> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/access-management-permissions.md).
# Access management permissions
Set permissions for Users, Roles, User Groups, and Authentication Settings under Access Management (Set permissions for Users, Roles, User Groups, and Authentication Settings under Access Management (**Settings → Configurations → Access Management**).
{% hint style="warning" %}
**Caution**
* SSO Configuration Risk: Granting View/Edit access allows users to modify the tenant's Single Sign-On (SSO) and authentication settings. Misconfigurations can cause tenant-wide lockouts. Ensure only authorized identity or infrastructure administrators hold this permission.
* Auditing is Mandatory: It is highly recommended that any user managing access also has visibility into the Auditing module to track changes.
* IT Admin: Unlike other modules, IT Admins require full View/Edit access here for user provisioning and SSO duties.
{% endhint %}
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Access Management. | SOC Tier-1 and 2 Analysts and Threat Hunter: No need to manage users or roles. |
| View | Read-only access to users, roles, and groups. | - SOC Tier-3 Analyst: May need to understand team structure.
- Security Engineer: Should understand role structure but not manage users
|
| View/Edit | Full access to create, modify, and delete users, roles, and groups, including configuring SSO settings.
Note
Users with this permission are restricted from granting, modifying, or removing the Instance Administrator role for any user, user group, or API key, and cannot delete API keys that have this role.