When no active user in a tenant holds the necessary administrative roles (such as Account Admin or App Admin) in the Palo Alto Networks Hub, the tenant is considered to be in an orphaned state.

-In this scenario, users cannot self-assign these roles through the standard interface, even if they hold "Super User" status in the Customer Support Portal (CSP), because CSP roles do not automatically grant administrative privileges within the Hub or Cortex Gateway.

To resolve this and assign the roles required to activate the Cloud Identity Engine (CIE), you must follow these steps:

1. Open a Technical Support Case:

Because this requires a backend manual assignment, you must open a case with Palo Alto Networks Technical Support.

2. Required Information for the Case:

When opening the case, provide the following details to expedite the process:

The Customer Support Portal (CSP) Account ID.
The Cortex XDR Tenant URL or Tenant ID.
The email address of the user who needs to be granted the Account Administrator role.
Confirmation that no other active administrators are available to manage roles.

topic CSP HUB roles / accesses in Cortex XDR Discussions

CSP HUB roles / accesses

Re: CSP HUB roles / accesses

1. Open a Technical Support Case:

2. Required Information for the Case: