A superuser is tasked with creating administrator accounts for three contractors. For compliance purposes, all three contractors will be working with different device-groups in their hierarchy to deploy policies and objects Which type of role-based access is most appropriate for this project?

The most appropriate solution is to use the predefined "Device Group and Template Admin" role. This role is specifically designed to grant administrators the necessary permissions to manage policies and objects within the context of device groups and templates. To meet the compliance requirement of segregating access, the superuser would assign this role to each of the three contractor accounts and then configure the "Access Domain" for each account to specify the unique device group that the respective contractor is authorized to manage. This method directly addresses the scenario using a standard, purpose-built role, enforcing the principle of least privilege.

A. Create a Dynamic Read only superuser: This is incorrect because "read-only" permissions are insufficient for deploying policies, and "superuser" access is overly permissive and not restricted to specific device groups.
B. Create a Dynamic Admin with the Panorama Administrator role: The "Panorama Administrator" role provides excessive permissions. Furthermore, dynamic roles grant access based on tags, not the device group hierarchy as required by the scenario.
D. Create a Custom Panorama Admin: While a custom role could achieve this, the predefined "Device Group and Template Admin" role already exists for this exact purpose, making it the most direct and appropriate choice without unnecessary configuration.

1. Palo Alto Networks - Panorama Administrator's Guide 11.0, "Administrative Role Types": This document describes the predefined roles available in Panorama. It specifies the "Device Group and Template Admin" role as providing "Role-based access to device groups and templates. You can select specific device groups and templates." This directly aligns with the requirements of the question.

2. Palo Alto Networks - Panorama Administrator's Guide 11.0, "Configure an Administrator Account": This section details the process of creating an administrator. Step 6 involves selecting a role, and for role-based administrators, Step 7 is to "Define the access domain (the device groups, templates, and virtual systems the administrator can access)." This confirms that you can assign a role like "Device Group and Template Admin" and then restrict its scope to specific device groups for each administrator.

3. Palo Alto Networks - Panorama Administrator's Guide 11.0, "Role-Based Access Control": This section explains the concept of combining roles (which define what an admin can do) with access domains (which define where an admin can do it). The scenario is a classic example of applying an access domain to a role to limit administrative scope. The "Device Group and Template Admin" role is the appropriate role to which an access domain should be applied.