Strata Copilot
    Common Services: License Activation, Subscription, & Tenant Management
    : How Product Activation Works
    Focus
    Download PDF
    Focus
    1. Home
    2. Common Services
    3. Common Services: License Activation, Subscription, & Tenant Management
    4. Get Started with Common Services: License Activation, Subscription, Tenant Management, & Product Management
    5. How Product Activation Works
    Download PDF

    Common Services: License Activation, Subscription, & Tenant Management

    How Product Activation Works

    Table of Contents

    How Product Activation Works

    contains details which helps the user to choose appropriate activation flow
    When you purchase a Palo Alto Networks product or subscription, you’ll receive an email with a link you can use to launch the activation workflow and get started. Here’s what to expect.
    Important
    We are rolling out a new, unified activation experience in stages. For supported SASE products, you may see the new activation console now, or you may be directed to use the hub for activation until the update reaches your tenant.
    When the phased rollout is complete, the new activation portal will be supported for all Prisma Access, Prisma Browser, Remote Browser Isolation (RBI), AI Security, CASB, Data Security, SSPM, DLP tenants.
    Check the activation or welcome email in your inbox to determine which activation steps to follow:
    • Activation Using Hub – Use the existing workflow in the Hub and Strata Cloud Manager to activate products, complete onboarding, and manage licenses for tenants that have not yet transitioned to the new activation experience.
      Supported for:Next-Generation Firewall and SD-WAN products
      Prisma Access, Prisma Browser, Remote Browser Isolation (RBI), AI Security, CASB, Data Security, SSPM, DLP tenants might be directed to use the hub for activation, until the new activation console update reaches your tenant. The new unified application experience is currently being released in phases.
    • Activation Using Activation Console – Use the Activation Console to complete product activation and onboarding through the new unified activation workflow for tenants that have already migrated to the updated experience. This workflow applies only to the SASE products that have transitioned to the unified activation experience.
      Supported for: Prisma Access, Prisma Browser, Remote Browser Isolation (RBI), AI Security, CASB, Data Security, SSPM, DLP

    Use the Hub

    Contains instruction to activate a product through hub
    Next-Generation Firewall, SD-WAN, and some SASE products that have not yet transitioned to the new activation experience during the phased rollout will use the existing activation workflow described in this section.

    Activate a License or Subscription for Paid Products

    First-time license activation for paid products is through an email that you receive from Palo Alto Networks regarding. The email contains an activation link. Activating a product from the activation link creates a single tenant where the product is deployed.
    After you activate a product, you have access to Common Services to manage your product from the Activation Console or Strata Cloud Manager. You get assigned the Superuser role to manage your product.

    Single Customer Support Portal Activation Behavior

    See the license activation topics in this guide for details about activating specific products. In general, for a single Customer Support Portal account, certain fields in the activation form are prepopulated for you. Depending on your product, you might be asked to select a region where you want to deploy the product, to select or create Strata Logging Service to store your logs, to select or create a Cloud Identity Engine instance to identify and verify all users across your infrastructure, or to associate devices or appliances.
    • In the activation workflow, the Customer Support Portal account associated with the user is prepopulated if there is only one Customer Support Portal account associated with the user.
    • For the selected Customer Support Portal account, if there is no prior tenant associated, the tenant field is autopopulated with the same name as the Customer Support Portal account.
    • After completing the activation, the user who is activating the first product is added as a superuser on the selected tenant, and can also add other users.
    • The default tenant can't be deleted as long as there are products activated in the tenant.
    • If the user's selected Customer Support Portal account has a previously mapped tenant, and the user activating a license does not have access to that tenant, the user is informed to contact the tenant account admin to request access.

    Multiple Customer Support Portal Activation Behavior

    See the license activation topics in this guide for details about activating specific products. In general, if you have multiple Customer Support Portal accounts, you will select the Customer Support Portal account that you want to use for managing your product. Depending on your product, you might be asked to select a region where you want to deploy the product, to select or create Strata Logging Service to store your logs, to select or create a Cloud Identity Engine instance to identify and verify all users across your infrastructure, or to associate devices or appliances.
    • If there are multiple Customer Support Portal accounts associated with the user activating a license, the user can select a specific Customer Support Portal account.
    • For the selected Customer Support Portal account, if there is no prior tenant associated, the tenant field is autopopulated with a default tenant that has the same name as the Customer Support Portal account name.
    • After completing the activation, the user who is activating the first product is added as a superuser on the selected tenant, and they should be able to add other users.
    • If the selected Customer Support Portal account has a previously mapped tenant, and the user does not have access to that tenant, the user is informed to contact the account admin to request access.
    • If users require a multitenant setup, they are provided with an option to create a new tenant or a child tenant. They can create the hierarchy with the first child in the tenant management page. They can select the child tenant or create a new child tenant from the activation workflow.
    • If multiple tenants exist where products have been previously activated for the Customer Support Portal account, but the user does not have access to those tenants, the user is warned that the product will be activated in a different tenant from where the other services are currently active. The user gets the option to proceed anyway, but is warned that dependent products need to be activated in the same tenant.

    Managed Security Service Provider (MSSP) Activation Behavior

    See the license activation topics in this guide for details about activating specific products. In general, for a Managed Security Service Provider (MSSP), you will select the Customer Support Portal account that you want to use for managing your customers' products. You will create a tenant hierarchy to manage them. Depending on the product, you might be asked to select a region where you want to deploy the product, to select or create Strata Logging Service to store the logs, to select or create a Cloud Identity Engine instance to identify and verify all users across the infrastructure, or to associate devices or appliances.
    After you activate a tenant heirarchy, you have access to Common Services to manage your tenants from the Activation Console or Strata Cloud Manager. You can also use Strata Multitenant Cloud Manager aggregated views for monitoring information across all of your tenants.
    • In the case of managed security service providers (MSSP), the end customers are managed by the MSSP that owns the Customer Support Portal account.
    • The default tenant is associated with the MSSP Customer Support Portal account. The user activating the product must be granted access to that tenant, and then user can create child tenants and activate products in the child tenant.

    Use the New Activation Console

    contains procedure to activate a product using the activation console.
    The new unified activation and onboarding experience is available only for following SASE products that have transitioned to the Activation Console.
    Firewall and SD-WAN products (Next-Generation Firewall and SD-WAN), as well as SASE products that have not yet transitioned, will continue to follow the existing workflow described in Activation Using Hub.
    • Prisma Access
    • Prisma Access Browser
    • Remote Browser Isolation (RBI)
    • AI Security
    • CASB
    • Data Security
    • SSPM
    • DLP

    Activate a Product on a Single Tenant

    Before You Begin
    If the product needs to be activated in a non-default tenant, create the tenant before you begin the activation process
    To activate a product, perform the following:
    The following steps outline the common activation procedure for products. The screenshots shown are based on Prisma Access, but the same workflow applies to all supported products. Detailed, product-specific steps are provided in the respective SASE product documentation.
    1. Click Login to Activate in the welcome email.
    2. This will take you to the Activation ConsoleSubscription and Add-ons, where you can view the list of all your product entitlements. Click Activate to activate a specific product.
    3. You will be taken to the Product activation form.
    4. Select a Tenant if you have multiple tenants. For a single tenant environment, it is autopopulated with the primary tenant.
    5. Select a Region where you want to deploy your product.
    6. Select the product-specific details.
    7. Agree to the terms and conditions, and then click Activate Now.
    8. You will be redirected to the Subscription page, where you can see the activation status. The status column would show Activation in Progress for the products where activation is in progress.
    9. Once the activation is complete, click Launch to launch and access the product.When you launch the product, you will be redirected to the Strata Cloud Manager from where you can access the product and all its activated add-ons.

    Activate a Product on Multiple Tenants

    1. On the Subscriptions page, locate the activated product you wish to manage.
    2. Click ⋮Manage for the required product.
    3. Select the target tenant.
    4. Select a Region nearest to the storage location of the data logs.
    5. Modify the license allocation as needed.
      Note: If you are modifying the allocation for the default tenant, ensure that you reduce the assigned license quantity. The reduced quantity becomes available for reallocation to other tenants in the hierarchy.
    6. Agree to the terms and conditions, and select Activate Now to activate the license on the selected tenant.
    7. Validate the allocation by clicking View Details and hovering over the Tenants to view the license quantity for each tenant.
    8. Repeat from the Step 3 to allocate licenses to additional tenants.
      Validate the license allocation by switching to the corresponding tenant in the tenant browser and reviewing the allocation details.
    After activating your products, you can continue to manage your subscriptions from the Subscriptions & Add-ons page in the Activation Console. This page provides options to perform common subscription management tasks, including activating free add-ons, enabling purchased add-ons, reallocating licenses to other tenants, and renewing existing licenses.

    © 2026 Palo Alto Networks, Inc. All rights reserved.