Authorize User Group Mapping in Cloud Identity Engine for Dynamic Privilege Access

From Strata Cloud Manager, open the Cloud Identity Engine app associated with your tenant.
Add an Azure directory or an Okta directory as IdP for mobile users.
Download the SP Metadata in the Cloud Identity Engine app.
Go to
Authentication
Authentication Types
Add New Authentication Type
.
Set Up
a SAML 2.0 authentication type.
Select
Dynamic service provider metadata
.
Download SP Metadata
.
Log in to the Azure Portal and select
Azure Active Directory
.
Make sure you complete all the necessary steps in the Azure portal.
If you have more than one directory,
Switch directory
to select the directory you want to use with the Cloud Identity Engine.
Select
Enterprise applications
and click
New application
.
Search for
Palo Alto Networks Cloud Identity Engine - Cloud Authentication Service
and create the Azure Active Directory (AD) single sign-on integration.
Customize the app name if required while creating the application.
After the application loads, select
Users and groups
, then
Add user/group
to
Assign
them to this application.
Select the users and groups you want to use the Azure IdP in the Cloud Identity Engine for authentication.
Be sure to assign the account you're using so you can test the configuration when it's complete. You may need to refresh the page after adding accounts to successfully complete the test.
Set up single sign-on
then select
SAML
.
Upload Metadata File
by browsing to the metadata file that you downloaded from the Cloud Identity Engine app in step 3.c and click
Add
.
After the metadata uploads, enter your regional endpoint as the
Sign-on URL
using the following format: https://<RegionUrl>.paloaltonetworks.com/sp/acs (where <RegionUrl> is your regional endpoint).
Alternatively, copy the reply URL to the sign on URL.
Save
your configuration.
Configure conditional access policy to enable MFA on selected user groups.
Go to your application's
Overview
Conditional Access
Create a policy
.
Add a
New Policy
.
Enter a name for the policy.
In
Users
section, include
Select users and groups
and choose your project groups accordingly.
Verify the
Target resources
.
Select the
Conditions
that trigger the policy.
Grant
access in
Access Controls
using
Require multifactor authentication
.
Enable the policy by toggling the selector to
On
, and
Create
the conditional access.
Add your IdP vendor as an authentication type.
Select
Single sign-on
SAML Certificates
and copy the
App Federation Metadata URL
.
In the Cloud Identity Engine app, select
Authentication
Authentication Types
Add New Authentication Type
.
Set Up
a SAML 2.0 authentication type.
Under
Configure your Identity Provider Profile
, enter a
Profile Name
.
Select
Azure
as your
IDP Vendor
.
Select
Get URL
, paste the URL from step 5.a, and
Get URL
to get the metadata.
Enable
Multi-factor Authentication is Enabled on the Identity Provider
.
Test SAML Setup
to verify the profile configuration.
Select the SAML attributes you want Prisma Access to use for authentication.
Enable
Dynamic Privilege Access
.
Ensure to sync the directory you added in step 2 and the SAML app.
Submit
the IdP profile.
Repeat steps from 3 to 5 to configure the SAML app for user groups that don't require MFA.
Don't enable MFA in step 5.g for user groups that don't require MFA.
Add an authentication profile for MFA user groups and non-MFA user groups.
Select

Authentication

Authentication Profiles

Add Authentication Profile

.

Enter a

PROFILE NAME

.

Select an

Authentication Mode

.

Select the

Authentication Type

from step 5 or 6, based on the user groups requiring MFA, and

Submit

.
Add the authentication profile from Cloud Identity Engine to Prisma Access.
In Strata Cloud Manager, select

Manage

Configuration

NGFW and Prisma Access

Identity Services

Authentication

Authentication Profiles

.

Ensure to set the configuration scope to the

Access Agent

mobile users container.

Add Profile

.

Select

Cloud Identity Engine

as your

Authentication Method

.

Enter a

Profile Name

.

Select the

Profile

you added in the Cloud Identity Engine app from step 7.

Save

the changes.
Attach the authentication to mobile users.
Launch Prisma Access from your Strata Cloud Manager.
Select
Manage
Configuration
NGFW and Prisma Access
.
Set the scope to the project snippet you created, and navigate to
Security Services
Security Policy
.
Create a policy to allow traffic only from a particular project DHCP range and that project-based user group.