Configure the Cloud Identity Engine Visibility Scope
Table of Contents
Expand all | Collapse all
-
- Cloud Identity Engine Attributes
- Collect Custom Attributes with the Cloud Identity Engine
- View Directory Data
- Cloud Identity Engine User Context
- Create a Cloud Dynamic User Group
- Configure Third-Party Device-ID
- Configure an IP Tag Cloud Connection
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
-
- Configure Azure as an IdP in the Cloud Identity Engine
- Configure Okta as an IdP in the Cloud Identity Engine
- Configure PingOne as an IdP in the Cloud Identity Engine
- Configure PingFederate as an IdP in the Cloud Identity Engine
- Configure Google as an IdP in the Cloud Identity Engine
- Configure a SAML 2.0-Compliant IdP in the Cloud Identity Engine
- Configure a Client Certificate
- Set Up OIDC Authentication
- Set Up an Authentication Profile
- Configure Cloud Identity Engine Authentication on the Firewall or Panorama
- Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
- Get Help
Configure the Cloud Identity Engine Visibility Scope
Learn about the Visibility Scope for the Cloud Identity Engine and how to configure
it.
An individual firewall that you associate with the Cloud Identity Engine can belong
to a Customer Support Portal (CSP) account as well as a Tenant Service
Group (TSG). There is a one-to-many relationship
between CSP accounts and TSGs. This means that a single CSP account can have many
associated TSGs.
When you use the Cloud Identity Engine's Directory Sync or Cloud Authentication
Service, your firewall can view and connect to all tenants associated with your CSP
account. To isolate firewalls and ensure a particular firewall is only associated
with and can only view specific tenants, you can configure the Visibility Scope.
When you configure the Visibility Scope, you can configure each tenant for CSP
visibility or TSG visibility. When you configure a tenant for CSP visibility, that
tenant is visible and available to firewalls that are a member of any TSG within
that CSP account. If you configure a tenant for TSG visibility, the tenant is only
visible and available to firewalls associated with that TSG.
![](/content/dam/techdocs/en_US/dita/_graphics/uv/cloud-identity/visibility-scope-diagram.png)
In the diagram above, there are two firewalls (Firewall_1 and Firewall_2), each with
a different configuration. Visibility and availability depends on the Visibility
Scope for the tenant. In this example, there are two TSGs (TSG_1 and TSG_2) within a
single CSP account (CSP_1). Each tenant has its own Cloud Identity Engine instance.
Both firewalls are associated with CSP_1.
One of the firewalls is associated with TSG_1 and the other firewall is associated
with TSG_2. In this example, the Cloud Identity Engine instance for TSG_1 uses the
CSP Visibility Scope and the instance for TSG_2 uses the TSG Visibility Scope. As a
result, on Firewall_1, only the instance for TSG_1 is visible. This is because
Firewall_1 is associated with TSG_1 and TSG_2's Visibility Scope is configured so
that only firewalls associated with TSG_2 can view and select Firewall_2.
Firewall_2 has visibility for both the Cloud Identity Engine instance for TSG_1 and
the instance for TSG_2. This is because although Firewall_2 is associated with
TSG_2, TSG_1's Visibility Scope is configured for CSP visibility, so any firewall
associated with the CSP account can view and select Firewall_1.
- Log in to the Cloud Identity Engine and selectSettings.
- Select the scope type you want to use for the Cloud Identity Engine.
- TSG— The Cloud Identity Engine tenant is only visible and available to firewalls associated with the current tenant.
- CSP—The tenant is visible and available to firewalls that are a member of any tenant within the current CSP account.
If you use Panorama to manage Prisma Access in the same tenant service group (TSG) as the Cloud Identity Engine, associate Panorama with the Cloud Identity Engine to ensure that Panorama and Prisma Access can access the Cloud Identity Engine (for more information, refer to User Context, step 1.n). This a requirement if you selectTSGas theScope Type. - Saveyour changes.