Configure Microsoft Azure Active Directory IP-Based Enforcement

Configure the Prisma Access Browser Application Enforcement IP Addresses

1. Create a new Named Location from the Azure Active Directory Admin Center.

   1. Search for the Named Locations from the Admin Center. If available, select the New and improved Named Location.

   2. Click IP range location.

   3. In the New Location <IP> Ranges section, enter the name of the Prisma Access Browser IP Range.
   4. Paste the egress IP Addresses into a text file.
   5. Upload the file.

   6. Click Create.
   7. Confirm that the new Named Location appears on the list.

2. Select Applications and User Groups to Adhere to Policy

   1. Navigate to the Azure Conditional Access Portal.
   2. Select New Policy → Create New Policy , and enter the following information:

      • Name - Enter a name. For example, Block access not from Prisma Access Browser.
      • Assignments - Assign the policy to users or groups. Be sure to include all users who need to connect to applications using the Prisma Access Browser only.
      • Target Resources - Make sure that the Control access includes cloud apps.
      • Conditions - Apply any needed conditions. Include at least one local condition.
      • Grant - Select Block access.
      • Cloud apps or actions - Select Cloud apps, then include selected applications.

      The Prisma Access Browser can't be a required application for enforcement.

      If you select All apps, be sure to exclude the Prisma Access Browser.

      • Enable policy - Set this to On.
   3. Click Create.

3. Enable IdP Enforcement in the Prisma Access Console

   1. In the Strata Cloud Manager, navigate to Workflows → Prisma Access Setup → Prisma Access Browser.
   2. In the Prisma Access Browser Setup page, click Step 4: Enforce SSO Applications.
   3. Select the appropriate IdP. In this case, click Microsoft Azure Active Directory.

      From this point on, users will only be able to access the SSO applications via the Prisma Access Browser

Configure OneLogin IP-Based Enforcement

1. Configure the Prisma Access Browser Application Enforcement IP Addresses

   1. In the OneLogin toolbar go to Security -> Policy .
   2. Click New App Policy.

   3. Enter a name to identify the policy. For example, Enforce Access from the Prisma Access Browser only.
   4. In the IP Address Whitelist, copy and paste the egress IP Addresses.
   5. Click Save.
2. Click Select Applications and User Groups to Adhere to Policy

   1. On the OneLogin toolbar go to Application → Applications.
   2. Click Add App.

   3. In the Found Applications field. search for the application that you need to add.
   4. Click Save.
   5. Select Access.
   6. In the drop down before the Policy Title, select Enforce Access from the Prisma Access Browser only.
   7. Repeat steps b-f for each application that you want to add enforcement access.

      The Prisma Access Browser can't be a required application for enforcement.
   8. Select Users.
   9. Select the Users or Groups that must adhere to the Enforce Access from the Prisma Access Browser only policy.

3. Enable IdP Enforcement in the Prisma Access Console

   1. In the Strata Cloud Manager, navigate to Workflows → Prisma Access Setup → Prisma Access Browser.
   2. In the Prisma Access Browser Setup page, click Step 4: Enforce SSO Applications.
   3. Select the appropriate IdP. In this case, click OneLogin.

      From this point on, users will only be able to access the SSO applications via the Prisma Access Browser

Configure PingOne IP Based Enforcement

1. Configure the Prisma Access Browser Application Enforcement. In the PingOne Admin Console, perform the following steps:

   1. Select Connection → Application, select the Prisma Access Browser application, and click the vertical ellipse.

   2. Click View.

   3. Select the Policy Rules tab and click the pencil icon.
   4. Click Add Policy Rules.
   5. In the Edit Policies window, select Multi_Factor, and click Save.

   6. Select Overview and click PingID.

      1. Click on the Services + and add the PingID service.

      2. Click on PingID and continue the process.

      3. Select the Policy tab and click Add Policy.

   7. In the New Policy page, enter the following information:

      1. In the Name field, enter an identifying name.
      2. In the Application section, select the applications that you want to apply conditional access enforcement.
      3. In the Groups section, select All Groups.

      4. If an application does not appear on the list:

      1. Make sure that the application has multi-factor authentication enabled.
      2. Under PingFederate Applications, click Add Application to add the application to the list.
   8. In the Rules section, click Add Rule.

      1. For Select a Condition, choose Accessing from a company network.

      2. For Action select Approve.
      3. For the IP addresses, manually copy and paste the egress IP addresses as comma-separated-values.
      4. In the Default Action section, choose Deny.
      5. Click Save.
   9. Click the Configuration tab and scroll down to the Policy section.

      1. Enable Enforce Policy.
      2. Enable Policy for Windows Login.
      3. Click Save.

2. Enable IdP Enforcement in the Prisma Access Console

   1. In the Strata Cloud Manager, navigate to Workflows → Prisma Access Setup → Prisma Access Browser.
   2. In the Prisma Access Browser Setup page, click Step 4: Enforce SSO Applications.
   3. Select the appropriate IdP. In this case, click PingOne.

      From this point on, users will only be able to access the SSO applications via the Prisma Access Browser

Configure JumpCloud Based IP Enforcement

1. Configure the Prisma Access Browser Application Enforcement. In the JumpCloud Admin Portal, perform the following steps:

   1. Select Security Management -> Conditional Lists and click the +.

   2. In the New IP List, enter the following information:

      1. List Name - Prisma Access Authentication Proxy.
      2. Description - Enter an optional description for the list.
      3. IP Addresses - Enter the list of egress IP addresses.

      Click Save.

      A message will display indicating that the list was created.

   3. Select Security Management -> Conditional Policies and click the +.

   4. Click User Portal.

   5. In the General Info section, enter the following information:

      • Policy Name - Enter a name for the policy, for example - Allow access only from the Prisma Access Browser.
      • Description - Enter an optional description.
      • Policy Status - Make sure that this is set to 'On'.

   6. In the Assignments section, click All Users or Select User Groups.

      Admins can select All Users or individual user groups. Additionally, admins can select groups that are to be excluded from the policy.

      For example, the policy can be applied to all users, but the admins can be excluded.
   7. In the Conditions section, do the following:

      • Click Add conditions and select IP addresses.
      • IP address: Select not on list, and for the list - select Prisma Access Authentication Proxy.
   8. In the Action section, enter the following information:

      • For Access, select Denied.
      • For Authentication, select based on your corporate policy.

2. Enable IdP Enforcement in the Prisma Access Console

   1. In the Strata Cloud Manager, navigate to Workflows → Prisma Access Setup → Prisma Access Browser.
   2. In the Prisma Access Browser Setup page, click Step 4: Enforce SSO Applications.
   3. Select the appropriate IdP. In this case, click JumpCloud.

      From this point on, users will only be able to access the SSO applications via the Prisma Access Browser

Configure VMware Workspace ONE IP Based Enforcement

1. Configure the Prisma Access Browser Application Enforcement. In the Main Access Portal page, perform the following steps:

   1. On the main Access Portal page, select Resources -> Policies, and click Network Ranges.

   2. Click Add Network Range.

   3. Enter a Name and Description for the Network Range.
   4. manualle enter each row of the egress IP addresses.

      The values must be entered as "from -to" without including the subnet mask.

   5. Click Save. The new Network Range will be added to the list.
2. Select Applications and User Group to Adhere to Policy

   1. On the main Access Portal page, select Resources -> Policies, and click Add Policy.

   2. On the Definition page, enter a name and a description for the Policy.
   3. Select the relevant application in the Applies to field.

      The Prisma Access Browser cannot be a required application for enforcement.
   4. Click Next.
   5. On the Configuration page, click Add Policy Rule, and provide the following information:

      1. If a user's network range is - Select the Range Name defined in the previous step.If a user's network range is – Select the Range Name defined in the previous step.
      2. and the user accessing content from – All Device Types.
      3. and the user belongs to a group – Select the affected group (optional).
      4. Then perform this action – Authenticate using…
      5. then the user may authenticate using – Password (Local Directory)

   6. Click Save. The new policy will be displayed,
   7. Click Next and review the New Access Policy Summary.
   8. Click Save. The new policy will be added to the policy list.
3. Enable IdP Enforcement in the Prisma Access Console

   1. In the Strata Cloud Manager, navigate to Workflows → Prisma Access Setup → Prisma Access Browser.
   2. In the Prisma Access Browser Setup page, click Step 4: Enforce SSO Applications.
   3. Select the appropriate IdP. In this case, click VMware Workspace ONE.

      From this point on, users will only be able to access the SSO applications via the Prisma Access Browser.