Starting with PAN-OS version 11.1.0, the default browser selection for SAML authentication is set at the GlobalProtect client authenticaiton level. This setting controls whether the GlobalProtect app uses the device's default browser for the initial SAML or CAS authentication to the portal.

With this feature, you can select the Use Default Browser option to use the device's default web browser (instead of the GlobalProtect embedded browser) to complete the authentication workflow. Follow the steps below to access this option:

• On Panorama, navigate to NetworkGlobalProtectPortals<portal-config>Authentication<client-authentication-config>

• On Strata Cloud Manager, follow the steps below:
  1. Enable the feature flag for Use Default Browser.
  2. Navigate to ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtect

When upgrading from a PAN-OS version earlier than 11.1.0, the system performs a migration check across all existing GlobalProtect agent configurations:

• If any portal agent configuration had the deprecated Use Default Browser for SAML Authentication option enabled, the new portal-wide Use Default Browser option is automatically selected after the upgrade. This is true for both Panorama and Strata Cloud Manager environments.
• If all agent configurations had the setting disabled, the Use Default Browser option will not be enabled.

This scenario shows the result of a mixed configuration after migration.

The pre-upgrade configuration for this scenario is as follows:

Agent portal settings are :

1. Agent-config-windows: Embedded Browser
2. Agent-config-macos: Default Browser
3. Agent-config-default: Default Browser

Client authentication setting: SAML auth - default: os=all, use-default-browser=yes (Default Browser)

After upgrading to PAN-OS 11.2.0 or later, the Use Default Browser option is enabled in the client authentication configuration instead of the in agent-configuration, so all users will start using the default browser.

In order to retain the pre-upgrade behavior, set the client authentication as follows:

These settings will enable Windows users to use the embedded browser for SAML authentication and all other OS users to use the default browser.

If you downgrade the PAN-OS version from 11.1.0 to an earlier version, the Use Default Browser configuration in the client authentication setting will be automatically removed. You must revert to using predeployment registry key/plist settings to manage the browser preference.