Log in to the Prisma Access Agent

Table of Contents

To securely access applications and resources in your organization's network, you must log in to the Prisma Access Agent.

Where Can I Use This?	What Do I Need?
Prisma Access Agent	macOS 14 and later or Windows 10 version 2024 and later desktop devices Internet access

To access your organization's network, resources, SaaS applications, or the internet, log in to the Prisma Access Agent using your login credentials.

After you log in to the Prisma Access Agent, you’re automatically connected to your network using the best location (sometimes called a gateway). The agent automatically selects the best location to provide you with the best performance to provide a better experience, such as viewing websites in your local language. When your device is outside your organization's network, the agent finds the best location to give you the best performance when connecting to the network.

Before you begin, the Prisma Access Agent must be installed on your device. Typically, your administrator will deploy the Prisma Access Agent to the device that you use to access your organization's network, resources, and applications. The agent is configured according to policy rules defined by your administrator and deployed to your device. However, if your administrator did not deploy the Prisma Access Agent to your device, you will need to manually install the Prisma Access Agent.

Depending on how Prisma Access is set up in your organization, your administrator should provide you with the name of the server that manages your Prisma Access Agent.

Depending on the settings for your operating system, the app icons and app interface can appear in dark mode or light mode.

If your administrator configured the Prisma Access Agent in Always On mode, the Prisma Access Agent starts automatically after the installation and whenever you log in to your device.

If your administrator configured the Prisma Access Agent in On-Demand mode, you need to start the Prisma Access Agent by clicking the Prisma Access Agent icon

from the macOS menu bar or Windows taskbar.
Select the Server Name of the Prisma Access server that your administrator provided and click Connect.

The format of the server name is <xxx>.epm.gpcloudservice.com (without the https:// protocol). The maximum length of the server name is 256 characters.
In the login page that appears in your default web browser, sign in to your organization's single sign-on (SSO) app, such as Okta or Azure Active Directory (AD), by entering your login credentials for your organization.

If your administrator enabled multi-factor authentication (MFA), you’ll need to complete additional verification in the browser when you log in.
When your web browser prompts you, click Open Prisma Access Agent.

(Optional) If you don’t want the browser to prompt you the next time you log in, select Always allow <site> to open these types of links in the associated app, then click Open Prisma Access Agent (if supported by your default web browser).
Wait while Prisma Access Agent connects to Prisma Access.
After successfully logging in, you’re connected automatically to the best available location.

You can now access your organization's resources and SaaS apps, along with secure access to the internet.

If your administrator enabled Always On mode for the Prisma Access Agent, you can’t disconnect from Prisma Access due to your organization's policy. However, you can still change locations.
If your administrator enabled On Demand mode for the Prisma Access Agent, you must click the lock icon to connect to Prisma Access.

If you're using the Prisma Access Browser to securely access your organization's network and resources and to browse the internet, the Prisma Access Browser might prompt you to open the Prisma Access Agent again. This can happen if you leave the Prisma Access Agent authentication tab open in the Prisma Access Browser and then restart the browser and restore all open tabs. This action refreshes the Open Prisma Access Agent browser tab even though your login credentials are still valid and active. Clicking Open won’t affect the state of the agent and you won't have to authenticate to the agent again.