>
    Strata Copilot
    Administrative Roles
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Panorama Overview
    4. Role-Based Access Control
    5. Administrative Roles
    Download PDF
    Panorama

    Administrative Roles

    Table of Contents

    Administrative Roles

    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama)
    No prerequisites needed
    You configure administrator accounts based on the security requirements of your organization, any existing authentication services that your network uses, and the required administrative roles. A role defines the type of system access that is available to an administrator. You can define and restrict access as broadly or granularly as required, depending on the security requirements of your organization. For example, you might decide that a data center administrator can have access to all device and networking configurations, but a security administrator can control only security policy definitions, while other key individuals can have limited CLI or XML API access. The role types are:
    • Dynamic Roles
      These are built-in roles that provide access to Panorama and managed firewalls. When new features are added, Panorama automatically updates the definitions of dynamic roles; you never need to manually update them. The following table lists the access privileges associated with dynamic roles.
    Dynamic Role
    Privileges
    Superuser
    Full read-write access to Panorama
    Superuser (read-only)
    Read-only access to Panorama
    Panorama administrator
    Full access to Panorama except for the following actions:
    • Create, modify, or delete Panorama or firewall administrators and roles.
    • Export, validate, revert, save, load, or import a configuration in the DeviceSetupOperations page.
    • Configure Scheduled Config Export functionality in the Panorama tab.
    • Generate Tech Support File, Generate Stats Dump File, and Download Core Files (PanoramaSupport)
    • Admin Role Profiles
      To provide more granular access control over the functional areas of the web interface, CLI, and XML API, you can create custom roles. When new features are added to the product, you must update the roles with corresponding access privileges: Panorama does not automatically add new features to custom role definitions. You select one of the following profile types when you configure an admin role profile.
    Admin Role Profile
    Description
    Panorama
    For these roles, you can assign read-write access, read-only access, or no access to all the Panorama features that are available to the superuser dynamic role except the management of Panorama administrators and Panorama roles. For the latter two features, you can assign read-only access or no access, but you cannot assign read-write access.
    An example use of a Panorama role would be for security administrators who require access to security policy definitions, logs, and reports on Panorama.
    Custom Panorama admin roles have the following limitations:
    • No access to Reboot Panorama (PanoramaSetupOperations)
    • No access to Generate Tech Support File, Generate Stats Dump File, and Download Core Files (PanoramaSupport)
    Device Group and Template
    For these roles, you can assign read-write access, read-only access, or no access to specific functional areas within device groups, templates, and firewall contexts. By combining these roles with Access Domains, you can enforce the separation of information among the functional or regional areas of your organization. Device Group and Template roles have the following limitations:
    • No access to the CLI or XML API
    • No access to configuration or system logs
    • No access to VM information sources
    • No access to Reboot Panorama (PanoramaSetupOperations)
    • No access to Generate Tech Support File, Generate Stats Dump File, and Download Core Files (PanoramaSupport)
    • In the Panorama tab, access is limited to:
      • Device deployment features (read-write, read-only, or no access)
      • The device groups specified in the administrator account (read-write, read-only, or no access)
      • The templates and managed firewalls specified in the administrator account (read-only or no access)
    An example use of this role would be for administrators in your operations staff who require access to the device and network configuration areas of the web interface for specific device groups and/or templates.

    © 2026 Palo Alto Networks, Inc. All rights reserved.