Set Up the Secure Agentless Access Portal

1. Navigate to the SAA Portal page.

   • For Prisma Access (Managed by Strata Cloud Manager):
     1. Log in to Strata Cloud Manager as the administrator.
     2. Select ConfigurationSecure Agentless AccessPortal.
   • For Prisma Access (Managed by Panorama):
     1. Launch Secure Agentless Access from the Cloud Services plugin on Panorama by selecting PanoramaCloud ServicesSecure Agentless Access.
     2. Click Get Started.
     3. Select ConfigurationSecure Agentless AccessPortal.
2. Edit the Secure Agentless Access portal settings.

3. Enter the Portal Tab Name. This name will appear on the browser tab for the SAA portal website.
4. Specify the portal domain. The portal domain is the FDQN (URL) that your end users will visit to access their SAA apps. You can enter a subdomain of the default domain (.panwsaa.com) or specify a custom domain.

   1. To use a subdomain of the default domain, select Subdomain and enter the subdomain in the Portal URL field.

   2. To use a custom domain:

      1. Select Custom Domain and enter the FQDN for your custom domain in the Portal URL field.
      2. Specify a Certificate that enables secure access for SAA apps through the custom domain.
         • On Strata Cloud Manager, select or Import a certificate. Selecting Import will open the Certificate Management page where you can select a certificate and import it.
         • On Prisma Access (Managed by Panorama), copy the name of the certificate from Panorama and paste it here.

5. In Max Number of concurrent connections per user, enter the maximum number of SAA apps that a user can connect to at the same time.
6. (Optional) Allow your users to access their own remote apps through the SAA portal.

   1. Select Enable users to define custom apps (Optional).
   2. (Optional) Select a Profile for user defined apps that defines what functions your users can perform while accessing the custom app, such as copy, paste, upload files, or download files. If you do not select a profile, the Default SAA Profile is used.
7. Select an Inactivity Timeout (Minutes) to specify the maximum time in minutes that an RDP, SSH, or VNC application connection can remain idle before being automatically terminated. Select a value of 30, 60, or 120 minutes. (Default: 30 minutes)

   SAA monitors keyboard input, mouse movement, and file transfers to determine user activity. When an application connection has no user interaction for the configured duration, that connection is terminated. If all application connections become idle and exceed the inactivity timeout, the portal session ends and the user will be logged out.

   The inactivity timeout works independently from the maximum session duration, which terminates sessions based on total elapsed time rather than user activity.
8. Select a Max Session Duration (Hours) to specify the maximum time in hours that a user can remain logged in to SAA portal before being automatically logged out. Enter a value between 3 and 24 hours. (Default: 3 hours)

   When the maximum session duration is reached, SAA terminates the portal session and all associated application connections regardless of user activity. Users receive a warning 10 minutes before their session expires. Changes to this setting apply to active sessions within 15 minutes.
9. (Optional) Upload a Portal Logo (Optional) for the SAA portal page. You can either drag and drop an image file or Browse File to upload the image. The supported image types are .jpg and .png. The maximum logo size is 250 KB.
10. Save your settings.