> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md).
# Manage user roles
{% hint style="warning" %}
### Prerequisite
Managing user roles in Cortex XDR Access Management requires **View/Edit** RBAC permissions for **Access Management** (under **Configurations**). Account Admin and Instance Administrator roles are granted this permission by default. For more information, see *Predefined user roles* in [Set up users and roles](/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles.md).
{% endhint %}
Review the following topics:
* [Set up users and roles](/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles.md)
* [User group management](/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles.md#UUID-c6567cfd-f3f7-da7e-e266-557f3946ec41)
* [Assign user roles and groups](/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles.md#UUID-61ea0230-3be4-e77f-9899-950d47d74fd8)
* [Manage user roles and access management](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management.md)
Manage user roles that are assigned to Cortex XDR users, user groups, or API keys. User roles enable you to define the type of access and actions a user can perform.
You can only set dataset access permissions from a user role in Cortex XDR **Access Management** for the tenant. When creating user roles from the Cortex Gateway, these settings are disabled. By default, dataset access management is disabled, and users have access to all datasets. If you enable dataset access management, you must configure access permissions for each dataset type, and for each user role. When a dataset component is enabled for a particular role, the Issues and Cases pages include information about datasets.
Create a user role
1. Select **Settings** → **Configurations** → **Access Management** → **Roles**.
2. Click **New Role**.
3. Under **Role Name**, enter a name for the user role.
4. (Optional) Under **Description**, enter a description for the user role.
5. Under **Components**, expand each list and select the permissions for each of the components.
6. Under **Datasets (Disabled)**, you have two options for setting the Cortex Query Language (XQL) dataset access permissions for the user role:
* Set the user role with access to all XQL datasets by leaving the dataset access management as disabled (default).
* Set the user role with limited access to certain XQL datasets by selecting the **Enable dataset access management** toggle and selecting the datasets under the different dataset category headings.
7. Click **Save**.
Edit a user role
1. Select **Settings** → **Configurations** → **Access Management** → **Roles**.
2. Right-click the relevant user role, and select **Edit Role**.
3. (Optional) Under **Role Name**, modify the name for the user role.
4. (Optional) Under **Description**, enter a description for the user role or modify the current description.
5. Under **Components**, expand each list and select the permissions for each of the components.
6. Under **Datasets**, you have two options for setting the Cortex Query Language (XQL) dataset access permissions for the user role:
* Set the user role with access to all XQL datasets by disabling the **Enable dataset access management** toggle.
* Set the user role with limited access to certain XQL datasets by selecting the **Enable dataset access management** toggle and selecting the datasets under the different dataset category headings.
7. Click **Save**.
Create new role based on an existing role
1. Select **Settings** → **Configurations** → **Access Management** → **Roles**.
2. Right-click the relevant user role, and select **Save As New Role**.
3. (Optional) Under **Role Name**, modify the name for the user role.
4. (Optional) Under **Description**, enter a description for the user role or modify the current description.
5. Under **Components**, expand each list and select the permissions for each of the components.
6. Under **Datasets**, you have two options for setting the Cortex Query Language (XQL) dataset access permissions for the user role:
* Set the user role with access to all XQL datasets by disabling the **Enable dataset access management** toggle.
* Set the user role with limited access to certain XQL datasets by selecting the **Enable dataset access management** toggle and selecting the datasets under the different dataset category headings.
7. Click **Save**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.