Cloud Management

Visit the EDL Hosting Service and identify the Feed URL for your SaaS application.
Review the Microsoft 365 documentation for more information which Feed URL is best for your use case. Additionally, consider the SaaS application and location of users accessing the SaaS application when identifying a Feed URL to use. For example, if you have a branch in Germany that only needs to access Exchange Online, select a Feed URL from the
Service Area: Exchange Online
for
Germany
.
(
Best Practices
) Create a certificate profile to authenticate the EDL Hosting Service.
Download the GlobalSign Root R1 certificate.

Convert the GlobalSign Root R1 Certificate to PEM Format.

Import the GlobalSign Root R1 certificate from Cloud Managed

Prisma Access

.

In

Prisma Access (Managed by Strata Cloud Manager)

, go to

Manage

Configuration

Objects

Certificate Management

, set the scope to

Explicit Proxy

, and

Import

a new certificate.

If you're using Strata Cloud Manager, go to

Manage

Configuration

NGFW and

Prisma Access

Objects

Certificate Management

, set the configuration scope to

Prisma Access

Mobile Users Container

Explicit Proxy

, and

Import

a new certificate.



Enter a descriptive

Certificate Name

.

For the

Certificate File

, select

Choose File

and select the certificate you converted in the previous step.

For the file

Format

, select

Base64 Encoded Certificate (PEM)

.

Save

your changes.



Create a certificate authority (CA) certificate profile.

Add Profile
in the
Certificate Profiles
area.

Enter a descriptive
Name
.
For the
CA Certificate
,
Add
the certificate you imported in the previous step.
Save
your changes.


Create an EDL using a Feed URL from the EDL Hosting Service.
Go to
Manage
Configuration
Objects
External Dynamic Lists
and
Add External Dynamic List
, making sure that the scope is still set to
Explicit Proxy
.
If you're using Strata Cloud Manager, go to
Manage
Configuration
NGFW and
Prisma Access
Objects
External Dynamic Lists
and
Add External Dynamic List
. Set the configuration scope to
Prisma Access
Mobile Users Container
Explicit Proxy
.
Enter a descriptive
Name
for the EDL.
Select a
Type
of
URL List
.
(
Optional
) Enter a
Description for the EDL
Enter the Feed URL as the EDL
Source
.
Enforce all endpoints within a specific Feed URL. Adding an excluding a specific endpoint from a Feed URL can cause connectivity issues to the SaaS application.
(
Best Practices
) Select the
Certificate Profile
you created in the previous step.
Specify the frequency the firewall should
Check for updates
to match the update frequency of the Feed URL.
For example, if the Feed URL is updated daily by Palo Alto Networks then configure the EDL to check for updates
Daily
.
Palo Alto Networks displays the update frequency for each Feed URL in the EDL Hosting Service. Feed URLs are automatically updated with any new endpoints.
Save
your changes.

Add a decryption policy to prevent decryption for the EDL Feed URLs.
Select

Manage

Configuration

Decryption

, set the scope to

Explicit Proxy

, and

Add Rule

.

If you're using Strata Cloud Manager, go to

Manage

Configuration

NGFW and

Prisma Access

Security Services

Decryption

and

Add Rule

. Set the configuration scope to

Prisma Access

Mobile Users Container

Explicit Proxy

.



Enter a descriptive

Name

for the policy.

In the

Services and URLs

area,

Add External Dynamic Lists

and specify the EDL you created in an earlier step.

Select an

Action and Advanced Inspection

of

Do Not Decrypt

.


Add a security policy rule to allow traffic from the EDL Feed URLs.
Select

Manage

Configuration

Decryption

, making sure that the scope is set to

Explicit Proxy

, and

Add Rule

.

If you're using Strata Cloud Manager, go to

Manage

Configuration

NGFW and

Prisma Access

Security Services

Decryption

and

Add Rule

. Set the configuration scope to

Prisma Access

Mobile Users Container

Explicit Proxy

.

Enter a descriptive

Name

for the policy.

In the

URL Category Entities

area,

Add External Dynamic Lists

and specify the EDL you created in an earlier step.

Select an

Action and Advanced Inspection

of

Allow

.


Push Config
to save your changes to
Prisma Access
.