Platform Administration (RBAC, Enterprise Groups, Integrations)
What this domain tests
This domain tests administration of users, roles, scoping, single sign-on, and integrations. You need to know how RBAC and enterprise groups limit visibility and how integrations connect Prisma Cloud to other systems.
Core rules and concepts
- RBAC assigns roles to users or groups. Roles carry permissions; users receive access through role assignment.
- Enterprise groups scope account groups and cloud accounts for administration and visibility. They are not the same as account groups.
- SSO with SAML maps identity provider groups to Prisma Cloud roles where configured.
- Integrations include notification channels, ticketing, SIEM, and CI/CD systems; each needs correct credentials and least privilege.
- Audit logs and API access keys should be managed and rotated.
Worked example
A security analyst should see only production alerts. Reasoning: create or select a role with read-only alert and resource visibility, assign it to the analyst, and scope access through an enterprise group that contains the production account group. Verify that non-production accounts are absent from the analyst's view. This avoids over-privileged access.
Traps that cost marks
Do not assign broad default roles when a scoped role works. Do not confuse an enterprise group with an account group. Do not assume SSO automatically maps group membership without configuration. Do not leave integration credentials over-privileged or unrotated.