CSP HUB roles / accesses

[ThisizAmen]

Greetings,

How can we manage the hub roles while no user have relevant roles in the tenant. I need to assign a role to a user to activate the Cloud Identity Engine for Cortex XDR

[susekar · Accepted solution]

Hello @ThisizAmen ,

Greetings for the day.

When no active user in a tenant holds the necessary administrative roles (such as Account Admin or App Admin) in the Palo Alto Networks Hub, the tenant is considered to be in an orphaned state.

-In this scenario, users cannot self-assign these roles through the standard interface, even if they hold "Super User" status in the Customer Support Portal (CSP), because CSP roles do not automatically grant administrative privileges within the Hub or Cortex Gateway.

To resolve this and assign the roles required to activate the Cloud Identity Engine (CIE), you must follow these steps:

1. Open a Technical Support Case:

Because this requires a backend manual assignment, you must open a case with Palo Alto Networks Technical Support.

2. Required Information for the Case:

When opening the case, provide the following details to expedite the process:

• The Customer Support Portal (CSP) Account ID.
• The Cortex XDR Tenant URL or Tenant ID.
• The email address of the user who needs to be granted the Account Administrator role.
• Confirmation that no other active administrators are available to manage roles.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar