| Where Can I Use This? | What Do I Need? |
|---|
- Strata Cloud Manager
- Prisma Browser standalone
|
- Prisma Access with Prisma Browser bundle
license
- Superuser or Prisma Browser
role
|
Use sign-in rules to determine which users and devices have access to Prisma Browser. The Sign-in rules page displays information about existing
sign-in rules:
To view the rules:
The last rule on the
list is the
Default rule.
The Default rule is the policy rule that is used
when no other policy rule is applicable. Since this rule must be available for
any given user or device, only certain controls can be edited.
- Priority—The priority order for rule enforcement.
- Mode—Indicates whether the rule is active or disabled.
- Name—Identifies and describes the rule.
- Users—The users and user groups associated the each rule.
- Device groups—The device group associated the each rule.
- Network & Location—The specific networks and geolocations associated
with the rule.
- Action—The action Prisma Browser takes for users and devices matching
the rule: Allow, Block, or
Prompt the user.
- Updated—Last updated date for the rule; hover to see the full
timestamp.
When you create a sign-in rule, you define the scope of the rule. When a user
attempts to access Prisma Browser, the browser compares the scope of the rules
in order until it finds a rule match for the user or device or network or
geolocation, and then it enforces the corresponding access rule. In some cases, you
may want the sign-in rules you define to block Prisma Browser if they match the
scope of the rule. For example, suppose the scope of the rule is set to match a
device group for devices with a specific OS and you don’t want to allow access to
devices that are still running that OS. In that case, you would set the sign-in rule
to block access for users who match to it. In other cases, you might want to allow
users who match the sign-in rule access to Prisma Browser. For example, suppose
the scope of the rule allows users in a specific user group and in a device group
that only allows devices running a specific OS version, a specific client
certificate, and has active endpoint protection. In this case, you might want the
matching sign-in rule to allow access to Prisma Browser. The way you create your
user groups and device groups (including the corresponding device posture rules you
enforce at the device group level) informs how you will want to create your sign-in
rules.
When a user attempts to access the browser, Prisma Browser
evaluates the sign-in rules in top-down order until it finds a match for the user
and device and then it enforces the corresponding sign-in rule. If the user or
device don’t match any of the defined sign-in rules, Prisma Browser enforces the
Default sign-in rule allow rule.
There are two
ways to create sign-in rules: one for managed devices and one for unmanaged devices,
as described in the following sections.
