>
    Strata Copilot
    Create a Workspace
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Workspaces Overview
    6. Create a Workspace
    Next‑Gen Trust Security

    Create a Workspace

    Table of Contents

    Create a Workspace

    Creating a workspace also creates the Identity and Access Management (IAM) scope that controls access to it. Both are permanent: you cannot delete a workspace, and the scope name is fixed once it exists.

    Before You Begin

    Creating a workspace writes to two systems: it creates the workspace in Next-Gen Trust Security and the matching IAM scope in the platform. Each side has its own permission. The Workspaces permission set authorizes the Next-Gen Trust Security side, and the IAM administrator role authorizes creating the scope in the platform. A user needs both to create a workspace.
    You can add the Workspaces permission set to a custom role, so managing workspaces does not require making someone a full Next-Gen Trust Security administrator, though they still need the IAM administrator role.
    Choose the name with some care, though you are not stuck with it. You can rename a workspace later, but its scope name is fixed at creation and is never regenerated, so a renamed workspace and its scope stop resembling each other.

    Create the Workspace

    1. Sign in to Next-Gen Trust Security.
    2. Click System Settings > Certificate Settings > Workspaces.
    3. Click Create Workspace.
    4. On Workspace Details, in Name, enter a name of up to 100 characters.
      Use letters, numbers, spaces, hyphens, and underscores. Other characters are rejected. The name must also be unique within your tenant, ignoring case, so a tenant cannot hold both Platform Security and platform security.
    5. Review Scope.
      Next-Gen Trust Security builds the scope name from the workspace name as you enter it, and the field is read-only. It lowercases the name, replaces every character that is not a letter, number, or underscore with an underscore, collapses repeated underscores, trims any leading or trailing underscores, truncates the result to 20 characters, and appends six random characters. A workspace named Platform Security produces a scope named something like ngts_platform_security_k4m2np.
      Note: The scope name is permanent and cannot be reused, even after the workspace stops being used.
    6. (Optional) In Description, enter up to 500 characters.
    7. Click Next, review Review Summary, and click Create Workspace.

    After You Create a Workspace

    The workspace exists, but nobody can work in it yet. Until you assign its scope to someone, only users working at the tenant level see anything in it.
    Copy the scope name from the workspace, then assign it where the user comes from.
    • For a user who signs in directly, go to System Settings > Identity and Access Management, open the user, and add the scope to their role.
    • For users who arrive through SSO, go to Identity Federation and set the same three things you set for any other access: the product, the role, and the scope.
    Roles and scopes answer different questions, and you assign both. The role decides what a user can do; the scope decides which workspace they can do it in. Because they are separate, a user can be an administrator in one workspace and read-only in another, and what they can do changes when they switch workspaces.

    © 2026 Palo Alto Networks, Inc. All rights reserved.