Manage user acces

Manage users and their access to the Cortex XDR tenant.

Prerequisite

• Managing users, roles, scopes, user groups, authentication settings in Cortex XDR Access Management requires View/Edit RBAC permissions for Access Management (under Configurations). Account Admin and Instance Administrator roles are granted this permission by default. For more information, see Predefined user roles in Set up users and roles.
• To make users visible in the Users list within the Cortex tenant, an administrator must first assign them the Cortex User role on the Edit User screen in the Manage User Console of the Customer Support Portal (CSP). This role assignment in the CSP controls both the user's visibility in the tenant and their ability to authenticate via the CSP. For more information, see Cortex Gateway Administrator Guide.

Role and permission management

While the CSP controls initial visibility and access, you must update the specific permissions associated with each role within the tenant itself or via the Roles tab in the Cortex Gateway.

The following applies to user access and retention:

• SSO-only access: To allow a user to appear in the tenant while restricting them to SSO login only, assign them the Cortex User role in the CSP, but do not assign them a direct role or a default role in the Cortex Gateway or the tenant.
• Access revocation: If no role is assigned to a user (either directly or through a user group) in the Cortex Gateway or the tenant, the user cannot access the tenant. The user is subsequently revoked in the Cortex Gateway, and their information is no longer saved.

Manage users in the Cortex XDR tenant

Once users are visible in the tenant, perform the following tasks in Cortex XDR to edit permissions, import multiple users, view permissions, or manage user status.

Edit user permissions

Update a user's role and scope, add a user to a user group, and view permissions based on the role, scope, and user groups assigned to the user.

You can configure granular scoping for Scope-Based Access Control (SBAC) by granting access only to the relevant data that the user requires for their designated role. Administrators apply scopes to limit the data and content that users can be granted access to in Cortex XDR, which are divided into different scoping areas. The scoping areas include Assets, Cases and Issues, and Endpoints, which can be applied as relevant to the enforcement area or entity. For more information, see Manage user scope.

Note

• You can only reduce the permissions of an Account Admin user via Cortex Gateway.
• Non-administrator users with Access Management permissions are restricted from granting, modifying, or removing the Instance Administrator role for any user, user group, or API key. Additionally, the Edit and Remove buttons are hidden for users who already hold an effective Instance Administrator role.

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Edit User Permissions.

   Tip

   To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.
3. In the Role tab, under Role, select the default or custom role.
4. (Optional) Under User Groups, add the user to a group.
5. (Optional) Under Show Accumulated Permissions:

   1. Do one of the following:

      • Select all to view the combined permissions for every role and user group assigned to the user.
      • Select a specific role assigned to the user to view the available permissions for that role.
   2. Under Components, expand each list to view the permissions to the various Cortex XDR components.
   3. Under Datasets, there are two possibilities for viewing a user's dataset access permissions:

      • When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed.
      • When dataset access management is disabled and users have access to all XQL datasets, the text No dataset has been selected is displayed.

   Note

   User permissions for components and datasets are based on the access permissions set in the user role. For more information on editing these user role permissions, see Manage user roles.
6. (Optional) You can configure granular scoping:

   1. Click the Scope tab.
   2. Under Scope Definition, expand the scoping areas that you want to grant the user role access to in the tenant by clicking the chevron icon (>) beside the scoping area title, and make any changes required. The following table explains the options available to configure:

      Important

      Before configuring, ensure that you review Understand scoping in the Manage user scope section.

      Scoping Area	Granular Scoping Configurations
      Assets	Set the Scope by selecting one of the following: No assets: No asset is accessible. All assets: Defines access to all assets. Select asset groups: Defines access to the specific assets associated with the Asset Groups selected, and to view all their related cases, issues, and findings for these specific assets and Asset Groups. Under Select asset groups, define the specific asset groups that you want to grant access. Only Asset Groups relevant for scoping are listed, which are asset groups that are using only the asset attributes listed in Manage user scope (under Understand scoping → Scoping Areas → Assets). The scoping of assets also affects the scoping of cases, issues, and findings. Note Visibility of Security domain Issues that refer to assets with agents is controlled by the Endpoints scoping configuration.
      Cases and Issues	Set the Scope by selecting one of the following: No cases and issues: Defines access to no cases and issues. All cases and issues: Defines access to all cases and issues. Users can view cases or issues referencing assets within their scope. Use the Assets section to define which assets are in scope. Select domains: Defines access to the domains selected to view their related cases and issues. Under Select domains, define the specific domains that you want to grant access. Users can only view cases or issues referencing assets and endpoints within their scope. Use the Assets section to define which assets are in scope. When selecting All cases and issues or Select domains, you can separately configure access to issues and cases that lack an asset reference or where the referenced asset is not in All Assets and All Endpoints inventories. To provide access, select the Allow access to cases and issues that are not referencing known assets or endpoints checkbox. Once selected, you can specifically control which users have access to issues and cases that lack Affected Assets (as seen in the issue’s panel) and Assets (as seen in the case's panel), or where the listed assets are not part of the Asset or Endpoint inventories. When the assets listed are not part of the inventories, the asset string is typically non-clickable. In some cases, such as for identity-related issues, assets may open a dedicated User Risk View, which differs from the standard inventories panels. In the Issues and Cases tables, such items can be identified by empty values in the following columns: Asset IDs, Target Agent Identifier, and Source Agent Identifier.
      Endpoints	Set the Scope by selecting one of the following: No endpoints: Defines access to no endpoints with no ability to view their related agent management and enterprise policies. All endpoints: Defines access to all endpoints with the ability to view their related agent management and enterprise policies. This configuration can impact the visibility of related Security domain Cases and Issues, but will not affect asset visibility. Select specific (at least one required): Defines specific access to all endpoint groups by selecting Endpoint Groups or all endpoint tags by selecting Endpoint Tags to view their related agent management and enterprise policies. This configuration can impact the visibility of related Security domain Cases and Issues, but will not affect asset visibility.

   Important

   By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensures that the users, user groups, and API Keys defined in Cortex XDR are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.
7. Click Save.

Import multiple users

Use a CSV file to import users who belong to a Customer Support Portal account, and assign them roles that are defined in Cortex XDR. You can use the CSV template provided in Cortex XDR, or prepare a CSV file from scratch.

1. Select Settings → Configurations → Access Management → Users.
2. Click Import Multiple User Roles.
3. Do one of the following:

   • To use the CSV template, click Download example file, and replace the example values with your values.
   • Prepare a CSV file from scratch. Make sure the file includes these columns:

     • User email: Email address of the user belonging to a Customer Support Portal account, for example, [e-mail].
     • Role name: Name of the role that you want to assign to this user, for example, Privileged Responder. The role must already exist in Cortex XDR.
     • Is an account role: A boolean value that defines whether the user is designated with an Account Admin role in Cortex Gateway. Set the value to TRUE; otherwise, the value is set to FALSE (default).
4. Locate the file and drag it to the dialog box.
5. Click Import.

View user permissions

View all of the permissions currently assigned to a user.

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Edit User Permissions.

   Tip

   To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.
3. In the Role tab, under Show Accumulated Permissions, do one of the following:

   • Select all to view the combined permissions for every role and user group assigned to the user.
   • Select a specific role assigned to the user to view the available permissions for that role.
4. Under Components, expand each list to view the permissions to the various Cortex XDR components.
5. Under Datasets, there are two possibilities for viewing a user's dataset access permissions:

   • When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed.
   • When dataset access management is disabled and users have access to all XQL datasets, the text No dataset has been selected is displayed.
6. To view the granular scoping configurations granted to the user role, click the Scope tab, and under Scope Definition, expand the scoping areas to view the settings by clicking the chevron icon (>) beside the scoping area title. The scoping areas include Assets, Cases and Issues, and Endpoints.

Hide user

There might be instances where you want to hide a user from the list of users, for example, a user that has a Customer Support Portal Super User role but isn't active on your Cortex XDR tenant. After you hide a user, they will no longer be displayed in the list of users when Show User Subset is selected on the Users page. Non-administrator users with Access Management permissions can hide any user, including those assigned the Instance Administrator role.

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Hide User.

Add user to a user group

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Edit User Permissions.

   Tip

   To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.
3. Under User Groups, add the user to a group.
4. Click Save.

Deactivate user

You cannot deactivate a user who has an Account Admin role.

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Deactivate User.
3. Click Deactivate.

Remove role assigned to user

You cannot remove a user who has an Account Admin role.

1. Select Settings → Configurations → Access Management → Users.
2. Right-click the relevant user, and select Remove User Role.
3. Click Remove.

User access reference information

The following is a list of common fields on the Users page:

Field	Description
Show User Subset	Displays all users except for hidden users.
User Type	Indicates whether a user was defined in Cortex XDR using the Customer Support Portal, SSO (single sign-on) using your organization’s IdP, or both Customer Support Portal/SSO.
Direct XDR Role	Name of the role specifically assigned to a user. When a user does not have any Cortex XDR access permissions assigned specifically to them, the field displays No-Role.
Groups	Lists the groups to which a user belongs. Any group that was imported from Active Directory displays AD beside the group name. If a user group has scoping permissions, the users in the group are granted permissions according to the user group settings, even if the user does not have configured scope settings.
Group Roles	Lists the group roles based on the groups to which a user belongs. Hovering over the group role displays the group associated with this role.
Scope	Lists a summary of the granular scoping configured for the user.
Groups Scope	Lists a summary of the granular scoping configured in the user groups that the user belongs to

For more details, see the following topics:

• Set up users, groups, and roles
• User group management
• Assign user roles and groups
• Manage user roles and access management
• Manage user scope