>
    Strata Copilot
    Configure Windows Hello for Business Authentication for Prisma Access Agent
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent Administration
    4. Deploy the Prisma Access Agent
    5. Configure Single Sign-On for Prisma Access Agent
    6. Configure Windows Hello for Business Authentication for Prisma Access Agent
    Download PDF
    Prisma Access Agent

    Configure Windows Hello for Business Authentication for Prisma Access Agent

    Table of Contents

    Configure Windows Hello for Business Authentication for Prisma Access Agent

    Configure your environment to use Windows Hello for Business authentication with Prisma Access Agent.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • Minimum Prisma Access Agent version: 26.1
    • Windows Hello for Business enabled
    • Microsoft Entra ID-joined Windows 10 version 2024 or later devices
    • Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature
    To enable Windows Hello for Business authentication with Prisma Access Agent, you need to properly configure both your Microsoft Entra ID environment and Cloud Identity Engine. This procedure guides you through the necessary steps to set up this integration.
    Once configured, Prisma Access Agent will automatically detect the availability of Primary Refresh Tokens on your users' devices and leverage Windows Hello for Business authentication methods. Users will be able to authenticate using their configured personal identification number (PIN) or biometric methods without additional web-based authentication steps.
    Single sign-on with Windows Hello for Business is supported with either the Prisma Access Agent embedded browser or the default system browser for SAML authentication. You can configure the agent settings to suppress the embedded browser so that it won't appear.
    1. Configure Microsft Entra ID and Windows Hello for Business.
      1. Connect your Windows systems to Microsoft Entra ID.
        This enables Entra to manage authentication policy rules for your devices. Consult Microsoft's documentation for detailed procedures on joining devices to Microsoft Entra.
      2. Configure Windows Hello for Business policy rules in Microsoft Entra ID.
        Set up policy rules that enforce PIN requirements, biometric authentication methods (facial recognition, fingerprint), and other security settings according to your organization's requirements.
      3. Preconfigure end-user devices with Windows Hello for Business.
        Ensure your users have registered their biometric data or created PINs according to your organization's policy rules. This step is crucial for enabling Primary Refresh Token generation on user devices.
    2. Configure Cloud Identity Engine.
      1. Configure Entra ID as an identity provider (IdP) in Cloud Identity Engine. Create a Security Assertion Markup Language (SAML) 2.0 authentication type for Azure type and configure the SAML settings to integrate with your Azure AD environment.
      2. Set up an authentication profile and associate the profile with the Azure authentication type you created.
    3. Check the user authentication and app configuration for Prisma Access Agent.
      1. Set up user authentication for Prisma Access Agent using SAML with Cloud Identity Engine.
      2. In the User Authentication section, make sure the configured authentication type is SAML.
        For example, on Strata Cloud Manager Managed Prisma Access:
      3. In the App Configuration section, make sure the Connect method is set to Always On.
      4. (Optional) To prevent the Prisma Acesss Agent embedded browser from appearing during single sign-on, select Show Advanced OptionsAuthentication and enable Use Single Sign-on (Windows).
      5. Go to ConfigurationConfigure NGFW and Prisma Access and make sure the authentication profile mapped in the SAML user authentication is mapped to the Azure AD or Entra ID as the IdP.
    4. If you made any changes, save and push the configuration.
      Your Entra ID-joined users can now log in to their Windows devices with their PIN or biometric method and see that Prisma Access Agent is in the connected state.

    © 2026 Palo Alto Networks, Inc. All rights reserved.