> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md).

# Identity Security permissions

Identity Security provides centralized visibility and governance over both human and non-human identities across cloud, SaaS, and on-premises environments. Users access these features by going to Modules → Identity Security.

Identity Security permissions control the following permissions :

* Cloud Identity Security (Posture Management): Focuses on identity posture, detecting misconfigured IAM policies, over-privileged accounts, inactive identities, and excessive permissions. For more information, see [Cloud Identity Security](/cortex-cloud-posture-management/cortex-cloud-identity-security/what-is-cortex-cloud-identity-security.md).
* Identity Threat Detection and Response (ITDR): Focuses on real-time threat detection, identifying active attacks such as compromised credentials, privilege escalation, lateral movement, and suspicious authentication patterns.

  For more information, see [Identity Threat Module (ITDR)](broken://spaces/cyIgISZgANJYkmLlnwdK/pages/nfCatnVEpf2EoyglGxRf).

{% hint style="info" %}
Requires Cloud Posture Security or Cloud Runtime Security license.

ITDR requires a separate ITDR add-on.
{% endhint %}

| Permission | Description                                                                                                                                                                         | Roles Example                                                                                                                                                                                                                                        |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | The user has zero visibility into the Identity Security. All related dashboard widgets are hidden.                                                                                  |                                                                                                                                                                                                                                                      |
| View       | Read-only access to all Identity Security features (subject to addon/license availability). Users can observe, investigate, and analyze identity data, but cannot make any changes. | <ul><li>SOC Tier-1 Analyst: View identity posture issues and ITDR issues during triage.</li><li>SOC Tier-2 Analyst & Threat Hunter: Deep investigation access to identity issues and threats, but rule/policy changes should be escalated.</li></ul> |
| View/Edit  | Complete control. Includes the ability to create, modify, and delete identity security configurations, detection rules, and conditional access policies.                            | <ul><li>SOC Tier-3 Analyst: May require access to manage conditional access policies and settings during advanced response</li><li>Security Engineer: Build and tune identity detection rules and access policies.</li></ul>                         |

Required and recommended permissions

To effectively secure identities and investigate complex identity-based threats, analysts and engineers require deep visibility into the underlying cloud configurations, automation responses, and compliance standards. Consider adding the following permissions:

| Permission                        | Permission Level  | Reason                                                                                                                                                                       |
| --------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues                    | View              | Required. Needed to see the cases and issues generated by Identity Detection Rules.                                                                                          |
| Action Center                     | View/Edit         | Strongly Recommended. Required to track and execute active response actions against compromised identities (e.g., disabling accounts or forcing MFA).                        |
| Query Center & Query Library      | View or View/Edit | Strongly Recommended. Required to run and save XQL investigations on complex identity data.                                                                                  |
| Asset Inventory & Asset Groups    | View              | Strongly Recommended. Provides essential broader context for the affected identities and how they map to organizational assets.                                              |
| Cloud Security & Compute Policies | View              | Strongly Recommended. Dictates the overarching cloud posture and CWP policies governing the identities.                                                                      |
| Credentials                       | View              | Strongly Recommended. Needed to view the integrations and connections linking Cortex XDR to cloud and identity providers (such as AWS, Okta, or Microsoft Entra ID).         |
| Playbooks & Scripts               | View              | Strongly Recommended. Heavily utilized for automated identity remediation, such as auto-disabling compromised accounts or alerting identity owners.                          |
| Reports & Compliance              | View              | Recommended. General Reports, Compliance Reports, and Catalog & Assessment Profiles often include identity posture data and frameworks requiring identity security controls. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.