> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles.md). # Set up Identity profiles {% hint style="warning" %} ### Notice Requires the ITDR add-on. {% endhint %} The Identity Profile centralizes identity security policies for Domain Controllers. It supports consistent security controls across your environment. This Windows-only profile must be mapped to policies for Domain Controller endpoints. It streamlines onboarding, reduces configuration errors, and helps maintain a consistent identity security posture. This profile is available for Windows environments and must be mapped to policies for Domain Controller endpoints. {% hint style="info" %} ### Note Identity Profile requires Cortex XDR 3.5, Cortex XDR 5.1, or Cortex Cloud Runtime 2.1 or later. It also requires Cortex XDR agent 9.1 or later. It is unavailable for Cortex XDR 2.x and Cortex XDR 3.x tenants. Policies can contain an Identity Profile in mixed-agent environments. Agents earlier than version 9.1 ignore these settings. {% endhint %} To customize settings for specific agents, create an Identity Profile and assign it to policy rules for Domain Controller endpoints. 1. Add a profile and define its basic settings. 1. Go to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. 2. Select **+ Add Profile**, then select whether to create or import a profile.

Imported profiles create new profiles. They do not replace existing profiles.

3. Select the **Windows** platform and **Identity** profile type. 4. Click **Next**. 5. Enter a unique **Profile Name**. Use only letters, numbers, or spaces. Limit the name to 30 characters. 6. Add a **Description** with the profile's purpose or business reason. For example, include a case ID or help desk ticket link. 2. Configure **LDAP Protection** to analyze and act on suspicious LDAP queries sent to a Domain Controller. This feature detects and blocks Active Directory reconnaissance attacks. Use the toggle to enable or disable it.

LDAP Protection takes effect after a restart.

| Item | Options | More details | | ------------------------------------------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------- | | Action Mode | Block, Report, Disabled | The Cortex XDR agent performs this action when it detects suspicious attempts to query a Domain Controller. | | Monitor and Collect Domain Controller LDAP Events | Enabled, Disabled | When enabled, the Cortex XDR agent collects LDAP query information and creates events for investigating suspicious queries. | 3. Configure Weak Password Use Weak Password to identify weak passwords used in Active Directory and define the scan frequency. 4. Configure AD-SPM Use Active Directory Security Posture Management to monitor Active Directory for risky account configurations, weak or compromised passwords, unused accounts, and excessive privileges. When enabled, both **Weak Password** and **AD detection rules** are enabled. 5. Configure Conditional Access Use the toggle to enable or disable the feature. When enabled, configure these options:
| Item | Options | More details | | ------------------------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Silent Logging Mode |

On
Off

| When set to **On**, you can observe the impact of this profile before enforcing policies. | | Service Availability Fail-Mode |

Allow Access
Block Access

| Defines global system behavior when the entire Conditional Access service is unavailable and rule evaluation is impossible. **Allow Access** minimizes disruption and helps prevent user lockout. **Block Access** maximizes security. | | Conditional Access Policy | — | Open the **Identity Access Rules** page to view or change current Conditional Access policies. | 6. Click **Create** to save the profile. ### What to do next Apply the new profile by adding it to a policy rule. You can also define other profiles first. Policy rules let you select the endpoints that receive the policy.
Create a policy rule from the Prevention Profiles page 1. Go to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. 2. Right-click the new profile and select **Create a new policy rule using this profile**. 3. Configure the policy rule.
Edit an existing policy rule from the Policy Rules page 1. Go to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**. 2. Right-click an existing policy and select **Edit**. 3. Add the new profile to the policy rule.
Create a new policy rule from the Policy Rules page 1. Go to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**. 2. Click **Add Policy**. 3. Configure a policy that includes the new profile.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.