>
    Strata Copilot
    Activate Next-Generation CASB for Prisma Access and NGFW (CASB-X)
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Activation & Onboarding
    4. Activate Next-Generation CASB for Prisma Access and NGFW (CASB-X)
    Download PDF
    Enterprise DLP

    Activate Next-Generation CASB for Prisma Access and NGFW (CASB-X)

    Table of Contents

    Activate Next-Generation CASB for Prisma Access and NGFW (CASB-X)

    Activate Next-Generation CASB for Prisma Access and NGFW (CASB-X) for a single or multiple customer support tenants.
    Important
    Palo Alto Networks is rolling out a new, unified activation experience in stages. For supported SASE products, you might see the new activation console now, or you maybe directed to use the Hub for activation until the update reaches your tenant.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Browser
    • Customer Support Portal (CSP) account
    • Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
    • Strata Logging Service required for SaaS Security Inline but you can CASB-X without it
    Activate the Next-Generation CASB for Prisma Access and NGFW (CASB-X) license to get access to the following data security cloud services offered by Palo Alto Networks for your NGFW and Prisma Access tenants:
    • AI Access Security™
    • Enterprise Data Loss Prevention (E-DLP)
    • SaaS Security—Data Security (SaaS API), SaaS Security Inline, SaaS Security Posture Management (SSPM), and Behavior Threats.
    • SaaS Agent Security
    Before you can successfully activate the CASB-X license, you must have at least one Prisma Access tenant or NGFW associated with your Customer Support Portal (CSP) account.
    You receive an email from Palo Alto Networks after purchasing your CASB-X license. Click Login to Activate in the email to activate the license for one of the following use cases:
    • First Time Activation - Single Tenant—Create a new tenant for a single CSP account and activate the CASB-X license.
    • First Time Activation - Multi-CSP and Multitenant—Create a multitenant hierarchy and activate the CASB-X license for one or more newly created subtenants when your account has access to multiple CSP accounts.
    • Return Visit Activation—Activate the CASB-X license for an existing single tenant or multitenant CSP account. Also applies when you transition from a single tenant CSP to a multitenant CSP and if want to activate CASB-X for a newly added tenant.
    You cannot activate CASB-X if you already have the CASB add-on bundle, or the add-ons associated with the bundle, activated on your tenant. You cannot activate CASB-X if you do not have Strata Logging Service activated on your tenant.
    To convert a trial SaaS Security license to a production license, see convert trial license to production.

    Activate CASB-X For a Single Customer Support Portal Account Tenant

    Activate the Next-Generation CASB for Prisma Access and NGFW (CASB-X) license for the first time for a single tenant Customer Support Portal (CSP) account with a single tenant.
    1. Associate Prisma Access or NGFW with your CSP account.
      You must have at least one Prisma Access tenant or NGFW associated with your CSP account to successfully activate the CASB-X license.
    2. Allocate the product to the Recipient of your choice.
      1. The name provided matches your CSP account for convenience. You can use the name provided or change it.
    3. Select a Region where you want to deploy your product.
    4. The web interface shows if you have Prisma Access and NGFW available in this tenant where you can apply CASB-X.
    5. Agree to the terms and conditions, and Activate.
      A single default tenant is autocreated behind the scenes, and the product is activated in the tenant.
      This tenant, and any others created by this CSP account, have the Superuser role created by default.
    6. CASB-X activation is now complete for Prisma Access. To apply CASB-X on NGFW, you must go to the Device Association tab to select the devices and apply the CASB-X license:

    Activate CASB-X For a Multi-CSP and Multitenant Customer Support Portal Account

    Activate the Next-Generation CASB for Prisma Access and NGFW (CASB-X) for a newly created a multitenant hierarchy when your account has access to multiple Customer Support Portal (CSP) accounts.
    1. Associate Prisma Access or NGFW with your CSP account.
      You must have at least one Prisma Access tenant or NGFW associated with your CSP account to successfully activate the CASB-X license.
    2. Allocate the product to the Recipient of your choice.
      You can allocate your entire license to one recipient or you can share it with multiple recipients in a tenant hierarchy. What is a tenant?
      1. If you need just one tenant, use or rename the tenant provided. The name provided matches your Customer Support Portal account for convenience.
      2. (Optional) This step applies if you are a managed security service provider (MSSP), a distributed enterprise customer, or need multiple tenants. After you create the first tenant, you can Allocate to subtenant and use or rename the tenant provided.
        A subscription gets allocated on a tenant or a sub-tenant. This step is for choosing a tenant where you want to allocate a license, not for building a complete tenant hierarchy. You can create only a tenant and subtenant here, and you can choose to allocate a license to that subtenant.
        After activation, you can build out your tenant hierarchy as needed through tenant management. You can create your tenant hierarchy to reflect your existing organizational structure. You can also consider identity and access inheritance when creating the hierarchy, in addition to tenant hierarchy limits.
      3. Select Done.
    3. Select a Region where you want to deploy your product.
    4. The web interface shows if you have Prisma Access and NGFW available in this tenant where you can apply CASB-X.
    5. Agree to the terms and conditions, and Activate.
      This tenant, and any others created by this CSP account, have the Superuser role created by default.
    6. CASB-X activation is now complete for Prisma Access. To apply CASB-X on NGFW, you must go to the Device Association tab to select the devices and apply the CASB-X license:

    Return Visit CASB-X Activation

    Learn how to activate the Next-Generation CASB for Prisma Access and NGFW (CASB-X) license for an existing single tenant or multitenant Customer Support Portal (CSP) account.
    1. Select a Recipient tenant or subtenant.
      You can hover over each tenant to see if the tenant or subtenant already has an active CASB-X license.
    2. Verify the correct Region displays. This selection is based off the selected tenant or subtenant.
    3. Review the Assign Licenses section to review any additional data security licenses included with your the CASB-X license and whether you have Prisma Access tenants and NGFW available to which you can apply the CASB-X license.
    4. For the Data Loss Prevention tenant, select None.
      Selecting None creates a new Enterprise DLP tenant. If you have already activated a trial or EVAL license, you must create a new production Enterprise DLP.
    5. Agree to the terms and conditions, and Activate.
    6. You successfully activated the CASB-X license. You must now apply the CASB-X licenses to your Prisma Access tenants or NGFW to begin your new data security services.

    © 2026 Palo Alto Networks, Inc. All rights reserved.