>
    Strata Copilot
    Create Custom Roles
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Administrator Authorization and Authentication
    5. Role Based Access Control
    6. Custom Roles
    7. Create Custom Roles
    Download PDF
    Prisma SD-WAN

    Create Custom Roles

    Table of Contents

    Create Custom Roles

    Learn how to create custom roles before assigning a role to an administrator using System Administration.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    Create custom roles before assigning the role to an administrator using the System Administration screen. You can create them by assembling a set of system permissions or by adding or removing permissions from system roles.
    1. Select System SettingsIdentity & Access ManagementRolesCustom RolesAdd Custom Roles.
    2. Add a Name and a Description for the role.
    3. Add permissions. The permissions are split between web interface and API.
      If you select API: Any permissions that you had set using Web Interface are visible. You can't remove them from here, but you can remove them by changing them in Web Interface.
      1. Select Add Permissions to open the permissions modal. Permissions are listed in a hierarchy.
      2. Expand Prisma SD-WAN and search for relevant API’s. Type in an API resource to search. Type in an API resource to search. For eg. to modify Path policies, search for “networkpolicysets” You can find the API resources from Unified SASE SD-WAN APIs.
        To allow or disallow specific actions for each resource, you'll need to expand each one and explicitly select "get," "post," "put," "delete," and "query" options. Simply choosing a resource from the initial screen won't be enough, as each resource offers both "allow" and "disallow" sub-options for fine-grained control.
      3. To manage permissions, explicitly select the "put," "post," and "delete" allow options for specific API actions, such as creating or deleting Path Policy sets (networkpolicysets). You do not need to select "get" because a base role like "view_only" will automatically allow get actions.
    4. Click Save the new custom role is created.

    © 2026 Palo Alto Networks, Inc. All rights reserved.