement: [Enable SBAC at the tenant level](#enable-sbac-in-the-cortex-cloud-tenant).
2. [Create or edit an Asset Group](#create-an-application-based-asset-group) to include application assets.
3. [Scope user access to an an application](#scope-user-access-to-an-application).
   1. Assign application-based SBAC to a **User Group**.
   2. Add users to the User Group.
4. **Resulting visibility**: Users see only the applications and related assets they are authorized to manage, based on the applied application scope.

## Manage user access

Configure user scopes in Cortex Cloud by navigating to **Settings** → **Configurations** → **Access Management**. You must possess the necessary **View/Edit** RBAC permissions for Access Management. These permissions are granted by default to the **Account Admin** and **Instance Administrator** roles.

## Enable SBAC in the Cortex Cloud tenant

Before configuring Application scope, SBAC must be enabled at the tenant level.

### Prerequisites

**RBAC permissions**: To configure user scopes you must have **Administrator** or **View/Edit** RBAC permissions for **Access Management** (under Configurations).

* Navigate to Settings → Configurations → General → **Server Settings** → **Enable Scope Based Access Control**.

{% hint style="info" %}

### Note

**Exclusions** (roles not governed by SBAC): Certain roles cannot have SBAC applied. For these roles, access and permissions are managed through Role-Based Access Control (RBAC). You must manually ensure that these roles have all necessary base permissions (for example **Edit/View permissions to assets**), because SBAC is bypassed and does not impose its usual restrictions. As a result, functional access for these roles is determined solely by their RBAC configuration.
{% endhint %}

### Create an application-based Asset Group

Create an application-based **Asset Group** if no appropriate group exists or if the application’s permissions must be isolated from existing groups.

1. Navigate to **Inventory** → **Groups** → **+ Add Group**.
2. On the **Create New Assets Group** page.

   1. Provide a **Group Name** (required) and **Description** (optional).
   2. Enable the **Use only the fields supported by scoping in Access Management** configuration.
   3. Select **Filter panel** → **Business Application Names** → **choose an application**.
   4. Click Create Dynamic Group.

      The **Asset Group** is scoped to applications.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You cannot create SBAC based on static groups.</p></div>

For more information about **Asset Groups**, refer to [Asset groups](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md).

### Create Asset Groups through Terraform workflows

To create Asset Groups through Terraform workflows, refer to [Terraform workflow for Asset Groups](#terraform-workflow-for-asset-groups).

## Scope user access to an application

Scoping user access by application ensures that permissions are applied consistently across all related assets. Users receive access through their membership in application-scoped **User Groups**.

### Assign application-based SBAC to a User Group

Define a **User Group** with SBAC permissions by setting its scope to include assets in Asset Groups that have application properties configured.

1. Navigate to **Settings** → **Configurations** → **User Groups (under Access Management)**.
2. **Right-click on a group in the table** → **Edit Group** → **select the Scope tab**.
3. Define the application scope:
   1. **Scope assets**: Select **Assets** → **Select asset groups** → **select an Asset Group associated with applications**.
   2. **Scope cases and issues**: Select **Cases and Issues** → **All cases and issues**.
4. Click **Save**.

{% hint style="info" %}

### Note

For more information about User Groups, refer to [User group management](/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/user-group-management.md).
{% endhint %}

### Add users to the application-scoped User Group

Add users to the User Group so they inherit the application-specific permissions and access to all related child resources, such as repositories.

1. Select **Settings** → **Configurations** → **Users (under Access Management)**.
2. **Right-click the relevant user** → **select Edit User Permissions**.
3. Select the **Scope** tab.
4. Scope assets: **Select the chevron icon (>) in the Assets field** → **Select Asset groups** → **select the user group scoped to the application** (see above).
5. Scope cases and issues: **Select the chevron icon (>) in the Cases and Issues field** → **Select All Cases and issues**.
6. Click Save.

## Create application-scoped policies

The process for creating an Cortex Cloud Application Security application-scoped policy is the same as for a standard policy. The only difference is on the **Scope** step of the wizard, where you can restrict the policy to a specific application(s) and their associated assets. If your user access is application-scoped, you can create policies only within your assigned scope. All other steps remain unchanged.

{% hint style="info" %}

### Note

Application-scoped policies apply to both code and CI/CD configuration policies.
{% endhint %}

1. Navigate to **Modules** → **Application Security** → **AppSec Polices (under Policy Management)** → **Add Policy**.
2. Configure the **General** and **Conditions** steps of the wizard.
3. On the **Scope** step of the wizard.
   1. Select **Asset Types** as the scope.
   2. Select **Add Filter** → **Business Application Names** → **enter the required application name**.
   3. Click Next.
4. Complete the remaining steps in the wizard to create the policy.

   The policy is displayed in the general **AppSec Policies** table, which reflects your application scope, displaying only the policies associated with applications you can access. Users with broader permissions can filter by **Business Application Names** to find application-scoped policies.

For more information about creating Cortex Cloud Application Security policies, refer to [Create Cortex Cloud Application Security policies](/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md).

## Terraform workflow for Asset Groups

The Cortex Cloud Terraform provider allows you to perform full CRUD (Create, Read, Update, Delete) operations for Asset Groups. By managing these groups as Infrastructure-as-Code, you can dynamically control your inventory lifecycle to properly scope policies, rules, and compliance profiles.

**Configuration**: Use the `cortexcloud_asset_group` resource.

**How it works**: You define the `membership_predicate` to establish boundaries, such as targeting GitHub repositories that contain the word **frontend** in their name.

For more information, refer to [Manage resources](/application-security/terraform-workflows/manage-resources.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.