>
    Strata Copilot
    Create and Associate a Deployment Profile for Prisma AIRS AI Runtime Firewall
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. Activation & Onboarding
    4. Create and Associate a Deployment Profile for Prisma AIRS AI Runtime Firewall
    Download PDF
    Prisma AIRS

    Create and Associate a Deployment Profile for Prisma AIRS AI Runtime Firewall

    Table of Contents

    Create and Associate a Deployment Profile for Prisma AIRS AI Runtime Firewall

    Create Prisma AIRS AI Runtime firewall deployment profile in the Palo Alto Networks customer support portal and associate it with a tenant service group.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Runtime Security
    To deploy Prisma AIRS AI Runtime firewall, create a deployment profile in the Palo Alto Networks Customer Support Portal and associate it with a Tenant Service Group (TSG). The deployment profile defines how many vCPUs and instances you plan to use, and allows the system to allocate credits appropriately.
    Licensing Capacity Limit: Limited to processing up to 10K AI transactions per day per vCPU of Prisma AIRS AI Runtime firewall.
    When you create or associate a deployment profile ensure that you have registered the firewall. Registration requires access to the Palo Alto Networks customer support portal and a support account; if you do not have an account, you can create one. For more information, see the registration page.
    1. Log in to the Palo Alto Networks Customer Support Portal.
    2. Select Products Software/Cloud NGFW Credits.
    3. Locate your credit pool and click Create Deployment Profile. This lets you define how credits will be allocated for Prisma AIRS instances.
    4. Select Prisma AIRS: AI Runtime Security (Firewalls) and click Next.
    5. Select PAN-OS 11.2.2 and above and click Next.
      PAN-OS is required for managing deployment compatibility and service integration.
    6. Enter the Prisma AIRS details:
      1. Deployment Profile Name.
      2. Number of Prisma AIRS instances.
      3. Planned vCPU per instances.
      Review the Prisma AIRS AI Runtime firewall Setup Prerequisites and Limitations to validate your configuration.
    7. Optional Panorama for Management (with Log Collector) to create a deployment profile for Panorama maanged firewall.
    8. Select Create Deployment Profile.
      The subscriptions and services used by Prisma AIRS AI Runtime firewall are bundled and pre-configured. That is why, you cannot customize or modify them as part of this deployment.
      You’ve now created and associated a deployment profile for Prisma AIRS AI Runtime firewall. This enables you to allocate resources and begin securing AI network traffic across your selected tenant environment.

    Associate a Deployment Profile with a TSG

    After creating a deployment profile for Prisma AIRS, the next step is to associate it with a Tenant Service Group (TSG). This association links your deployment to a specific tenant environment and is required to activate thePrisma AIRS services.
    You must complete this step before onboarding cloud accounts or using runtime services.
    1. Log in to Palo Alto Networks Customer Support Portal.
    2. Select Products Software/Cloud NGFW Credits.
    3. Locate the credit pool you used to create the deployment profile and click Details.
    4. Locate the Prisma AIRS AI Runtime firewall deployment profile and click Finish Setup.
    5. In the Activate Subscriptions based on Deployment Profile(s) form, select the following:
    6. Select the Customer Support Account used to create your deployment profile from the available list.
    7. Select Tenant.
      Verify that the Strata Logging Service is enabled for this tenant.
    8. Select a Region.
    9. In Select Deployment Profile, select the deployment profile you created previously.
    10. Click Done.
      Keep existing deployment profiles checked to maintain their association with the tenant.
    11. Enable Cloud Identity Engine or create a new one for centralized, cloud-based user identity management and enhanced security policy enforcement across your entire Palo Alto Networks deployment.
    12. Agree to the Terms and Conditions.
    13. Click Activate and record the Auth Code.
    14. Verify that the TSG association succeeded by logging into the Hub, selecting Common Services → Tenant Management, and selecting your tenant.
      The initial association between the deployment profile and TSG may take up to 30 minutes.
      Make sure your Strata Logging Service license is active. If it has expired, renew it before onboarding a cloud account to avoid issues with onboarding or Terraform generation.

    © 2026 Palo Alto Networks, Inc. All rights reserved.