> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access.md). # Manage user access {% hint style="warning" %} ### Prerequisite Managing users, roles, scopes, user groups, authentication settings in Cortex XSIAM Access Management requires **View/Edit** RBAC permissions for **Access Management** (under **Configurations**). Account Admin and Instance Administrator roles are granted this permission by default. For more information, see *Predefined user roles* in [Set up users and roles](/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles.md). {% endhint %} Review the following topics: * Set up users and roles * User group management * Assign user roles and groups * Manage user roles and access management * Manage user scope Manage access permissions for Cortex XSIAM users.
Edit user permissions Update a user's role and scope, add a user to a user group, and view permissions based on the role, scope, and user groups assigned to the user. You can configure granular scoping for Scope-Based Access Control (SBAC) by granting access only to the relevant data that the user requires for their designated role. Administrators apply scopes to limit the data and content that users can be granted access to in Cortex XSIAM, which are divided into different scoping areas. The scoping areas include Assets, Cases and Issues, Endpoints, and Datasets Rows, which can be applied as relevant to the enforcement area, entity, or dataset. For more information, see [Manage user scope](/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-scope.md). {% hint style="info" %} ### Note * You can only reduce the permissions of an Account Admin user via Cortex Gateway. * Non-administrator users with **Access Management** permissions are restricted from granting, modifying, or removing the **Instance Administrator** role for any user, user group, or API key. Additionally, the **Edit** and **Remove** buttons are hidden for users who already hold an effective **Instance Administrator** role. {% endhint %} 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Edit User Permissions**.

Tip

To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

3. In the **Role** tab, under **Role**, select the default or custom role. 4. (Optional) Under **User Groups**, add the user to a group. 5. (Optional) Under **Show Accumulated Permissions**: 1. Do one of the following: * Select all to view the combined permissions for every role and user group assigned to the user. * Select a specific role assigned to the user to view the available permissions for that role. 2. Under **Components**, expand each list to view the permissions to the various Cortex XSIAM components. 3. Under **Datasets**, there are two possibilities for viewing a user's dataset access permissions: * When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed. * When dataset access management is disabled and users have access to all XQL datasets, the text **No dataset has been selected** is displayed.

Note

User permissions for components and datasets are based on the access permissions set in the user role. For more information on editing these user role permissions, see Manage user roles.

6. (Optional) You can configure granular scoping: 1. Click the **Scope** tab. 2. Under **Scope Definition**, expand the scoping areas that you want to grant the user role access to in the tenant by clicking the chevron icon (**>**) beside the scoping area title, and make any changes required. The following table explains the options available to configure:

Important

Before configuring, ensure that you review Understand scoping in the Manage user scope section.

| Scoping Area | Granular Scoping Configurations | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Assets |

Set the Scope by selecting one of the following:

The scoping of assets also affects the scoping of cases, issues, and findings.

Note

Visibility of Security domain Issues that refer to assets with agents is controlled by the Endpoints scoping configuration.

| | Cases and Issues |

Set the Scope by selecting one of the following:

When selecting All cases and issues or Select domains, you can separately configure access to issues and cases that lack an asset reference or where the referenced asset is not in All Assets and All Endpoints inventories. To provide access, select the Allow access to cases and issues that are not referencing known assets or endpoints checkbox. Once selected, you can specifically control which users have access to issues and cases that lack Affected Assets (as seen in the issue’s panel) and Assets (as seen in the case's panel), or where the listed assets are not part of the Asset or Endpoint inventories. When the assets listed are not part of the inventories, the asset string is typically non-clickable. In some cases, such as for identity-related issues, assets may open a dedicated User Risk View, which differs from the standard inventories panels. In the Issues and Cases tables, such items can be identified by empty values in the following columns: Asset IDs, Target Agent Identifier, and Source Agent Identifier.

| | Endpoints |

Set the Scope by selecting one of the following:

| | Datasets Rows |

Configure a filter to define the specific subset of rows a user is allowed to access in each raw dataset. A raw dataset is every dataset where Palo Alto Networks data is ingested out-of-the-box or third-party data is ingested using a configured dedicated collector, also called a data source. This filter configuration does not impact the visibility of cases and issues.

Follow these steps to configure a filter:

1. For datasets where no filter is defined, determine how to set the When no filter is defined option as either:

Note

When defining a filter for row-level scoping on raw datasets, queries based on the Cortex Data Model (XDM) are not supported. XDM queries return specific rows only when All rows are accessible is selected and no filter is defined in the Datasets Rows scoping area. Otherwise, no rows are returned.

2. Define any filters for the applicable datasets listed in the table:

1. Scroll down the list of datasets to the dataset you want to apply a filter on, and click the Edit Scope icon.

2. In the Define what rows are accessible window, continue to write the query for the filter in the query box (where the syntax is a limited subset of XQL) to limit the data rows for the selected dataset according to the access permissions you want the user to have. The beginning of the query is already defined before the query box, and there is no need to include this in your query.

Important

For optimal performance, we recommend using a single field in the filter definition and simple comparison operators.

FIXME\_ACCORDION\_PLACEHOLDER

3. (Optional) Set the Time frame for the query. The default is Last 1 day.

4. (Optional) You can preview the query results displayed based on your defined query by clicking Preview. You can edit your query until you're satisfied with the output. By default, the query results are limited to 1000 records.

5. When you are finished, click Done.

The Scope field for the dataset that you added the filter on is updated with the query.

\*\*Example 13. \*\*null

3. Scroll down the list of datasets to the dataset you want to apply a filter on, and click the Edit Scope icon.

4. In the Define what rows are accessible window, continue to write the query for the filter in the query box (where the syntax is a limited subset of XQL) to limit the data rows for the selected dataset according to the access permissions you want the user to have. The beginning of the query is already defined before the query box, and there is no need to include this in your query.

Important For optimal performance, we recommend using a single field in the filter definition and simple comparison operators.

FIXME\_ACCORDION\_PLACEHOLDER

5. (Optional) Set the Time frame for the query. The default is Last 1 day.

6. (Optional) You can preview the query results displayed based on your defined query by clicking Preview. You can edit your query until you're satisfied with the output. By default, the query results are limited to 1000 records.

7. When you are finished, click Done.The Scope field for the dataset that you added the filter on is updated with the query.\*\*Example 13. \*\*null

|

Important

By default, Enable Scope Based Access Control is disabled in Settings → Configurations → General → Server Settings, and granular scoping is not enforced. Before enabling SBAC, we recommend that an administrator or a user with Access Management permissions first ensure that the users, user groups, and API Keys defined in Cortex XSIAM are granted the required access by assigning the relevant scopes. For more information, see Manage user scope.

7. Click Save.
Import multiple users Use a CSV file to import users who belong to a Customer Support Portal account, and assign them roles that are defined in Cortex XSIAM. You can use the CSV template provided in Cortex XSIAM, or prepare a CSV file from scratch. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Click **Import Multiple User Roles**. 3. Do one of the following: * To use the CSV template, click **Download example file**, and replace the example values with your values. * Prepare a CSV file from scratch. Make sure the file includes these columns: * User email: Email address of the user belonging to a Customer Support Portal account, for example, . * Role name: Name of the role that you want to assign to this user, for example, Privileged Responder. The role must already exist in Cortex XSIAM. * Is an account role: A boolean value that defines whether the user is designated with an Account Admin role in Cortex Gateway. Set the value to TRUE; otherwise, the value is set to FALSE (default). 4. Locate the file and drag it to the dialog box. 5. Click **Import**.
View user permissions View all of the permissions currently assigned to a user. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Edit User Permissions**.

Tip

To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

3. In the **Role** tab, under **Show Accumulated Permissions**, do one of the following: * Select all to view the combined permissions for every role and user group assigned to the user. * Select a specific role assigned to the user to view the available permissions for that role. 4. Under **Components**, expand each list to view the permissions to the various Cortex XSIAM components. 5. Under **Datasets**, there are two possibilities for viewing a user's dataset access permissions: * When dataset access management is enabled and the user has access to certain Cortex Query Language (XQL) datasets, the datasets are listed. * When dataset access management is disabled and users have access to all XQL datasets, the text **No dataset has been selected** is displayed. 6. To view the granular scoping configurations granted to the user role, click the **Scope** tab, and under **Scope Definition**, expand the scoping areas to view the settings by clicking the chevron icon (**>**) beside the scoping area title. The scoping areas include Assets, Cases and Issues, Endpoints, and Datasets Rows.
Hide user There might be instances where you want to hide a user from the list of users, for example, a user that has a Customer Support Portal Super User role but isn't active on your Cortex XSIAM tenant. After you hide a user, they will no longer be displayed in the list of users when **Show User Subset** is selected on the **Users** page. Non-administrator users with **Access Management** permissions can hide any user, including those assigned the **Instance Administrator** role. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Hide User**.
Add user to a user group 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Edit User Permissions**.

Tip

To apply the same settings to multiple users, select them, and then right-click and select Edit User Permissions.

3. Under **User Groups**, add the user to a group. 4. Click **Save**.
Deactivate user You cannot deactivate a user who has an Account Admin role. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Deactivate User**. 3. Click **Deactivate**.
Remove role assigned to user You cannot remove a user who has an Account Admin role. 1. Select **Settings** → **Configurations** → **Access Management** → **Users**. 2. Right-click the relevant user, and select **Remove User Role**. 3. Click **Remove**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.