Use the Prisma Agent App (Managed Devices) iOS

1. Open the Prisma Agent app by tapping the Prisma Agent app icon (

   ).

2. If this is your first time opening the app, the app opens to the home page with the connect button. When prompted, enter the project name your administrator provides.

   1. Enter the project name your administrator provided and tap Continue.

      The project name is case-sensitive and can be up to 32 characters. After your first login, the app displays your authorized projects as a list so you can select rather than type.

   2. Authenticate with your organization credentials when prompted.
3. The agent gets connected based on the connect method configured by your Prisma Agent administrator. Prisma Agent supports the following connect methods:

   • Always-On
     In an Always-On configuration, Prisma Agent automatically connects as soon as you log in.
   • On-Demand
     In an on-demand configuration, you must manually connect Prisma Agent through the application. Traffic is routed through the Prisma Agent app only after you initiate and establish the connection.
   • Automatic Configuration
     • Per-App
       In a per-app configuration, your administrator can configure the managed apps that will route traffic through Prisma Agent. When you access the managed app, Prisma Agent will automatically connect and only traffic for the managed apps your administrator has configured under the configuration profile will be routed through Prisma Agent.
     • On-Demand Connect Rules
       In an on-demand connect rules configuration, while you can manually initiate a connection to the Prisma Agent, administrators can also configure Prisma Agent to connect automatically when you access a specific domain.

   Configurations for the agent will be pushed to your device based on the project you are assigned to.

   After a first-time installation, the Prisma Agent does not automatically connect to Prisma Access, even if your administrator configured Always On mode. You must log in to complete your initial enrollment, which includes entering the project name your administrator provides.

   After this first login, Always On mode takes effect and the agent connects automatically on subsequent logins.

   If you're unable to connect and need to share logs with your IT administrator, tap ? in the top-right corner of the enrollment page. This opens a share sheet with a log archive that you can share via AirDrop, Messages, Mail, or other apps.

4. If your agent is always-on, you'll receive a notification to authenticate with your identity provider.

   Your administrator controls which notifications you receive. You can view and manage your notification settings in Notification Controls.

   1. Tap the notification to proceed.
   2. Enter your organization credentials to authenticate to the app:

      If your administrator configured Prisma Agent to use the default system browser for SAML authentication, your default browser — such as Safari — opens instead of the embedded browser. After you authenticate, tap Open in the prompt that appears to return to the Prisma Agent app.

5. If your agent is on-demand, manually connect to the agent.

   1. Connect by clicking the lock icon.

   2. Enter your organization credentials to authenticate to the app.

      If your administrator configured Prisma Agent to use the default system browser for SAML authentication, your default browser — such as Safari — opens instead of the embedded browser. After you authenticate, tap Open in the prompt that appears to return to the Prisma Agent app.

6. After authentication is complete, the connection is established and the app displays the status as Connected.

7. When using Prisma Agents configured for per-app deployment, you will receive a notification if you connect to a network that requires captive portal authentication, such as public Wi-Fi at hotels, cafes, or airports.

   1. Tap on the notification to proceed.
   2. The captive portal login page will appear in the embedded browser. Enter your credentials or accept the terms of service as required by the network provider. For example:

   After you connect the app, the app displays the VPN icon on the screen.

8. For Prisma Agents agents with on-demand or per-app configurations, tap Disconnect on the app when you no longer need to access the resources through Prisma Agent.

   For Prisma Agents with always-on configurations, you won't be able to disconnect the agent: