> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-migration/migrate-from-cortex-xsoar-6-to-cortex-xsoar-8-saas-using-the-pre-migration-and-migration-wizard/step-3.-run-user-acceptance-tests-uat-using-the-migration-wizard/users-user-groups-and-roles.md). # Users, User Groups, and Roles In Cortex XSOAR 6, management of users and roles is undertaken exclusively in the Cortex XSOAR instance. In Cortex XSOAR 8 SaaS: * Users are created in the Customer Support Portal (CSP). * Administrators can manage users, roles, user groups, and SSO in the instance and in Cortex Gateway. When migrating from Cortex XSOAR 6 to Cortex XSOAR 8, you should review and update your access management settings, user roles, and permissions to ensure they align with the new RBAC model and access management features. For more information about managing users and roles in Cortex XSOAR 8, see [Users and roles in Cortex XSOAR](/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md). {% hint style="info" %} ### Note SAML-authenticated tasks are supported. Self-service read-only users are not supported by Cortex XSOAR 8 and will not be migrated. {% endhint %} User and role differences between Cortex XSOAR 6 and 8 {% tabs %} {% tab title="User and roles" %} | Feature | Cortex XSOAR 6 | Cortex XSOAR 8 | | --------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Users | Can belong to multiple roles | Users can belong to only one role, but can belong to multiple user groups. | | Users | The primary identifier is the username. | The primary identifier is the email address. Usernames are not used in Cortex XSOAR 8. | | Users | Default Admin |

There is no Default Admin in Cortex XSOAR 8. Some permissions granted to Default Admins in Cortex XSOAR 6 are now granted only to users with Instance Administrator or Account Admin roles. This includes access to:

| | User Groups | Not supported | Administrators can create and manage groups of users and assign them specific roles and permissions in a single operation. User groups can include multiple users and nested groups, which inherit the permissions of parent user groups. Administrators also can map groups from an organization's identity provider (IDP) and see details such as created date, updated date, and assigned roles. | | Roles | In server |

Includes out-of-the-box roles, such as Instance Administrator, Account Admin, Analyst, and Read-Only, with specific access rights that cannot be changed. You can view and manage permissions in the instance or in the Cortex Gateway.

Note

If you use the migration wizard to move to Cortex XSOAR 8, your roles from Cortex XSOAR 6 are migrated to Cortex XSOAR 8 and the new Cortex XSOAR 8 out-of-the-box roles of Instance Administrator and Account Admin are also available in your Cortex XSOAR 8 tenant.

| | User Management | In server | In the Cortex XSOAR 8 instance or in the Cortex Gateway, you can view and manage permissions, role-based access control (RBAC), and user group settings. In Cortex XSOAR 6, administrators may have the Users and Roles permission, which includes invitations and editing permissions. In Cortex XSOAR 8, only administrators have user editing permissions. | | {% endtab %} | | | {% tab title="User groups" %} In Cortex XSOAR 6, a user can have multiple roles (there are no user groups). For example, a user can be an Analyst and a Content Developer. In Cortex XSOAR 8, a user can have a single role and belong to multiple user groups, where each group has a role. During the migration process, existing Cortex XSOAR 6 users, with multiple roles are converted to assigned roles within a user group with corresponding roles. For example, in Cortex XSOAR 6, User A has three roles: Employee, Analyst, and Content Developer. When migrating, Cortex XSOAR 8 creates the following: * User groups: Employee, Analyst, and Content Developer * User Roles: Employee, Analyst, and Content Developer User roles are assigned to the user groups, so the Employee role is assigned to the Employee user group, the Analyst role is assigned to the Analyst user group, and the Content Developer role is assigned to the Content Developer user group. User A is assigned to the Employee, Analyst, and Content Developer user groups. {% endtab %} {% tab title="Nested roles" %} Roles are nested in the same way in Cortex XSOAR 6 and 8, but how nesting works is different. * Role nesting Cortex XSOAR 6 uses basic role nesting, where the role with higher permissions includes the role with lower permissions. For example, the Admin role includes the Analyst role permissions. * User group nesting Cortex XSOAR 8 uses group nesting, where the group with higher permissions includes the permissions of the group with lower permissions, but as a subset of the group with lower permissions. For example, the Admin user group is included as a subset of the Analyst user group, as shown in the following graphic. The Admin role includes the permissions of the Analyst role, the same as in Cortex XSOAR 6. ![nested-roles.png](/files/czMssUsyEgtroc6RDL1k) For example, from the user group example above, you have the following roles: * Employee * Content Developer * Analyst In Cortex XSOAR 6: The Employee role is nested in the Content Developer role and is also nested in the Analyst role. In Cortex XSOAR 8, the Employee, Content Developer, and Analyst roles, and user groups are created separately. The nesting is reversed, so the Content Developer and Analyst User Groups are now nested in the Employee User Group rather than the Employee role being nested in Content Developer and Analyst roles in Cortex XSOAR 6. {% endtab %} {% endtabs %} **User migration** Cortex XSOAR 6 users are migrated as follows: * **SSO users**: Users will be created after they log in for the first time. These users should not change their passwords. When they log in, all their additional data is available, such as dashboards and preferences. * **Cortex XSOAR 6 local users**: Local users (including the default admin) with a defined email address are migrated to Palo Alto Networks' CSP (unless already registered or using a third-party integrated SAML). These users are designated the **PANW IDP** user type. All of these users are synced to the Cortex Gateway and set as disabled until the switchover date. {% hint style="info" %} ### Note * The **PANW IDP** user type is created during the migration process and cannot be recreated. If you delete the user with this user type, you cannot create a user with **the PANW IDP** user type, but instead create a regular user in the CSP with the same permissions. * Ensure that all local users that you want to migrate, including the default admin, have an email address in Cortex XSOAR 6. An email address is the primary identifier for the user in Cortex XSOAR 8. Without defined email addresses in Cortex XSOAR 6, local users (including the default admin) are not migrated. If you want to migrate users without a defined email address, add an email address before the migration process begins, or add them manually after migration by creating a CSP account and then assigning them a relevant role. * If an invitation was sent to a user in Cortex XSOAR 6 and the user did not accept the invite before the migration, that user is not migrated to Cortex XSOAR 8. {% endhint %} After migration, the **PANW IDP** users (previously local users) receive an email asking them to complete their registration for the CSP, unless they are already registered or use a third-party integrated SAML. Until the users accept the invitation email, they cannot access Cortex XSOAR 8, and will appear as grayed out in the UI. When the user accepts the invite, the user becomes an active user. All users who were enabled in Cortex XSOAR 6 are enabled in Cortex XSOAR 8. Users who were configured as disabled in Cortex XSOAR 6 remain disabled in Cortex XSOAR 8. Any new users that were created in Cortex XSOAR 6 after the initial data sync are not migrated at switchover and must be added manually. {% hint style="info" %} ### Note Users can access the Cortex XSOAR 8 instance if they are registered CSP users or if they have access through SSO to the instance with SAML. SAML users do not receive an invite email but have access to the Cortex XSOAR 8 instance after the migration is complete. Cortex XSOAR 6 local users receive an invitation email to the CSP when the migration is complete. {% endhint %} **User role migration** Your Cortex XSOAR 6 roles are migrated to Cortex XSOAR 8. In addition, Cortex XSOAR 8 comes out of the box with Instance Administrator and Account Admin roles. Account Admins have access to all Cortex instances, but the Instance Admin only has access to a specific instance. {% hint style="info" %} ### Note During the User Acceptance Testing (UAT) phase, only Instance Administrators and Account Admins can access the Cortex XSOAR 8 UAT instance. You can invite more users to access the UAT instance, provided they have been assigned the Instance Administrator or Account Admin user role. To give them access, go to **Settings** → **Settings & Info** → **Access Management** → **Users**, select the user, and then select the Activate option. The user will then receive an email about how to log in. {% endhint %} You should review all users, roles, and permissions. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-migration/migrate-from-cortex-xsoar-6-to-cortex-xsoar-8-saas-using-the-pre-migration-and-migration-wizard/step-3.-run-user-acceptance-tests-uat-using-the-migration-wizard/users-user-groups-and-roles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.