Table of Contents
Expand all | Collapse all
- Remote Browser Isolation Activation
-
- What is a Tenant?
- Add a Tenant
- Edit a Tenant
- Manage Tenant Licenses
- Delete a Tenant
- Transition from Single Tenant to Multitenant
- Move an Internal Tenant
- Acquire an External Tenant
- Approve an External Tenant Acquisition
- Limitations for Moving and Acquiring Tenants
- Tenant Hierarchy Limits
- Edit Telemetry Settings
- Product Management
Use the Hub
Contains instruction to activate a product through hub
Next-Generation Firewall, SD-WAN, and some SASE products that have not yet transitioned
to the new activation experience during the phased rollout will use the existing
activation workflow described in this section.
Activate a License or Subscription for Paid Products
First-time license activation for paid products is through an email that you receive
from Palo Alto Networks regarding. The email contains an activation link. Activating
a product from the activation link creates a single tenant where the product is
deployed.
After you activate a product, you have access to Common Services to manage your product from the
Activation Console or Strata Cloud Manager. You get assigned the
Superuser role to manage your product.
Single Customer Support Portal Activation Behavior
See the license activation topics in this guide for details about activating specific
products. In general, for a single Customer Support Portal account, certain fields
in the activation form are prepopulated for you. Depending on your product, you
might be asked to select a region where you want to deploy the product, to select or
create Strata Logging Service to store your logs, to select or create a Cloud
Identity Engine instance to identify and verify all users across your
infrastructure, or to associate devices or appliances.
- In the activation workflow, the Customer Support Portal account associated with the user is prepopulated if there is only one Customer Support Portal account associated with the user.
- For the selected Customer Support Portal account, if there is no prior tenant associated, the tenant field is autopopulated with the same name as the Customer Support Portal account.
- After completing the activation, the user who is activating the first product is added as a superuser on the selected tenant, and can also add other users.
- The default tenant can't be deleted as long as there are products activated in the tenant.
- If the user's selected Customer Support Portal account has a previously mapped tenant, and the user activating a license does not have access to that tenant, the user is informed to contact the tenant account admin to request access.
Multiple Customer Support Portal Activation Behavior
See the license activation topics in this guide for details about activating specific
products. In general, if you have multiple Customer Support Portal accounts, you
will select the Customer Support Portal account that you want to use for managing
your product. Depending on your product, you might be asked to select a region where
you want to deploy the product, to select or create Strata Logging Service to
store your logs, to select or create a Cloud Identity Engine instance to identify
and verify all users across your infrastructure, or to associate devices or
appliances.
- If there are multiple Customer Support Portal accounts associated with the user activating a license, the user can select a specific Customer Support Portal account.
- For the selected Customer Support Portal account, if there is no prior tenant associated, the tenant field is autopopulated with a default tenant that has the same name as the Customer Support Portal account name.
- After completing the activation, the user who is activating the first product is added as a superuser on the selected tenant, and they should be able to add other users.
- If the selected Customer Support Portal account has a previously mapped tenant, and the user does not have access to that tenant, the user is informed to contact the account admin to request access.
- If users require a multitenant setup, they are provided with an option to create a new tenant or a child tenant. They can create the hierarchy with the first child in the tenant management page. They can select the child tenant or create a new child tenant from the activation workflow.
- If multiple tenants exist where products have been previously activated for the Customer Support Portal account, but the user does not have access to those tenants, the user is warned that the product will be activated in a different tenant from where the other services are currently active. The user gets the option to proceed anyway, but is warned that dependent products need to be activated in the same tenant.
Managed Security Service Provider (MSSP) Activation Behavior
See the license activation topics in this guide for details about activating specific
products. In general, for a Managed Security Service Provider (MSSP), you will
select the Customer Support Portal account that you want to use for managing your
customers' products. You will create a tenant hierarchy to manage them. Depending on
the product, you might be asked to select a region where you want to deploy the
product, to select or create Strata Logging Service to store the logs, to
select or create a Cloud Identity Engine instance to identify and verify all users
across the infrastructure, or to associate devices or appliances.
After you activate a tenant heirarchy, you have access to Common Services to manage your tenants from the
Activation Console or Strata Cloud Manager. You can also use Strata Multitenant Cloud Manager aggregated views for monitoring information across all of your
tenants.
- In the case of managed security service providers (MSSP), the end customers are managed by the MSSP that owns the Customer Support Portal account.
- The default tenant is associated with the MSSP Customer Support Portal account. The user activating the product must be granted access to that tenant, and then user can create child tenants and activate products in the child tenant.