> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles/manage-asset-roles-for-users.md).

# Manage Asset Roles for Users

{% hint style="info" %}

### Note

User Role Management is available only if the Identity Threat Module add-on is enabled.
{% endhint %}

You may want to manually exclude users from certain asset roles if a user's position in the organization changes and you want their Analytics baselines adjusted accordingly

To access the management page, navigate to **Inventory** → **Assets** → **Configurations**→ **Asset Roles**, right-click a user asset role, and select **Edit Asset Role**. Note that some asset roles are nested under parent roles higher in the hierarchy. For example, an **Admin User** asset role may be a child asset role of the parent asset role **Sensitive User**. You can hover over the information icon next to a role's name to see its parent rule.

When editing an asset role, there are two primary lists:

* **Included Users:** Displays all the users Cortex Cloud automatically detects as having this asset role, as well as any users you have manually added.
* **Excluded Users:** Displays the users that were manually removed from the asset role.

**User role actions**

* **Exclude a User:** Right-click a user in the included list and select **Exclude User**. The user moves to the **Excluded** list, which overrides future automatic detections and ensures they are not added back to the role. By default, Cortex Cloud also removes the user from the parent asset roles.
* **Advanced Exclusion Settings:** To remove a user from a child asset role but leave them in any parent asset roles, click **Advanced Exclusion Settings** and select **Don't Exclude** next to the name of the parent role.
* **Manually Add Users:** Click **Add User** to manually assign a role. To add users one by one, click **Add New** and type the usernames using the exact `Netbios\samAccount` format. To add users in bulk, click **Import from File** and upload a structured CSV.
* **Delete vs. Exclude:** If you right-click and select **Delete User** on a manually added user, the user is removed from the included list. If the system automatically detects the user acting in that role in the future, they appear in the included list again. To permanently prevent them from being associated with the role, you must use the **Exclude** action.

To change the name of a user, right-click the user name and **Edit User**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles/manage-asset-roles-for-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.