>
    Strata Copilot
    Define Permissions for Accessing Secure Agentless Access Apps
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Secure Agentless Access
    5. Define Permissions for Accessing Secure Agentless Access Apps
    Download PDF
    Prisma Access

    Define Permissions for Accessing Secure Agentless Access Apps

    Table of Contents

    Define Permissions for Accessing Secure Agentless Access Apps

    Configure the permissions users and user groups need to access certain apps in the Secure Agentless Access portal.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access 5.2.1
    • Minimum Prisma Access dataplane version: 11.2.4
    • Prisma Access license with a Mobile User subscription
    • Secure Agentless Access add-on license
    By default, no users can access any of the apps that you set up for Secure Agentless Access (SAA). You will need to explicitly grant permissions to the users or user groups to define who has access to which apps.
    To define the permissions, you must:
    • Define the SAA policy rules that identify which users or user groups have access to which apps
    • Define a Security policy rule on the GlobalProtect gateway (Mobile User Security Processing Node (MU-SPN)) to allow traffic from a set of users or user groups to a set of destinations
    To set up the permissions to enable SAA app access:
    1. Configure app policies for SAA.
      1. Go to ConfigurationSecure Agentless AccessPortal.
        The SAA Policies table shows the policies that have been set up.
      2. Add a policy.
      3. Enter a meaningful Name for the SAA policy.
        By default, the new policy is Enabled. If needed, you can disable it later in the App Policies table.
      4. Specify the match criteria that define which users and user groups have access to which apps.
        1. Select at least one User, User group, or both, to associate to this policy.
          If you select a user, the User Groups field becomes optional. Similarly, if you select a user group, the Users field becomes optional.
        2. Select the Applications that you want to associate to this policy. Select at least one Application, Application group, or both, to associate to this policy.
          If you select an application, the Application Groups field becomes optional. Similarly, if you select an application group, the Applications field becomes optional.
      5. Select a SAA Profile that for the apps in this policy. When the matching users access the apps in this policy, they will be able to perform the actions that are defined in the selected SAA profile.
      6. Save your settings.
    2. Define a Security policy rule to allow Secure Agentless Access (SAA) traffic through the MU-SPNs so that your users can access the destination IP addresses or FQDNs for the SAA apps.

    © 2026 Palo Alto Networks, Inc. All rights reserved.