> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md).

# Agent Groups

Configure permissions for agent groups.

Create and manage logical groups of endpoints. These groups are used to assign specific security policies and target actions to specific subsets of devices.

For more information, see [Define endpoint groups](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/define-endpoint-groups.md).

| Permissions | Description                                                                                                                                       | Roles Example                                                                                                                                                                                                                                                                                                                                                                                                           |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | No access to the Groups page (**Inventory** → **Endpoints** → **Groups**.                                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                         |
| View        | Read-only access to the **Endpoint Groups** page, including read-only access to agent group configurations, group details, members, and criteria. | <ul><li>SOC Tier 1 Analyst: Understanding which group an endpoint belongs to helps contextualize issues.</li><li>SOC Tier 2 Analyst: Group membership is important for understanding applied policies.</li><li>SOC Tier 3 Analyst: Full visibility helps understand policy application and identify misconfigurations.</li><li>Threat Hunter: Understanding endpoint grouping helps target hunting activities</li></ul> |
| View/Edit   | All view capabilities plus management actions, such as creating, editing, and deleting groups.                                                    | Security Engineer: Responsible for organizing endpoints into appropriate groups                                                                                                                                                                                                                                                                                                                                         |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission                | Permission Level | Reason                                                                                                                                                                                   |
| ------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Administrations     | View             | Required. Groups organize endpoints. Without endpoint visibility, group membership cannot be understood or validated.                                                                    |
| Agent Prevention Policies | View             | Required. Policies are assigned to groups. Understanding which policies target which groups is essential for group context.                                                              |
| Agent Profiles            | View             | Strongly recommended. Profiles are assigned to groups. Understanding profile assignments prevents configuration conflicts when reorganizing groups.                                      |
| Agent Extension Policies  | View             | Strongly recommended. Extension policies target groups. Understanding extension assignments prevents disrupting Device Control, Host Firewall, or Disk Encryption when modifying groups. |
| Agent Installations       | View             | Recommended. Installation packages may be targeted by group. Visibility helps coordinate deployment with group structure.                                                                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.