Focus

Cloud NGFW for Azure

Integrate Single Sign-on

Table of Contents

Integrate Single Sign-on

Integrate your organization’s SSO login flow with your Palo Alto Networks Customer Support Portal (CSP) account for your Azure Cloud NGFW subscription.

You can integrate your organization’s SSO login flow with your Palo Alto Networks Customer Support Portal (CSP) account for your Azure Cloud NGFW subscription.

Enable Third Party Identity Provider (IDP)

Enabling a third party identity provider (IDP) in the Customer Support Portal (CSP) allows you to log into the Palo Alto Networks Customer Support Portal (CSP) using your own corporate login credentials. Because you set up IDP at the domain level, members within the domain can log into multiple CSP accounts using corporate SSO login credentials. However, domain administrator accounts
must continue to use Palo Alto Networks login credentials.

To enable third party IDP for your domain:

You must have the domain administrator role in the CSP to configure third-party IDP access for your account.

You must have administrator access on the identity provider to update the SSO configuration details provided by Palo Alto Networks.

You need one non-domain administrator account for verification.

Log into the Azure Portal and search for

Active Directory

In Active Directory, select

Enterprise Application

and select

New Application

Enter the name for your SSO application (for example, panorama-sso) and click

Create

In the

Create your own application window

, select

Integrate any other application you don't find in the gallery (Non-gallery)

Click

Create

In the

Manage

section, click

Single sign-on

Select the

SAML

single sign-on method. The SAML-based sign-on page contains information you need to link your new SSO enterprise application to your Palo Alto Networks CSP account.

In the SAML-based sign-on page, scroll down to locate URLs in the

Set up [your SSO application name]

section. Copy the

Azure AD Identifier

In the CSP, select

Account Management > Account Details

In the

SSO

section, click

View Single Sign-On settings for your domain

Accounts Configuration

, paste the copied

Azure AD identifier

from step 8 into the

Identifier Provider ID

field.

Return to the

SAML-based Sign-on screen

in the Azure portal. Scroll down to locate URLs in the

Set up [your SSO application name]

section. Copy the

Return to the

Accounts Configuration

page in the CSP. Paste the copied

(from the previous step) into the

Identity Provider SSO Service URL

field.

Use the same

Identity Provider SSO Service URL

address for the

Identity Provider Destination URL

field.

Return to the

SAML-based Sign-on

screen in the Azure portal. Scroll down to locate the

SAML Certificates

section.

In the SAML Certificates section, download the

Certificate (Base64)

Return to the

Account Management > Account Details

page in the CSP. Paste the downloaded certificate (from the previous step) into the

Identity Provider Certificate

field.

The

Accounts Configuration

page changes to display

Palo Alto Service Provider Information

. Copy the

Entity ID

URL.

Return to the

SAML-based Sign-on screen

in the Azure portal.

In the

Basic SAML Configuration

screen, click

Edit

In the

Identifier (Entity ID)

field, click

Add Identifier

Paste the Palo Alto Networks

Entity ID

(from step 21) into the

Identifier

field.

Return to the

Account Management > Account Details

page in the CSP. Copy the

ACS URL

Return to the

SAML-based Sign-on screen

in the Azure portal.

In the

Basic SAML Configuration

screen, click

Edit

Enter the ACS URL (copied from step 24) into the

Reply URL (Assertion Consumer Service URL)

Return to the CSP

Accounts Configuration

page. Use the toggle button to

Enable Identity Provider

Click

Save

Return to the Azure Portal. In the

Manage

section of your SSO application, click

Users and groups

Use the

Add user/group

option to enable use of SSO login for each specified user.

Verify SSO Login

After enabling the identity provider, all users (except domain administrators) are forced to login using SSO. To verify that SSO login is setup properly:

Provide an email address on the login page. Do not use domain administrator login credentials.

Verify that you’re redirected to the IDP login page for authentication.

After authentication, the Palo Alto Networks Customer Support Portal page appears.

Integrate SSO with CSP for a non-domain user using Azure Marketplace

To integrate a user with a CSP account using Azure Marketplace:

Azure Services

, select

Cloud NGFWs by Palo Alto Networks

Select the firewall that you want to integrate with your CSP account.

In the

Support + troubleshooting

section, click

New Support Request

. The Palo Alto Networks Support screen appears, displaying the

Tenant ID

and the

Product serial number

Click

On the

Create New Account / Use Existing Account

page, enter your email address and complete the authentication steps, then click

In the

Device Registration

section, select the

Cloud Marketplace

subscription from the drop-down menu. For example, Azure Cloud NGFW
.

Enter the

Tenant ID

and

Serial Number

for your Azure Marketplace subscription. You can copy this information from the Palo Alto Support page from Step 4. Click

Enter the

Authentication code

that was sent to your email address. Click

After authenticating using SSO, the CSP login page appears. Enter your email address and click

Integrate SSO with CSP for a domain user using Azure Marketplace

To integrate a domain user
with a CSP account using Azure Marketplace you’ll need your Palo Alto Networks login credentials:

Azure Services

, select

Cloud NGFWs by Palo Alto Networks

Select the firewall that you want to integrate with your CSP account.

In the

Support + troubleshooting

section, click

New Support Request

. The Palo Alto Networks Support screen appears, displaying the

Tenant ID

and the

Product serial number

Click

On the

Create New Account / Use Existing Account

page, enter your email address and complete the authentication steps, then click

In the

Device Registration

section, select the

Cloud Marketplace

subscription from the drop-down menu. For example, Azure Cloud NGFW
.

Enter the

Tenant ID

and

Serial Number

for your Azure Marketplace subscription. You can copy this information from the Palo Alto Support page from Step 4. Click

Enter the

Authentication code

that was sent to your email address. Click

After authenticating using SSO, the CSP login page appears. Enter your email address and click

Manage Cloud NGFW Roles for Azure Users

Cloud NGFW for Azure Pricing

Cloud NGFW for Azure

Integrate Single Sign-on

Integrate Single Sign-on

Enable Third Party Identity Provider (IDP)

Verify SSO Login

Integrate SSO with CSP for a non-domain user using Azure Marketplace

Integrate SSO with CSP for a domain user using Azure Marketplace

Recommended For You