>
    Strata Copilot
    Switch Between the Prisma Access Agent and GlobalProtect App
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent User Guide
    4. Prisma Access Agent for Desktop Devices
    5. Switch Between the Prisma Access Agent and GlobalProtect App
    Download PDF
    Prisma Access Agent

    Switch Between the Prisma Access Agent and GlobalProtect App

    Table of Contents

    Switch Between the Prisma Access Agent and GlobalProtect App

    You can use either the Prisma Access Agent app or the Prisma Access command-line tool (PACli) to switch between the Prisma Access Agent and the Global Protect app.
    Where Can I Use This?What Do I Need?
    • Prisma Access Agent
    • macOS 14 and later or Windows 10 version 2024 and later desktop devices
    • Internet access
    In some organizations, the Prisma Access Agent is installed on user devices that already have the GlobalProtect app installed. After installing the Prisma Access Agent, you can switch between the Prisma Access Agent and the GlobalProtect app as needed.
    Before switching to the GlobalProtect app, you must disable the Prisma Access Agent app. The following table shows the Prisma Access Agent behavior after disabling the agent and after switching to GlobalProtect.
    Prisma Access Agent BehaviorAfter Disabling Prisma Access AgentAfter Switching to GlobalProtect
    Connectivity to the tunnelNoNo
    Connectivity to the server (Prisma Access Agent management plane)YesYes
    Prisma Access Agent NotificationsNoNo
    Prisma Access Agent enforcerNoNo, but GlobalProtect enforcer is enabled
    ADEM Access Experience statusYes (independent of agent status)Yes (independent of agent status)
    Troubleshooting by remote shellYesYes
    Anti-tamper featureYesYes
    PACli commands functionalYes, but don't use pacli connectYes, but don't use pacli connect
    You can use either the Prisma Access Agent app or the Prisma Access command-line tool (PACli) to switch between the two apps. (Not supported on Prisma Access Agent Linux)

    Switch Between the Prisma Access Agent and GlobalProtect App (Using Prisma Access Agent App)

    Learn how to switch between the Prisma Access Agent and the Global Protect app using the Prisma Access Agent App.
    Before switching to the GlobalProtect™ app, you need to disable the Prisma Access Agent. If your administrator configured the feature to allow users to disable the Prisma Access Agent, you can use the app to disable the Prisma Access Agent. After you disable the Prisma Access Agent, you can start the GlobalProtect app.
    Your administrator must contact the Palo Alto Networks team to enable this tenant-level feature. It's not available as an agent setting on Strata Cloud Manager.
    • To switch from the Prisma Access Agent to the GlobalProtect app:
      1. Open the Prisma Access Agent.
        If you're disabling the agent for the first time, open the Prisma Access Agent app and sign out of the Prisma Access Agent.
        1. Select the hamburger menu and select Sign Out.
        2. Log in to the Prisma Access Agent app again to make the Disable link appear in the preferences window.
      2. Click the hamburger menu to open the preferences window.
      3. Disable the Prisma Access Agent.
      4. Close the preferences window by clicking the X.
        The Prisma Access Agent is disabled.
      5. Start the GlobalProtect app and Connect to GlobalProtect.
    • To switch from the GlobalProtect app back to the Prisma Access Agent:
      1. Open the GlobalProtect app.
      2. Click the options menu and select Disconnect.
      3. Launch the Prisma Access Agent app.
      4. Click the hamburger menu to open the preferences window.
      5. Enable the Prisma Access Agent.
      6. Close the preferences window by clicking the X.
      7. If the agent is in Always On mode, the agent is enabled and will connect to the best location.
        If the agent is in On-Demand mode, the Prisma Access Agent is enabled but remains disconnected. Click the lock icon to connect to the Prisma Access location.

    Switch Between the Prisma Access Agent and GlobalProtect App (Using PACli)

    Learn how to switch between the Prisma Access Agent and the Global Protect app using the command line.
    To switch between the Prisma Access Agent and the GlobalProtect app, run the Prisma Access command-line tool (PACli). When switching to the GlobalProtect app, the PACli tool will prompt you for the anti-tamper unlock password if the administrator set one up during the onboarding of the Prisma Access Agent. Switching to the desired app disables the app that you're currently using.
    1. To switch from the Prisma Access Agent to the GlobalProtect app:
      1. Run the switchto command to switch agents:
        • On macOS devices, open a Terminal window and issue the following command:
          sudo /Applications/Prisma\ Access\ Agent.app/Contents/Helpers/pacli switchto GlobalProtect
        • On Windows devices, open a Command Prompt window and issue the following command:
          "C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" switchto GlobalProtect
      2. (macOS) Enter the admin password when prompted.
      3. If prompted, enter Y to switch to the GlobalProtect app.
      4. If prompted for a supervisor password, enter the anti-tamper unlock password.
        The following text shows an example of switching from the Prisma Access Agent to GlobalProtect on a macOS device:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto GlobalProtect  
Enter supervisor password:
Disabled Prisma Access Agent.
Starting the GlobalProtect service. This can take up to 60 seconds...
Successfuly started GlobalProtect. Switch complete.
<username@hostname> Helpers %
        This action stops the Prisma Access Agent service, and starts the GlobalProtect service. An entry is written to the Prisma Access Agent logs indicating that the Prisma Access Agent has been disabled. For example, the following events are logged:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % ./pacli event
.
.
740      2024-12-11 23:20:57  Tamper Detection   Agent is disabled
741      2024-12-11 23:20:57  Agent Tunnel       Tunnel disconnected
.
.
      5. (Optional) Show the status of the switchto command by running the pacli switchto status command.
        The following text shows an example of checking the status of the switchto command on macOS:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto status
Prisma Access Agent:      Disabled
GlobalProtect:            Enabled
<username@hostname> Helpers %
    2. To switch back to the Prisma Access Agent:
      1. Run the switchto command to switch agents:
        • On macOS devices, open a Terminal window and issue the following command:
          sudo /Applications/Prisma\ Access\ Agent.app/Contents/Helpers/pacli switchto PrismaAccessAgent
        • On Windows devices, open a Command Prompt window and issue the following command:
          "C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" switchto PrismaAccessAgent
      2. (macOS) Enter the admin password when prompted.
      3. If prompted, enter Y to switch to the Prisma Access Agent.
      4. If prompted for a supervisor password, enter the anti-tamper unlock password.
        The following text shows an example of switching from the GlobalProtect app to the Prisma Access Agent on a macOS device:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto PrismaAccessAgent
Password:
Enter supervisor password:
Stopping the GlobalProtect service. This can take up to 60 seconds...
Disabled GlobalProtect.
Successfuly started Prisma Access Agent. Switch complete.
<username@hostname> Helpers %
        This action stops the GlobalProtect service and starts the Prisma Access Agent service. An entry is written to the Prisma Access Agent logs indicating that the Prisma Access Agent has been enabled. For example, the following events are logged:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % ./pacli event
.
.
742      2024-12-11 23:21:05  Tamper Detection   Agent is enabled
743      2024-12-11 23:21:21  Agent Tunnel       Tunnel connected
.
.
        After switching back to the Prisma Access Agent, if the agent is in Always On mode, the agent will be enabled and will connect to the best location. If the agent is in On-Demand mode, the agent will be enabled but disconnected.
      5. (Optional) Show the status of the switchto command by running the pacli switchto status command.
        The following text shows an example of checking the status of the switchto command on macOS:
        <username@hostname> ~ % cd /Applications/Prisma\ Access\ Agent.app/Contents/Helpers
<username@hostname> Helpers % sudo ./pacli switchto status
Prisma Access Agent:      Enabled
GlobalProtect:            Disabled
<username@hostname> Helpers %

    © 2026 Palo Alto Networks, Inc. All rights reserved.