Autonomous DEM
What’s New—Autonomous DEM
Table of Contents
What’s New—Autonomous DEM
View the new features added in Autonomous DEM.
Here’s what’s new in Autonomous DEM:
What's New in October 2025
Security Policy Insights in Access Analyzer
Requires:
|
Access Analyzer provides a comprehensive
view of policy enforcement that enables faster troubleshooting and resolution of
user access issues. Without clear visibility into which attributes triggered the
block for the user to access an application, it can be challenging to determine if
the block was appropriate or the result of an unintended security policy
configuration. Access Analyzer addresses this issue by allowing you to gain insights
into security policy attributes within a few seconds.
When you submit a user access issue query in Access Analyzer, you can view
the exact user attributes that contributed to the policy enforcement, including
specific user groups that triggered the policy rule match, the Host Information
Profile (HIP) applied at the time, URL categories, and devices that were evaluated
at the time of the block. You can also view a time line of events in traffic logs,
that shows when a security policy rule matched and any policy rule changes that
contributed to its enforcement.
The feature is valuable in common scenarios such as when a user is added to
a dynamic user group that restricts access to corporate resources, when a device's
posture changes due to security software being uninstalled, or when application
identification issues occur. This visibility enables you to perform remediation
steps effectively when blocks are legitimate, or to quickly correct policy
configurations when blocks occur in error.
Unifying SASE and NGFW Visibility with the NetSec Health Dashboard
Requires:
|
The NetSec Health Dashboard provides a
comprehensive view of your organization's network security health across all user
devices, branch sites and AI-Powered ADEM monitored applications. Previously,
NGFW users lacked a unified way to understand the end-to-end health of users and
applications across their organization. This dashboard enhances the existing SASE
health dashboard by integrating the health and experience scores from both your
Next-Generation Firewall (NGFW) deployments and your Prisma Access (PA) environment
into a single pane of glass. Currently, the dashboard shows unified digital
experience insights from NGFW deployments for user devices only.
The interactive view in the dashboard shows the experience scores to
highlight the status of user devices, sites, and applications in your organization
as Good, Fair, and Poor. You can further drill down to analyze user-specific
details, users’ browsing experience, network segments causing degradation, and open
device incidents. For sites, you can review Prisma SD-WAN and third-party
connectivity data and any related open incidents. For monitored applications, the
dashboard shows application availability and critical end-to-end performance
metrics.
What's New in August 2025
Review features introduced in the ADEM Access Experience Agent 5.7.
Monitor LAN Health When Local Access is Blocked
Requires:
|
Autonomous Digital Experience Management (ADEM) is enhanced to monitor LAN health with synthetic tests,
even when the GlobalProtect app is configured to block direct access to the local
network. This functionality provides the flexibility to maintain the security
posture of blocking direct local network access without sacrificing ADEM's critical visibility into LAN performance. You can
explicitly configure ADEM to monitor LAN health when the local
network access is blocked. When ADEM detects the direct access to
local network is disabled in the GlobalProtect app, the ADEM
agent runs separate, dedicated processes to collect LAN metrics using TCP
connections. Ensure to allowlist these processes in your GlobalProtect app to enable
the agent to collect LAN metrics.
Reverse DNS Lookup for Path Tracing
Requires:
|
ADEM enables you to control reverse DNS lookups during path
trace monitoring. By default, ADEM attempts to identify the hostname for every IP
address it encounters. However, DNS lookups on private IP addresses (RFC1918) fail to resolve which adds to DNS
traffic. To eliminate this traffic, you can configure ADEM to perform reverse
lookups only for public IP addresses, ignoring all private ranges. Alternatively,
you can retain the default setting to perform DNS lookup on all IP addresses. This
optimization reduces network noise and improves the efficiency of path
monitoring.
Launch Access Experience from the Prisma Access Agent App
Requires:
|
The Access Experience icon is integrated
directly into the Prisma Access Agent app, giving you a convenient way to get
help for connectivity issues, device health assessments, and other common access
problems. You no longer need to find and click a separate icon in the Windows
system tray or macOS menu bar when they encounter connectivity issues. Instead,
simply open the Prisma Access Agent app and access the integrated Access
Experience icon, creating a more intuitive workflow for resolving problems. This
integration reduces interface clutter and provides a more straightforward path
to diagnostic tools.
What's New in July 2025
Enhanced Root Cause Analysis for Application Experience
The root cause analysis for application
experience in ADEM is enhanced to provide actionable insights to help
resolve application performance issues quickly. ADEM provides granular root cause
analysis of the application issues by pinpointing the exact source of performance
degradation and recommends remediation steps. The root cause analysis breaks down
application metrics into sub-components to identify precise causes of issues. The
applications issues are mainly categorized as App Degradation, App Not Reachable,
and App Unavailable. For each issue type, ADEM enables you to drill down to identify
the potential root causes, degraded reason or error types and impacted service
delivery segments. ADEM also shows tailored remediation steps specific to each
identified issue, guiding you through the appropriate actions to resolve problems.
The root cause analysis data is made easy to read using an interactive
sunburst chart and companion widgets. The sunburst chart provides a hierarchical
view of application issues, progressing from general categories to detailed root
causes and error types for straightforward diagnosis. The root cause analysis
visualization in ADEM extends across organization, mobile user, remote site,
application, user, PA locations, and branch sites. ADEM leverages Real User
Monitoring (RUM) data in addition to synthetic metrics for comprehensive root cause
analysis where available. These enhancements empower you to diagnose and resolve
application issues more efficiently.
What's New in June 2025
Evidence-based Verdict in Access Analyzer
The user access issues query in Access Analyzer is enhanced to show focused
insights into user connectivity issues. This enhancement provides new evidence-based verdicts for user access
issues. You can now use two distinct user access issues queries:
- User Issues query- enables you to query new evidence-based verdict on user access attempts directly from logs. The query result displays aggregated Traffic logs for the past seven days for a matched policy rule along with detailed log sessions for the past 3 hours. The logs provide conclusive historical evidence of a user's access attempts. The query result also shows the threat and URL logs for the traffic generated by the user for the past 3 hours.
- User Issues (Check Security Policy Only) query- shows the security policy configuration of the rules that denied user access to the specified application domain.
This enhancement empowers you to generate focused reports that are most
relevant for your investigations.
What's New in May 2025
Review features introduced in the ADEM Access Experience Agent 5.6.
Real User Monitoring (RUM) for Consumer Browsers
Real User Monitoring (RUM) enhances your ability
to monitor and optimize the user experience for web applications. In addition to RUM
support for Prisma® Access Browsers (PAB), RUM capabilities are extended to consumer
browsers such as Google Chrome and Microsoft Edge on managed devices. You can now
collect Core Web Vitals metrics from Chrome and Edge
browsers on Windows and macOS, providing broader visibility into your users'
application experiences.
The feature integrates with your existing ADEM infrastructure, using the
GlobalProtect app for authentication and communication. RUM collects and securely
processes and stores data, respecting data privacy and residency
requirements. Now, with RUM support extending to multiple
browsers, you can configure and manage settings at the tenant level, with options to
exclude specific users, user groups, or domains from monitoring. Visualize metrics
through updated ADEM dashboards, enabling you to
analyze performance trends, identify issues, and make data-driven decisions to
improve application delivery. RUM data can be combined with the existing Synthetic
monitoring for granular root cause analysis of user experience issues.
What's New in April 2025
Review features introduced in the ADEM Access Experience Agent 5.5.
Mobile User and Remote Site Experience Monitoring for NGFWs
Requires:
|
Previously, comprehensive end-to-end visibility into user and application experience
was limited when traffic passed through Next-Generation Firewalls (NGFWs). Autonomous Digital Experience Management (ADEM) now extends its end-to-end application experience and
performance monitoring capabilities beyond the SASE platform to next-generation
firewalls (NGFWs) for a more comprehensive view into your users’ digital
experience.
Now, if you have users connecting to an NGFW with a GlobalProtect®Gateway installed, you can
run synthetic tests from the user's endpoint to the application to gain visibility
into their application experience. User experience to applications with hop by hop
views and segment wise health is visible, allowing you to identify issues and better
target your remediation efforts.
Similarly, if you have an NGFW configured as a branch site using SD-WAN, you can now monitor synthetic
tests from the NGFW branch site to the application and take action upon any signs of
application experience degradation.
If you have both Strata Cloud Manager Pro for Prisma Access and for NGFW, ADEM can detect and report when a user is
connecting to Prisma Access or to an NGFW at a given point in
time so that you can easily pinpoint where an experience issue may be occurring.
This comprehensive experience data is now fully integrated and viewable in Strata
Cloud Manager, streamlining your analysis across your entire hybrid
network.
What's New in March 2025
The following new features were released in April 2025.
Natural Language Queries for Access Analyzer
Requires:
|
Administrators often struggle when manually constructing complex, technical
queries for access analysis, slowing down investigation. Natural language queries for Access
Analyzer solve this by providing a simple interface to construct
queries with ease. The new Access Analyzer workflow in Strata Cloud Manager allows
you to select from predefined example questions. The interface includes dynamic
placeholders you can modify, streamlining the process of inputting specific values
such as usernames, devices, or locations. Ask Access Analyzer queries in Strata
Copilot™ before moving over to the Access Analyzer dashboard to review query
logs.
When utilizing this new functionality, you can use the powerful
capabilities of Access Analyzer more effectively, enabling faster problem
resolution. Coming soon, users will be able to type out the questions fully
themselves. This enhancement aims to increase adoption of the tool among
administrators.
What's New in February 2025
The following new features were released in February 2025.
Access Analyzer: Identity Provider Visibility
| Requires Cloud Identity Engine |
ADEM to solve the challenge of identifying user access blocks caused by
identity provider (IdP) restrictions, enhancing your ability to troubleshoot user
access issues across your SASE environment.
By integrating Access Analyzer's existing capabilities with CIE's ability to collect application authorization information
from IdPs like Azure AD (Entra ID) and Okta, you gain comprehensive visibility into
access control. As an IT administrator, you can quickly determine if a user can't
access an application due to endpoint, network, or application performance
degradations; network policy rules; or IdP blocks.
As part of this integration, you can easily view which user groups lack
access to specific applications, identify the IdP vendor imposing restrictions, and
log into the IdP to grant user access. This can save you time in root cause
analysis, improve your ability to manage access across your organization, and ensure
that your users have appropriate access to the applications they need while
maintaining security standards.
What's New in December 2024
The following new features were released in December 2024.
Specific SD-WAN Path Monitoring
| Requires SD-WAN ION version
6.4.2 or later and ADEM agent 3.4.7 or later If you had synthetic application
tests configured for remote sites before this
change, you must check the configuration of those tests to
ensure that they continue to run as expected. For any
pre-existing application test for remote sites running
ION version 6.4.2 or later:
This does not apply to ION devices running
version 6.4.1 or earlier. For those devices, no matter
what is specified in Application
Entities, the application test will run
as expected. However, if you want to upgrade the device,
make sure to follow the steps above so that you do not
risk test interruption. |
Previously, your synthetic application tests in Autonomous DEM probed all
possible network paths to an application. This often skewed your application
experience scores with irrelevant data from unused paths, making it difficult and
time-consuming to troubleshoot performance issues.
If you have configured Prisma SD-WAN path policy rules for your remote
sites, you can now specify that your synthetic application tests probe a
particular SD-WAN path. This allows you to test the exact path your user traffic
actually follows, eliminating irrelevant data from your analysis.
Focusing on these active paths provides an application experience score that
accurately reflects real-world user experience. This precision helps you resolve
issues faster, make better-informed decisions to improve application performance,
and significantly lower your mean time to resolution.
What's New in October 2024
The following new features were released in October 2024.
Browser-Based Real User Monitoring (RUM)
Real User Monitoring (RUM) uses a browser
plugin to capture live web application performance from the user's perspective. This
helps to reveal user experience issues that synthetic tests may not detect so that
you can have a more complete understanding of user experience across your
organization, take any possible remediation steps, and work to increase user
productivity and satisfaction.
RUM Benefits
- Comprehensive View into User Experience: Gather a new set of metrics to help you understand the full user journey so that you can take the appropriate actions.
- Enhanced Troubleshooting: View real-time application availability, usability, and the performance of underlying dependencies, such as APIs or microservices, enabling quicker and more accurate troubleshooting.
- Faster Remediation: Combine RUM metrics with synthetic metrics to detect a wider range of performance degradation issues, identify root causes, and receive recommended remediation steps.
Simplified App Test Configuration
You can define application tests in ADEM with greater
flexibility and precision to ensure better coverage of all application subdomains
and dynamic services. Previously, App-IDs™ are used to define the
targets for your application tests. This complexity often hindered rapid
troubleshooting of user experience issues. To streamline this process and enhance
coverage, Application tests in ADEM now use top-level domains or IP addresses
instead of reliance on specific App-ID™ tags to define test
targets. When you use a top-level domain as the target of your application test, the
test automatically probes the related subdomains. This approach allows you to
quickly pinpoint if any network or application components related to the subdomains
are causing experience issues for users, simplifies diagnostics, and reduces mean
time to resolution.
Security Profile Visibility on ADEM Access Analyzer
Autonomous DEM (ADEM) Access Analyzer provides automatic monitoring of your SASE
environment. It offers a natural-language query interface for contextual
troubleshooting and what-if analysis to analyze access and connectivity issues in
your SASE environment. Prisma® Access uses Access Analyzer in Strata Cloud Manager
to give you visibility into the security profiles blocking a user's access
to a resource. This feature addresses the challenge of manually searching through
logs to determine if a security policy is the root cause of an issue. When you run a
query in Access Analyzer, the multidomain analysis results pinpoint when a security
profile blocks or hinders traffic. You can use the query results to filter logs by a
specific security profile subtype and enforcement action for immediate context. This
helps you quickly determine if a legitimate real-time threat or a misconfiguration
is blocking the user, so you can restore access or escalate the issue.
The Access Analyzer's multidomain analysis results integrate this capability into
your existing access queries. You can instantly filter logs by security profile
subtype and enforcement action to get the context needed to resolve issues fast.
This focused approach accelerates issue resolution, helping you confirm if a
legitimate real-time threat or a policy misconfiguration is blocking a user.
What's New in September 2024
The following new feature was released in September 2024.
Configure Agent-Based Proxy for ADEM
Learn about the Agent-Based Proxy for ADEM feature and how to configure it. Customers
who choose to use Agent-Based Proxy access in Prisma Access require visibility into
application access through Agent-Based Proxy as well as the performance of
Agent-Based Proxy as an element of Prisma Access' service. With ADEM, Agent-Based
Proxy forwards all internet traffic to Prisma Access and allows for customized
forwarding beyond the scope of PAC based on:
- Destination, user or user group, operating system, or location (static branch egress IPs).
- Branches with dynamic egress IP addresses.
- Geographic locations within the country.
What's New in July 2024
The following new feature was released in July 2024.
Microsoft Teams Integration with ADEM
The integration of Microsoft Teams meeting metrics with ADEM data provides visibility
and root cause analysis to a wide user base, so users can resolve or communicate
possible UCaaS performance issues before they affect end-user experience. The
Microsoft Teams dashboard data correlates with ADEM synthetic data, giving
networking team, UCaaS team, and help desk admins the information they need to
troubleshoot Microsoft Teams calls.
What's New in May 2024
The following improvements were released in May 2024.
ADEM Enhancements in the ADEM 5.1.0 Agent
ADEM Agent is now modularized and called Access Experience. Access Experience can be
used for multiple features based on the license activated, such as ADEM and App
Acceleration. Other enhancements include:
- An agent out-of-band upgrade.
- New Access Experience Agent configuration options for GlobalProtect version
6.3 and above:
- Install—Install the agent on the endpoint.
- Uninstall—Uninstall the agent from the endpoint.
- No Action—Retain the last agent state.
What's New in November 2023
The following new features were released in November 2023.
Comprehensive Visualization of Application Performance for a Suite of
Applications
With the introduction of this feature, administrators will be able to select a single
application test and add all relevant test targets associated with that application
to the application test. Hence they can view your application test metrics as an
aggregated view of all targets, as well as individual test target performance. Since
you can now add multiple test targets to a single application test, you cannot
create multiple tests for that same application. Administrators are offered the
drill down visibility to each test target. For more information, see
Comprehensive Visualization of Application Performance for a Suite of Applications
ADEM support for FedRAMP High
The Federal Risk and Authorization Management Program (FedRAMP) is a United States
government-wide program that provides a standardized approach to security
assessment, authorization, and continuous monitoring for cloud products and services
for government users. Palo Alto Networks has demonstrated FedRAMP compliance.
To ensure FedRAMP High "In Process" compliance, Prisma SASE FedRAMP High In Process introduces support
for additional Prisma SASE apps, add-ons, and certain features.
What's New in September 2023
The following new feature was released in September 2023.
Introducing ADEM APIs
Analyzing ADEM data for real-time application troubleshooting and integrating
granular performance metrics into custom tools often requires complex, manual data
extraction. The ADEM APIs solve this by providing
programmatic access to ADEM data for real-time and historical monitoring of user,
applications, and sites across your deployment. This API capability allows you to
pull metrics related to agent, application and synthetic test results directly for
customized analysis and reporting. Each API endpoint is fully documented with clear
examples illustrating the lines in the API Response code that correspond to the data
visible in the ADEM UI, simplifying the integration and consumption of the data for
automation and custom reporting.
What's New in March 2023
The following new feature was released in March 2023.
ADEM Zoom Integration
ADEM has partnered with Zoom to provide the first per-minute root-cause analysis on
the market. This helps administrators debug, monitor, and proactively identify the
performance issues impacting Zoom users in their organization. To enable this
feature, you will need to purchase a Zoom Quality of Service Subscription (QSS)
license from Zoom. This integration provides minute-by-minute analysis of all the
Zoom calls in a customer's network. See Autonomous DEM Zoom Integration for details
on this feature.
What's New in January 2023
The following new feature was released in January 2023.
Prisma Access Locations Dashboard updated
The following changes have been implemented in the Prisma Access
Locations dashboard:
- New widgets have been added to show all Network Performance and Application Performance metrics monitored for all applications from cloud agents.
- The Map View shows the application distribution data for connected Mobile Users and Remote Sites at that location.
- The left border of the application distribution pop-up that appears when you hover your mouse cursor over a circle in the Map View is color-coded such that it represents the overall status that is lower of the Mobile Users status and Remote Sites status.
- You can filter the data in the dashboard by deployment type.
What’s New in December 2022
The following new feature was released in December 2022.
New Role Available - ADEM Tier 1 Support Role
ADEM provides role-based access control to the IT Administrators. Administrators who
log in with ADEM Tier 1 Support role get read-only access to the ADEM application
only. Refer to
Role-Based Access Control in ADEM
for details.
What’s New in October 2022
The following new feature was released in October 2022.
ADEM Self-Serve
ADEM now offers end-user notifications for issues that they can resolve directly.
With ADEM Self-Serve, when end users experience issues with either application
experience, device usage, WiFi, or internet connectivity, they get a notification on
their desktop. The notification indicates what the issue is and guides them with one
or more possible solutions that they can use to resolve the issue on their own. This
enhances user productivity and has the potential to reduce the number of IT tickets.
Clicking in the notification opens the Application Experience user interface which
provides more details on the issue.
Transition to Prisma SASE Platform
Prisma Access is being transitioned to the Prisma SASE Platform to provide these benefits. As a part of this
transition, you may experience a difference in the steps to access Prisma Access.
What’s New in June 2022
The following new feature was released in June 2022.
Support for Selecting Mobile User Groups
When creating synthetic tests, you now have the option to enable the test on an
individual Mobile User or on a Mobile User group or both. You can enable tests only
on existing groups that are used in security policies. The tests that you enable on
a user group will run on all devices that belong to every single user in that group.
You cannot select only certain devices on which to run the test. If a user is
removed from a user group, the tests will automatically stop running on the user’s
devices. When new users are added to a group, the tests will automatically be run on
the new user’s device(s). The test results can be filtered by individual Mobile
Users or Mobile User groups (only groups currently in test configuration).
The following UI pages have been updated to support this feature:
- New App Test page approached from the
Applications page.Under the Source section, for Mobile Users, a new Custom option has been added which allows you to select either a single Mobile User or a Mobile User group or both.
![]()
- A new filter called Mobile User Groups has been added on
the following pages:
- Settings
- Applications
- Mobile Users
![]()
What’s New in April 2022
The following new feature was released in April 2022.
Mobile User changes
The following UI changes have been made with respect to the Mobile User devices:
- Summary pageThe widget for Experience Score for Top Monitored Mobile User Devices displays a separate card for each of the User/Device combination along with the device and hostname details.
![]()
- Monitored Mobile Users pageMonitored Users are now defined as the unique number of User/Device combination. For example, if 2 users are logged in to 3 devices each, the Devices count will display as 6 and the Users count will display as 2. Likewise, if 2 users are using the same device, the Devices count will display 1 and the Users count will display 2. The Monitored Mobile Users Devices table on the Monitored Mobile Users page displays each User/Device combination as a separate row, hence the user name could be duplicated across multiple rows depending on the number of devices he/she is logged in to.
![]()
- Mobile User Details pageIn the Monitored Mobile Users Devices table on the Monitored Mobile Users page table, when you click on a user who has logged into multiple devices, the ensuing Mobile User Details page lists all devices for the selected user. Each unique User/Device combination is represented in a separate card. You can view the details of only one device at a time by selecting its card. The details in the widgets that follow will be displayed for the device card you select.
![]()
Autonomous DEM Agent Installer Available on the CSP
You can now download the Autonomous DEM agent installation package from the Customer Support Portal. This allows you to upgrade your
ADEM agent without having to upgrade your GlobalProtect app.
You can deploy Autonomous DEM agent that you download from the CSP to your endpoints
using the same methods you would deploy the GlobalProtect app:
- For Windows endpoints, you can obtain the update by navigating to Software Updates in the Customer Support Portal. Search for GlobalProtect Autonomous DEM for Windows64.To deploy the agent to Windows endpoints, use Msiexec or via an MDM.
- For Mac OS X endpoints, you can obtain the update by navigating to Software Updates in the Customer Support Portal. Search for GlobalProtect Autonomous DEM for OS X.To deploy the agent to MacOS endpoints, use the macOS plist or via an MDM.
What’s New in November 2021
The following new feature was released in November 2021.
Support for Remote Sites
ADEM is now natively integrated with Prisma SD-WAN and will deliver exceptional user
experience for Palo Alto Networks Prisma SASE. ADEM for Prisma Access together with
Prisma SD-WAN provide comprehensive visibility into remote site experience by
providing segment wise insights on all WAN paths (active and backup). This helps you
quickly isolate the domains and WAN paths that are experiencing degraded experience
for remote site users and devices.
View the overall experience score of your remote sites in the
Summary tab by selecting the Remote Site
Experience card. The Remote Sites dashboard
provides experience details for each site.
The Remote Sites Experience card in the
Summary tab is visible only if you have purchased the
Service Setup license.
For details on this feature, refer to the Remote Sites dashboard.
What’s New in October 2021
The following new features were released in October
2021.
ADEM for Hybrid Workforce
Optimizing User Experience and application performance across hybrid work
environments on and off campus.
With Autonomous DEM for Hybrid Workforce, regardless of whether Prisma Access
GlobalProtect Mobile Users are connected from an untrusted network or a trusted
network, Autonomous DEM will continue to provide User Experience and Application
Performance Monitoring.
Autonomous DEM can be enabled when GlobalProtect Clients connect to Prisma
Access. Once enabled, it will continue to monitor user experience across
hybrid work environments on and off campus.
For more details on this feature, refer to the First Look at Autonomous DEM
Dashboards.
Disable All Autonomous DEM Update Notifications
Starting in GlobalProtect version 5.2.8, you have the option to suppress receiving
all Autonomous DEM update notification on the Mobile User devices. See
Enable ADEM in Panorama Managed Prisma Access for Mobile Users
or
Enable ADEM in Cloud Managed Prisma Access for Mobile Users for details.