What happens when a role is deleted in Prisma Cloud?

In Prisma Cloud, every API access key is bound to a role. When an administrator deletes that role (Settings → Access Control → Roles → Delete), Prisma Cloud immediately and automatically removes all access keys mapped to it, rendering them invalid. No user accounts are altered; only the keys tied to the deleted role are purged, so anything that depended on those keys must be re-provisioned with a new key/role pair.

B – Integrations fail only as a consequence of the key’s removal; the system action is deletion of the key itself, not the integrations. C – User objects remain; they simply lose the permissions that the deleted role granted. D – Users aren’t deleted—only their access keys tied to the deleted role are removed.

1. Palo Alto Networks, “Prisma Cloud Administrator’s Guide (SaaS) – Manage Roles: Delete a Role,” para. 2 (“Deleting a role automatically deletes any access keys associated with it”).

2. Palo Alto Networks, “Prisma Cloud API Reference – Access Keys,” Section ‘Lifecycle of an Access Key,’ p. 3.