ITDR Honey Users for Cloud Identities

[Rocky-25]

Hi Everyone

We're using ITDR module and are manually assigning asset role as described here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Asset-Roles

Only on-premises identities from AD can be assigned to asset roles. The cloud identities from Entra-ID are not available and therefore can't be assigned. Both directories are integrated with Cloud Identity Engine separately (no Entra hybrid setup) and authentication logs are also ingested into Cortex.

What am I missing here? Is the asset role feature not available for cloud only identities?

Thanks & Best Regards

[neelrohit]

https://www.paloaltonetworks.com/blog/security-operations/boosting-identity-security-with-cortex-xdr...

[Rocky-25]

I'm aware of this article, but it doesn't describe how to add a cloud identities to asset roles. The format only supports AD users: