> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md).

# Manage user scope

With Scope-Based Access Control (SBAC), Cortex XDR enables you to assign users to specific tags of different types in your organization. By default, all users have management access to all tags in the tenant. However, after you (as an administrator) assign a management scope to a Cortex XDR user (non-administrator), the user is then able to manage only the specific tags and its associated entities that are predefined within that scope. To enable SBAC per server, see [Configure server settings](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-server-settings.md).

The permissions in user or group settings define which entity the user can access, and the scope defines what the user can view within the entity.

SBAC applies only to the following functional areas in Cortex XDR.

* **Endpoint Administration table:** View endpoints and take actions on endpoints.
* **Policy Management:** Create and edit Prevention policies and profiles, Extension policies and profiles, and global and device Exceptions that are within the scope of the user.
* **Action Center:** View and take actions only on endpoints that are within the scope of the user.
* **Dashboards and Reports:** Scoping takes place only on agent-related widgets.
* **Incidents and Alerts:** View and manage incidents and alerts filtered according to the scope of the user or group.

{% hint style="warning" %}

### Caution

The rest of the functional areas and their permissions in Cortex XDR do not support SBAC. Accordingly, if these permissions are granted to a scoped user, the user will be able to access all endpoints in the tenant within this functional area. For example, a scoped user with permission to view incidents can view all incidents in the system without limitation to a scope, however, will not be able to create an alert or device exception.

Also, note that the Agent Installation widget is not available for scoped users.
{% endhint %}

How to define user scope

1. Select **Settings** → **Configurations** → **Access** **Management** → **Users**.

   The currently assigned scope of each user is displayed in the **Scope** column of the **Users** table.
2. Right-click the user name and select **Update User**.
3. In the **Scope** tab, select one or all of the following for **Tag Family**. The user's permissions are based on the tags assigned to them.
   * **Select All**
   * **Endpoint Groups:** User is scoped according to endpoint groups. The tag selected refers to the specific endpoint group.

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>A user cannot edit the endpoint group that sets their scope. This restriction prevents users from changing their own scope.</p></div>
   * **Endpoint Tags:** User is scoped according to endpoint tags. The tag selected refers to the specific endpoint tag.
4. If you selected a **Tag Family** option, from the **Tags** field, select the relevant tags associated with the family.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><ul><li>If you select a tag family without specific tags, permissions apply to all tags in the family.</li><li>The scope is based only on the selected Tag Families. If you scope only based on tags from Family A, then Family B is disregarded in scope calculations and considered as allowed.</li></ul></div>
5. Click **Save**.

The users to whom you have scoped particular endpoints are now able to use Cortex XDR only within the scope of their assigned endpoints.

{% hint style="info" %}

### Note

Make sure to assign the required default permissions for scoped users. This depends on the structure and divisions within your organization and the particular purpose of each organizational unit to which scoped users belong.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.