>
    Device Security
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Configure IoT Networks
    4. Sites and Site Groups
    5. Device Security
    Download PDF
    Device Security

    Device Security

    Table of Contents

    Device Security

    Create and manage site and organize them into groups in the Device Security portal.
    Log in as a user with owner privileges and select NetworksNetworks and SitesSites. There you can view, add, edit, and delete sites and site groups with devices under Device Security protection.

    Add a Site

    Add a Site
    1. At the top of the Sites section, click + to open the Create Site dialog.
      There are different settings based on the device-to-site assignment method that’s in use.
    2. Configure your site.
      IP address-based assignment
      • Site Name: Enter a name for the site
      • Optional Site Address: Enter an address to help you identify the geographical or network logical location of the site
      • Optional IP Prefix: Choose a nonshared IP address block
      • Optional Network Segment: Choose a previously defined network segment
      • Optional Description: Enter a description for the site
      Firewall-based assignment
      • Site Name: Enter a name for the site
      • Optional Site Address: Enter an address to help you identify the geographical or network logical location of the site
      • Optional Site Group: Choose an existing site group to assign the site to
    3. Save your new site.
    4. Edit your site or delete your site if you no longer need it.
      To edit or delete a site, click the three vertical dots at the far right of a site row and then click one of the actions that appear. When assigning devices to sites based on firewalls, there are two additional options. You can assign one or more firewalls to a site or unassign a site from a group.
      Before you can delete a site, you must first remove all firewalls from it or reassign them to different sites.

    Add Groups to the Tree and Add Sites to Groups

    Add Groups to the Tree and Add Sites to Groups
    There can be five levels in a group hierarchy. The root node forms the top-level group (“Acme” in the examples here) and is the group to which all sites belong by default. The top-level group is the name of the tenant account and can’t be removed, but it can be renamed. All other groups below the root are owner-defined.
    The global filter has priority over page-level filters. When creating the tree structure, set the global filter at the top of the page to All Sites. If it’s set to anything else, the Organization panel will keep collapsing to show only the site or sites that are selected in the global filter.
    Once you have a group hierarchy set up, you can assign sites to groups as a bulk action, as an individual assignment, or as a combined create and assign action.
    1. Add a group to the organization by hovering over an existing group and then clicking the Add group icon.
    2. Enter a name for the group.
    3. Optional Continue adding groups and subgroups to reflect the structure of your organization.
    4. After adding the groups you need, add sites to them.
      1. Multiple sites selection Select the check box for one or more sites in the Sites panel, click Assign to Group, and then choose the group to assign them to.
        You can search for a group in the Search groups field at the top of the Assign to Group drop-down.
        You can also use these steps to reassign sites from one group to another. When you select a new group for a site, the site is removed from the old group.
        When you assign a site to a group that also has subgroups, a node labeled Sites appears in the tree under its assigned group at the same level as the subgroups. For example, the group named East Coast has two subgroups — New Jersey and Virginia — and it also has a node called Sites for two sites assigned to the East Coast group.
      2. Single site selection Assign a single site to a group by editing the site.
        1. Select the three-dot menu at the far-right of a site's row in the Sites panel.
        2. Select Edit Site to bring up the Edit Site dialog.
        3. Assign or edit the Site Group (Optional) field for the site.
        4. Save your changes.
      3. Continue assigning sites to the appropriate groups.
      4. Optional Add new sites to groups by selecting a Site Group option when you create a new site.

    Delete Groups

    Delete Groups
    1. Optional Reassign or remove all sites and child groups assigned to the site before deleting it.
      If you delete a group, Device Security reassigns all its sites and child groups to its parent group. For instance, look at what happens when the Maryland group is deleted. The site that belonged to Maryland now belongs to East Coast, and its child group Annapolis becomes a child group of East Coast.
    2. Hover over the group that you want to delete and then select the three-dot menu to view management actions.
    3. Select Delete Group.
    4. Verify that the site no longer appears in the organization hierarchy, and that all children groups and sites have been properly reassigned.

    Use Groups and Sites to Filter Data

    Use Groups and Sites to Filter Data
    You can use the tree organizational structure to filter what to display on the Sites page and on the Devices page. Additionally, you can use sites and groups to define the scope of reports.
    1. From NetworksNetworks and SitesSites, filter the Sites panel by selecting a group name in the Organization panel.
      To remove the site filter, click the X next to the site name chip at the top of the Sites table.
    2. From AssetsDevices, use the sites global filter to select which sites' devices to display on the page.
    3. Navigate to Logs & ReportsReports, click +, and select the type of report that you want to create with a site filter.
      1. Configure the report, and under Sites select the sites you want to filter for in your report.
      2. Generate or Schedule your report.
      3. Scheduled reports To verify that your report captures the correct site filter, find the card for your report and click Generate Now to generate a report to review on-demand.

    Control Access by Sites and Site Groups

    Control Access by Site and Site Groups
    When logged in as a user with owner privileges, you can use groups to control which sites you allow other users to access.
    By default, all users have access to all groups and sites. After a user with owner privileges gives other users access to a limited subset of sites and site groups, that’s all they can access. If you delete those sites and site groups, these users won’t return to having default access to everything. Instead, they won’t be able to access anything; that is, until they’re given access to something else. On the other hand, users with owner privileges always have access to all groups and sites in their account.
    1. Navigate to AdministrationUser Accounts and select the account to modify from the User Accounts table.
    2. On the User Detail page, open the User Role & AccessSites drop down, and select which sites and site groups the user can access.
    3. Save your changes.

    © 2025 Palo Alto Networks, Inc. All rights reserved.