> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units.md). # Manage Business Units In Expander, a *business unit* or BU is an organizational unit that is responsible for a specific set of assets. Business units are assigned to assets by Xpanse during the initial network mapping process. Business unit definitions can be hierarchical, so a large organization may have a parent business unit with multiple levels of child business units. An asset may be associated with one or more business units. Cortex Xpanse assigns business units to all assets in the Inventory, except services and websites. Services, websites, incidents, and alerts inherit the business units of the assets associated with them. Expander supports filtering and sorting of data in your asset inventory, incidents, alerts, dashboards, and reports by business unit. After the initial network mapping of your attack surface, you can modify the business unit assignments for assets in Expander on the **Assets** tab of an incident and on the asset details panel in the **Inventory**. When changing the business unit assignment, Expander displays all of the existing business units as a hierarchy so you can choose the specific business units to assign to the asset. An asset can belong to any business unit in the hierarchy. Business unit assignments and the access permissions based on those assignments are not inherited. If you remove all the business units from an asset, Expander will mark the asset as **Unassigned**. ## Add New Business Units While you can modify business unit assignments, you cannot add new business units in Expander. To add additional business units, contact your Customer Success representative. ## View Previous Updates to Business Units You can view information about previous updates to business unit assignments in the management audit logs. Navigate to **Settings** → **Management Audit Logs** and filter the table on **Type** equals **Business Unit Change**. ## Restrict User Access Using Business Units You can restrict user access in Expander to specific business units using scope-based access control (SBAC). See [Manage User Scope](/cortex-xpanse/users-and-roles/manage-user-scope.md) for information about configuring SBAC. You can also restrict access to viewing or editing business unit overrides by assigning users predefined or custom roles. The roles **Account Admin** and **Instance Administrator** are the only predefined roles with access to business unit overrides. For information about how to assign roles and create custom roles, see [Manage Roles](/cortex-xpanse/users-and-roles/manage-roles.md). ## The Difference Between Business Units and Tags In Expander, business units identify the organization or department that owns an asset on your attack surface. For example, if you acquire a company, you could assign their assets to a separate business unit. Or assets in different regions could be assigned separate business units. Tags, on the other hand, are used for a variety purposes, such as custom IP ranges, advanced data filtering, customized data, and to restrict or permit access to data in Expander using Scope-Based Access Control (SBAC). Business units are initially assigned by Xpanse and can be modified by users later. Tags may be created and assigned by Xpanse or created and assigned by users, depending on the type of tag. See [Asset Tagging](/cortex-xpanse/inventory/asset-tagging.md) for information about the different types of tags and how to use them. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.