> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/scope-based-access-control-sbac-changes-and-enhancements.md).

# Scope-Based Access Control (SBAC) changes and enhancements

Once your tenant is upgraded to version 5, the Scope-Based Access Control (SBAC) feature includes the following changes:

* You can now apply these scoping definitions to existing or new user groups, users, and API keys using the following scoping areas in the **Scope** tab:
  * Assets (New)
  * Case and Issues (Existed previously, updated user experience)
  * Endpoints (Existed previously, updated user experience)
* A new, descriptive user interface provides intuitive workflows for defining and managing granular scoping.
* Previously, SBAC granular scoping could only be configured when the SBAC setting was enabled. Now, even if the SBAC setting (renamed to Enable Scope-Based Access Control) is disabled, administrators can configure granular scoping before enabling the feature.
* Previously, newly created user groups, users, and API keys had default access to all cases, issues, and endpoints. Now, newly created user groups, users, and API keys do not have default access to assets, cases, issues, and endpoints.
* Previously, when using both an endpoint and a domain (now referred to as Endpoints and Cases and Issues scoping areas), access to Issues and Cases was granted when at least one of the scoping areas was matched. Now, access is provided when both scoping areas match.
* Previously, only users with no Endpoint scoping could access cases and issues that did not reference a specific endpoint. Now, any user can be configured to have access to these cases and issues; yet, this is disabled by default. To grant this access, you must manually enable the setting: **Allow access to cases and issues that are not referencing known assets or endpoints** under the **Cases and Issues** scoping area.
* When users with Endpoints scoping also belong to a User Group with no Endpoints scoping, after upgrading, these users will have access to **ALL** endpoints, as the User Group will have an **All Endpoints** scoping definition. If you encounter this scenario, you will need to perform any of the following, depending on the Endpoints scoping defined for users in the User Group:
  * Add common Endpoints scoping to the User Group by selecting **Endpoint Groups** or **Endpoint Tags**.
  * For the User Group, change the **Endpoints** scope to **No Endpoints**.
  * Separate the users from the User Group and grant the users Endpoints scoping as applicable.
* Attack Surface Management (ASM) related issues are scoped based on **Asset Groups** and **Posture** domain. This aligns with the migration of ASM alerts to the posture domain and the integration of ASM inventory into the unified asset inventory.

Read more: [Manage user scope](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/scope-based-access-control-sbac-changes-and-enhancements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.