> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/gateway-guide/fedramp-security-configuration-for-top-level-admin-accounts.md). # FedRAMP security configuration for top-level admin accounts It is important to understand how to securely configure your top-level accounts and manage privileged settings to ensure FedRAMP compliance. Cortex uses a tiered administrative model to ensure clear separation of duties and to enforce the principle of least privilege. ### Roles * **Account Administrator**: This role is the highest level of administrative authority. It provides cross-instance visibility and control. * This role is primarily managed through Cortex. When a user is designated as a **Super User** within the Customer Support Portal (CSP), Cortex automatically grants them Account Administrator privileges. Through CSP, they can activate serials. Cortex automatically grants Account Administrator privileges during provisioning only if the account does not already have an existing Account Administrator. * To oversee all activated instances, Account Administrators access the Cortex global management console. General user access to specific tenants occurs through the Cortex Gateway based on assigned privileges. The Account Administrator role inherently grants Administrator privileges across all existing and newly provisioned tenants residing within the same CSP account. * Key responsibilities: Instance lifecycle (activation/decommissioning), global user governance, and account-wide security configurations. * **Instance Administrator**: This role is scoped to a specific application instance (tenant). * The Instance Administrator can promote a standard user to an Instance Administrator for a specific environment. * Key responsibilities: Day-to-day security operations, local RBAC, endpoint protection profiles, and alert rule management. ### Managing administrative roles * **Centralized management**: Global management of tenants, users, roles, and user groups across all deployments occurs primarily through the Cortex Gateway. These centralized management capabilities are exclusively available to the Account Administrator role. * **Tenant management**: The Account Administrator role enables the activation of new tenants and the creation of child tenants within MSSP environments. * **User assignment**: The Account Administrator role enables assigning the Instance Administrator role to specific tenants, facilitating delegation of day-to-day operations while maintaining top-level control. ### Security and access controls This section details the management of administrative access across the platform. It covers the security requirements for active administrator roles and the specific procedures for revoking access. **Securing administrative roles** Enforce the following security measures and configurations to protect high-privilege administrative accounts from unauthorized access and compromise. * **Scope isolation**: Strict logical isolation prevents an Instance Administrator from escalating privileges to other tenants. * **API key security**: Account Administrator permissions require Global Management keys and cannot be applied to standard API keys. * **Audit logging**: All administrative actions are recorded in an audit trail for compliance and forensic analysis. * **Enforce IP restrictions**: Limit administrative console access exclusively to trusted corporate network ranges. * **Centralized identity**: Integrate Single Sign-On (SSO) to enforce corporate Multi-Factor Authentication (Federal MFA) across all accounts. * **Minimize privileged accounts**: Limit the total number of Account Administrators to reduce the potential impact of a compromised account. **Decommissioning roles** The following conditions govern the revocation of administrative privileges and the offboarding of users. * **Account Administrator**: An Account Administrator cannot be deactivated directly. Another Account Administrator must first revoke the Account Administrator role within the Cortex Gateway before deactivating the user. * **Instance Administrator**: Access is revoked when an Account Administrator or a peer Instance Administrator demotes the user or removes the user from the instance's authorized user list. * **User deactivation**: Once administrative roles are removed, the user account can be deactivated within the Cortex Gateway. * **CSP removal**: If Single Sign-On (SSO) is not configured, permanently revoking access requires removing the user from the Customer Support Portal (CSP) account, as the CSP globally synchronizes with Cortex environments. ### Administrative settings and security implications **Account Administrator privileged settings** Account Administrators manage global settings that impact the entire organization across all tenants, including the authority to assign the Account Administrator role to other users. The following table outlines these privileged settings and their associated security implications. | Setting | Description | Security implications | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Instance activation | Grants the ability to create and deploy new application instances (tenants) within the account. | **High**: Prevents the creation of unauthorized workspaces, which stops unexpected costs and unmonitored data usage. | | Delegating admin access | Allows assigning Account Administrators or Instance Administrator roles to other users. | **Critical**: Secures top-level system control. Misuse grants unauthorized users full administrative power across the organization's account. | | Approved IP ranges | Restricts administrative access to specific, approved network locations (such as a corporate VPN or main office network). | **Critical**: Acts as the primary defense against stolen passwords. Disabling this permits administrative login from any location globally. | | Identity Provider (IDP) setup | Connects the platform to a corporate Single Sign-On (SSO) system for unified user logins. | **Critical**: Manages user logins. Enabling this enforces corporate security policies like multi-factor authentication, while disabling it forces reliance on less secure, platform-specific passwords. | | Global distribution lists | Manages shared email contact lists for system-wide alerts and notifications. | **Medium**: Ensures important security alerts reach the correct team members across all active instances. | | External IP monitoring | Enables/disables tracking of login attempts from outside the approved corporate network. | **High**: Disabling this limits the ability to detect repeated, unauthorized login attempts from external sources. | **Instance Administrator privileged settings** Instance Administrators have full authority over a single, specific application instance, ensuring their actions cannot impact other tenants within the organization. The following table outlines these instance-level privileged settings and their associated security implications. | Setting | Description | Security implications | | ----------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Local RBAC management | Creates, updates, and deletes custom roles within the specific instance. | **High**: Controls what users can see and do. Incorrectly set permissions can allow unauthorized users to access sensitive data or change system rules. | | Job management | Controls scheduled tasks, data cleanup jobs, and automated maintenance. | **Medium**: Ensures the instance's operational health. Disabling critical jobs can lead to data retention issues or stale security intelligence. | | Endpoint protection policies | Manages the security rules that defend devices (endpoints) against threats. | **Critical**: Protects devices across the network. Incorrectly configured rules can leave devices vulnerable to attacks or accidentally block legitimate business tasks. | | Response and Remediation | Executes high-privilege actions such as Isolate Endpoint, Live Terminal, or File Destruction. | **Critical**: While essential for stopping active threats, these powerful tools can cause significant business disruption if used improperly. | | Data Collection and Ingestion | Configures log sources, parsing rules, and data management for the tenant. | **High**: Determines what the security team can actually monitor. Disabling ingestion creates blind spots, making it much harder to detect active threats. | ### Administrative actions and required privileges from the Cortex Gateway Key administrative actions managed in the Cortex Gateway, such as tenant lifecycle management, permissions, and system configurations, are detailed below with the role privileges required to complete each task. | Action | Description | Required privileges | | ----------------------- | -------------------------------------------------------------------- | ------------------------------------------------ | | Tenant activation | – | CSP Super User and Account Administrator | | XSOAR On-Prem related | Download license/image | CSP Super User and Account Administrator | | Egress configurations | – | Instance Administrator and Account Administrator | | Permissions management | Manage user permissions, roles, and user groups on the account level | Account Administrator | | Manage BYOK | Rotate/cancel rotation/disable keys and deactivate tenant | Account Administrator | | Add child tenant | – | Account Administrator | | Delete child tenant | – | Account Administrator | | Add dev tenant | – | Account Administrator | | Change tenant subdomain | – | Instance Administrator and Account Administrator | | Change tenant name | – | Instance Administrator and Account Administrator | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/gateway-guide/fedramp-security-configuration-for-top-level-admin-accounts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.