The asset inventory displays the full cloud hierarchy path for assets across Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud Infrastructure, allowing you to use **Hierarchy Path** to filter, sort, search, or build asset groups and enforce Scope-Based Access Control (SBAC).
**NOTE**
Asset hierarchy data is only available if you onboard your cloud environment using organization-wide or root-level onboarding; it does not apply to environments configured with single-account or individual onboarding.
If you choose to exclude specific organizational units during onboarding, asset hierarchy paths may be incomplete in the asset inventory.
The asset inventory integrates cloud provider hierarchies, ranging from root organizations to specific folders and projects, to provide structural context regarding where a resource resides.
**Asset detail enhancements**
When an asset is discovered, its profile includes three structural attributes to define its location in the cloud hierarchy:
* Realm (Account/Project)
* Organization
* Full Path: Captures all intermediate levels, such as folders and sub-folders, specific to the provider's logic.
These details update when a resource is moved within the cloud provider and display within the asset table.
**Query and Filtering Capabilities**
You can navigate the cloud structure using the **Hierarchy Path** filter in the asset inventory to search for resources under any path in the hierarchy.
* The filter operator logic supports autocomplete and multi-select functionality, displaying the hierarchy in ascending order.
* The filter value displays both the path and the unique ID. For example, GCP Org / Department X (13243141). The ID is for the last item in the path.
You can search by the name or ID of the objects within the autocomplete. For example, you can search by the cloud ID of the organization.
**Asset Groups and Scope-Based Access Control (SBAC)**
You can integrate the hierarchy filtering into Asset Groups to allow for automated grouping by business unit or environment.
This hierarchy data is exposed to Scope-Based Access Control (SBAC) to define permissions based on organizational branches. This allows administrators to configure access so that a user scoped only to **Folder A** cannot see assets residing in **Folder B**, despite being in the same cloud account. If you give access to a parent folder, the user also has access to all child folders.
\
**API Support**
Users can retrieve the full path in the **GET Assets** API, query assets by their hierarchy path using the **Assets API**, and create asset groups by their hierarchy path using the **Asset Groups** API.
\
**Azure resource group visibility**
You can filter, search, and audit your multi-cloud inventory by Azure resource group fields captured within the asset inventory. This resource metadata allows you to track cloud assets by their precise deployment boundaries, build custom asset groups, and enforce Scope-Based Access Control (SBAC).