Set the Identity Provider Login Control

Prisma Browser Desktop	Prisma Browser Extension	Prisma Browser for Mobile
Full support	Full support	Not available

The Identity Provider Login control allows administrators to govern SAML-based SSO authentication through enterprise identity providers. When a user attempts to authenticate through an identity provider such as Okta, Entra ID, Ping Identity, or Google Workspace, the Prisma Browser intercepts the SAML response and enforces the configured policy.

This control supports four enforcement modes, enabling administrators to allow or block login through all identity providers, or target specific providers by domain. The control is configured within the Access & Data policy rule wizard under Login ControlsIdentity Provider.

To set the Identity Provider Login control:

1. From Strata Cloud Manager, select PolicyRulesAccess & Data.
2. Select a rule and navigate to Login ControlsIdentity Provider.
3. Select one of the following options:

   • Allow - The Prisma Browser allows login with any corporate identity provider.
   • Block - The Prisma Browser blocks login with all corporate identity providers.
   • Allow specific Identity providers - Only login with the specified identity providers is allowed. Login with all other identity providers is blocked.
   • Block specific Identity providers - Login with the specified identity providers is blocked. Login with all other identity providers is allowed.
4. (Allow Specific / Block Specific only) Specify the identity provider domains to allow or block.

   Enter the domain of the identity provider (for example, login.microsoftonline.com or company.okta.com). Each domain must be a valid domain name.
5. (Optional) Set prompt behavior. Select one of the following options:

   • None - No prompt is displayed. The login is blocked without user recourse.
   • Warn and allow to proceed anyway - Inform the user about the restriction and allow the user to continue.
   • Warn and allow to proceed anyway with a reason - Inform the user about the restriction. The user must provide a reason to continue.
   • Permission request - Allow the user to send a permission request to the administrator. Once approved or denied, the user is notified.

   When a prompt option is selected, configure the bypass timeframe. Select how long the bypass remains active after the user proceeds or receives approval.

   The Prompt option is not available when the effect is set to "Allow".
6. (Optional) Customize dialog text. Configure the message displayed when the user is blocked:

   • Title (required if customizing) - The heading shown on the block page.
   • Description (optional) - Additional context for the user.
   • External link (optional) - A URL and label pointing to relevant documentation or resources.

   If no custom dialog text is configured, the default message is displayed:

   • Title: "You are not allowed to log in"
   • Description: "Logging into this site is prohibited to prevent sensitive data from leaving the organization."
7. Click Set.